joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be61d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004be26e

Function at 0x4c2c90
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x516808]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c2cd0
cmp byte [ebx], 0xa
jne 0x4c2cd0
or byte [eax + edi + 0x28], 4
jmp 0x4c2cd5
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4c2dd3
mov al, byte [edx]
cmp al, 0x1a
je 0x4c2db5
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4c2d04
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4c2d29
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4c2d33
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4c2ce6
jmp 0x4c2dd3
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c2db0
cmp dword [ebp - 0xc], 0
je 0x4c2db0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x516808]
test byte [eax + edi + 0x28], 0x48
je 0x4c2d8a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4c2d75
mov byte [esi], dl
jmp 0x4c2d86
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x516808]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4c2dd3
cmp byte [ebp - 1], 0xa
jne 0x4c2d99
cmp esi, ebx
jne 0x4c2d99
mov byte [esi], 0xa
jmp 0x4c2dd2
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004b9621
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4c2dd3
mov byte [esi], 0xd
jmp 0x4c2dd2
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x516808]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c2dcf
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c2dd3
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c2ddc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x516808]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c2e1f
cmp word [esi], dx
jne 0x4c2e1f
or byte [edi + eax + 0x28], 4
jmp 0x4c2e24
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4c2f77
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4c2f57
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4c2e66
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4c2e9c
cmp eax, edx
jae 0x4c2ea8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4c2e3e
jmp 0x4c2f77
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c2f53
cmp dword [ebp - 0x14], 0
je 0x4c2f53
mov eax, dword [ebx*4 + 0x516808]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4c2f2b
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4c2ef4
mov word [esi], cx
jmp 0x4c2f27
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x516808]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x516808]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x516808]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4c2f77
pop ebx
cmp word [ebp - 4], bx
jne 0x4c2f3c
cmp esi, dword [ebp + 0xc]
jne 0x4c2f3c
mov word [esi], bx
jmp 0x4c2f74
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004b9621
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4c2f77
push 0xd
jmp 0x4c2f70
mov ecx, dword [ebx*4 + 0x516808]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c2f6e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c2f77
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c56d5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c5651
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4c584d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4c584d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4c57fc
jg 0x4c572e
test eax, eax
je 0x4c57f2
push 1
push 0x1000
call fcn.004b86a6
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4c5754
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4c57e9
push 0x8000
push ebx
call fcn.004b5064
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4c5780
jg 0x4c577b
cmp ecx, 0x1000
jb 0x4c5780
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004b91da
add esp, 0x10
cmp eax, 0xffffffff
je 0x4c57c5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4c577b
jl 0x4c57ac
test ecx, ecx
jne 0x4c576d
push dword [ebp - 0xc]
push ebx
call fcn.004b5064
push esi
call fcn.004b700a
add esp, 0xc
xor edi, edi
jmp 0x4c585e
cmp byte [edi + 0x24], 0
je 0x4c57dc
cmp dword [edi + 0x20], 5
jne 0x4c57dc
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4c57e7
mov edi, dword [edi + 0x18]
jmp 0x4c57e9
xor edi, edi
push esi
call fcn.004b700a
pop ecx
jmp 0x4c585e
test ecx, ecx
jg 0x4c57be
jl 0x4c57fc
test eax, eax
jae 0x4c57be
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004b9621
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4c581f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4c57be
jmp 0x4c5856
push ebx
call fcn.004beabd
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4c57be
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4c585e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4c585b
mov edi, dword [edi + 0x18]
jmp 0x4c585e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004b9621
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c68f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4c691d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4c691d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40fb60
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x401946
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401610
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea ecx, [ebp - 0x18]
xor eax, eax
push ecx
push 0x20006
push eax
lea edx, [ebp - 0x2c]
push 0x40a464
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call edi
push eax
push 0x80000002
call fcn.00409370
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
call esi
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov eax, dword [ebx]

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46c004]
jne 0x40100a
repz ret
jmp fcn.004015e1

Function at 0x40541b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403efa
and dword [ebp - 0x14], 0
cmp dword [0x46ed68], 0
mov dword [ebp - 0x18], eax
jne 0x4054ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405576
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405576
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46ed68], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46ed6c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46ed70], eax
call edi
push eax
call esi
mov dword [0x46ed78], eax
test eax, eax
je 0x4054ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46ed74], eax
mov eax, dword [0x46ed74]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405527
cmp dword [0x46ed78], ecx
je 0x405527
push eax
call esi
push dword [0x46ed78]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405527
test ebx, ebx
je 0x405527
call edi
test eax, eax
je 0x40551e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40551e
test byte [ebp - 8], 1
jne 0x405527
or dword [ebp + 0x10], 0x200000
jmp 0x40555a
mov eax, dword [0x46ed6c]
cmp eax, dword [ebp - 0x18]
je 0x40555a
push eax
call esi
test eax, eax
je 0x40555a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40555a
mov eax, dword [0x46ed70]
cmp eax, dword [ebp - 0x18]
je 0x40555a
push eax
call esi
test eax, eax
je 0x40555a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46ed68]
call esi
test eax, eax
je 0x405576
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405578
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x468730
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x46f2a4]
imul eax, eax, 0x343fd
cmp dword [0x85dc64], 0x139e
mov dword [0x46f2a4], eax
jne 0x46877f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x46f2a4]
add eax, 0x269ec3
push esi
mov dword [0x46f2a4], eax
movzx esi, word [0x46f2a6]
and esi, 0x7fff
cmp dword [0x85dc64], 0x8e7
jne 0x4687b4
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x468800
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x468814
call fcn.00468730
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x468807
pop esi
cmp ebx, 0x2d
jne 0x46882e
mov dword [0x85dff8], 0xa62e7790
mov dword [0x85dffc], 0xffffffff
ret

Function at 0x468830
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x46c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x46d1e8]
push ebx
mov ebx, dword [0x85dc64]
push edi
mov edi, dword [0x85d930]
call fcn.004687d0
cmp dword [0x85dc64], 0x2f
jne 0x468895
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00468800
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x468bc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409fb0
mov eax, dword [0x46c004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x468be9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe0392
jge 0x468c91
cmp dword [0x85dc64], 0xa5f
jne 0x468c35
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.pukayowifepokihevefisuvotilapu
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x845653
jne 0x468c5a
mov eax, dword [0x46e008]
mov dword [0x85dc64], eax
mov ecx, dword [0x85dc64]
add ecx, 0xa231
mov dword [0x85dc64], ecx
cmp dword [0x85dc64], 0x141
jne 0x468c8c
push str.dosexijo_galodiyugakuj_pusofawufumivetew_siwoseze_piguje
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x46f2a8], 0xec58acac
mov dword [0x46f2ac], 0xffffffff
jmp 0x468be0
call fcn.004688b0
jmp dword [0x85d930]
Function at 0x10001485
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x100c697b
call fcn.100b286c
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.100aab52
mov eax, dword [ebp + 8]
xor edi, edi
push 0xa
lea ecx, [esi + 0x30]
mov dword [ebp - 4], edi
mov dword [esi], 0x100df798
mov dword [esi + 0x28], eax
call fcn.10002ddc
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 1
call fcn.1007e247
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.10009968
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
mov dword [esi + 4], edi
call fcn.100099c6
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0x64
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
call fcn.10077b7f
lea ecx, [ebp - 0x10]
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov byte [ebp - 4], 2
call fcn.10009971
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10002154
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.1007e247
call fcn.10019855
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.10019f3a
push eax
lea ecx, [ebp - 0x10]
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
call fcn.1007e410
xor esi, esi
push esi
mov ecx, edi
call fcn.1001b04a
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x100f7140
push 5
push esi
push 0x100f7100
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10002241
cmp dword [ebp - 4], esi
je 0x10002241
lea ecx, [ebp - 0x10]
mov word [ebp - 0x3c], 8
call fcn.1007e558
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x3c]
push edx
mov word [ebp - 0x2c], 0xb
mov word [ebp - 0x24], si
mov word [ebp - 0x4c], si
mov ecx, dword [eax]
push eax
call dword [ecx + 0xdc]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x3c]
push edx
mov word [ebp - 0x2c], 0xb
mov word [ebp - 0x24], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xdc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 1
mov ecx, edi
call fcn.1001b04a
jmp 0x1000224c
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x80004005
mov ecx, edi
call fcn.1001879a
lea ecx, [ebp - 0x10]
call fcn.1007e410
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10002279
Capabilities:
Check mutex on windows
Initialize iwebbrowser2

Disassembly:
mov eax, 0x100c6aa7
call fcn.100b286c
sub esp, 0x58
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
push eax
push 0x100f7140
push 5
push ebx
push 0x100f7100
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x100023c0
cmp dword [ebp - 0x10], ebx
je 0x100023c0
push esi
push edi
call fcn.10019855
mov esi, eax
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.10018b72
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.1007e49f
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x1000238e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000238e
lea ecx, [ebp - 0x1c]
call fcn.1007e247
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10019f3a
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1007e46a
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.1007e410
push ebx
mov ecx, esi
call fcn.1001b04a
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x54], 8
call fcn.1007e558
lea edx, [ebp - 0x64]
push edx
lea edx, [ebp - 0x44]
push edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x54]
push edx
mov word [ebp - 0x44], 0xb
mov word [ebp - 0x3c], 1
mov word [ebp - 0x64], bx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xdc]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov ecx, esi
call fcn.1001b04a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.1007e410
mov ecx, esi
call fcn.1001879a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1007e410
pop edi
pop esi
jmp 0x100023c6
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x100024a6
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7f4]
sub esp, 0x874
mov eax, dword [0x10120240]
push ebx
push esi
mov dword [ebp + 0x7f0], eax
push edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x7fc]
push eax
call dword [sym.imp.ole32.dll_StringFromIID]
xor ebx, ebx
cmp dword [ebp - 0x34], ebx
je 0x10002508
push dword [ebp - 0x34]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x38]
push eax
push 1
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x104
lea eax, [ebp + 0x3e0]
push eax
push dword [0x10121300]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [ebp + 0x80c]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, connect
mov dword [ebp - 0x70], ecx
mov ecx, str.CLSID_sInprocServer32
lea edx, [ebp + 0x3e0]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], str.CLSID_s
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], str.ThreadingModel
mov dword [ebp - 0x50], str.Apartment
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp + 0x80c], eax
lea esi, [ebp - 0x70]
lea eax, [ebp - 0x30]
push eax
push dword [esi - 8]
lea eax, [ebp + 0x1d8]
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp + 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000262f
lea eax, [ebp + 0x3e0]
push eax
push dword [esi]
lea eax, [ebp + 0x5e8]
push eax
call edi
add esp, 0xc
lea eax, [ebp + 0x5e8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 1]
push eax
lea eax, [ebp + 0x5e8]
push eax
push 1
push ebx
push dword [esi - 4]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 4]
add esi, 0x10
cmp eax, ebx
mov dword [ebp + 0x80c], eax
jne 0x10002581
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x7f0]
pop edi
pop esi
pop ebx
call fcn.100b29c1
add ebp, 0x7f4
leave
ret
xor eax, eax
jmp 0x10002619