joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473890
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4aad13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0049d44f
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x4b4948
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x4b4890
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call fcn.005056f2
nop
push eax
mov ecx, edi
call fcn.004a2ae7
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004a40fa
test eax, eax
je 0x4739ac
mov ecx, dword [esp + 0x3c]
call fcn.004a2b14
mov ecx, dword [esi + 0x1c]
mov ebp, dword [fcn.004ac3f8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x473970
push edi
mov ecx, esi
call fcn.004a0181
mov ecx, esi
call fcn.00473b50
cmp dword [esp + 0x38], 1
jne 0x4739a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004a02bc
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x475b80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x475bb3
push esi
call fcn.00478cf0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x475bac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x475c39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x475c22
mov eax, dword [esi + 8]
test eax, eax
je 0x475bd7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x475c1e
cmp eax, 2
je 0x475c22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x475bca
cmp eax, 3
je 0x475bfd
cmp eax, 1
jne 0x475bca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x475bca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x475bca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00475c60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x475c48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00475c60
add esp, 4
pop esi
ret
Function at 0x502e03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x503efd
pushfd
mov byte [esp], dh
pushal
mov dword [esp + 0x20], eax
movzx ax, al
lahf
mov eax, dword [0x4ac53c]
pushal
push 0x1a2f677
lea esp, [esp + 0x44]
call fcn.0050abcc
jmp 0x508115
call fcn.004fb29a

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x459828f6
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x631f1123
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4023a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x80
mov edi, ecx
push 0
push edi
call fcn.004043c0
add esp, 0xc
mov dword [edi + 0x80], 0
sub cl, 0x2c
add al, cl
mov al, byte [esp - 0x13]
xor esi, esi
mov al, cl
mov ax, 0x4c
mov dx, word [esp - 0x5b]
xor dx, word [esp - 0xa]
mov ebx, dword [ebp + 0xc]
xor dx, ax
mov edx, ecx
mov ax, word [esp - 0x20]
add cl, 0xc
sub cl, 0x15
xor al, 0x1e
mov cx, dx
add ecx, 0x1f0
sub cl, al
xor ecx, eax
xor edx, edx
mov eax, esi
div ebx
mov eax, dword [ebp + 8]
mov dl, byte [edx + eax]
mov cl, 0x16
sub cl, byte [esp - 0x21]
sub eax, edx
mov ax, word [esp - 0x3a]
add cx, 0x4c
mov byte [esi + edi], dl
mov cx, 0x6b
mov ecx, dword [esp - 0x13]
inc esi
cmp esi, 0x80
jb 0x4023e0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10001c56
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x854
mov eax, dword [0x10017114]
xor eax, esp
mov dword [esp + 0x850], eax
mov eax, dword [esp + 0x85c]
push esi
push edi
mov edi, dword [esp + 0x860]
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.gdi32.dll_SaveDC]
push 2
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.gdi32.dll_SetGraphicsMode]
push 1
xor esi, esi
push esi
push edi
call dword [sym.imp.gdi32.dll_ModifyWorldTransform]
push esi
push esi
push esi
push edi
call dword [sym.imp.gdi32.dll_SetViewportOrgEx]
push esi
push esi
push esi
push edi
call dword [sym.imp.gdi32.dll_SetWindowOrgEx]
mov esi, dword [sym.imp.gdi32.dll_GetDeviceCaps]
push 0x58
push edi
call esi
push 0x5a
push edi
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x20], xmm0
call esi
movss xmm0, dword [esp + 0x18]
mulss xmm0, dword [0x100104e0]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x100104f8]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x86c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x100104f8]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.gdi32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
xor ecx, ecx
cvtdq2pd xmm0, xmm0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov byte [esp + 0x30], cl
mov dword [esp + 0x32], ecx
mov word [esp + 0x36], cx
andps xmm0, xmmword [0x10010500]
divsd xmm0, qword [0x100104f0]
addsd xmm0, qword [0x100104e8]
cvttsd2si eax, xmm0
neg eax
cmp dword [esp + 0x870], ecx
mov dword [esp + 0x1c], eax
mov ecx, 0x800
mov eax, dword [esp + 0x86c]
setne byte [esp + 0x31]
push ecx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x5c]
push eax
push 0x1002
push ecx
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [esp + 0x5c]
push str.Japan
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [esp + 0x38]
je 0x10001dbc
push dword [esp + 0x14]
jmp 0x10001dc1
push str.MS_UI_Gothic
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectA]
push dword [esp + 0x10]
mov esi, eax
push edi
call dword [sym.imp.gdi32.dll_RestoreDC]
mov ecx, dword [esp + 0x858]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1000be75
add esp, 0x854
ret 0x14
Function at 0x10007fc2
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
mov eax, dword [0x10017114]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x128]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x1c], ecx
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0xc], ebp
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.1000ccc2
mov esi, eax
test esi, esi
jne 0x100080a1
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push dword [esp + 0x28]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call ebp
test eax, eax
jne 0x10008079
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10007fc2
mov esi, eax
test esi, esi
jne 0x100080a1
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call ebp
test eax, eax
je 0x1000803e
jmp 0x1000807b
xor esi, esi
cmp dword [esp + 0xc], 0
je 0x10008090
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.100055fb
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x100080b2
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x128]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be75
add esp, 0x120
ret 4
Function at 0x1000952d
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000958f
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x1000959f
push 0xd
pop eax
jmp 0x100095d5
push esi
push edi
xor esi, esi
mov edi, edx
push ebp
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100095ab
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x100095a6
pop ebp
push esi
push edx
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x1000189d
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1001b0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.10006f20
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.mshtml.dll
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.100057a7
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x214], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x10001986
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x10001986
push edi
push ebx
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1000197f
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1001872c
push edi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1000197f
cmp dword [ebp - 0x210], esi
je 0x1000197f
mov eax, dword [ebp - 0x218]
movzx esi, word [eax + 0xa]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000486f
leave
ret

Function at 0x10001b15
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1001b0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1388000
mov ebx, ecx
call fcn.10005252
mov esi, eax
pop ecx
test esi, esi
je 0x10001b9c
push edi
push 0x9c4000
xor edi, edi
push edi
push esi
call fcn.10006f20
add esp, 0xc
push edi
push edi
push edi
push edi
push str.GetJSCodeClient
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x10001b9b
xor eax, eax
push eax
push SysReAllocString
push eax
push eax
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
test ebx, ebx
je 0x10001b94
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x9c4000
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000486f
leave
ret
Function at 0x100020e0
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.1000c4d0
mov eax, dword [0x1001b0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x1046
mov word [ebp - 0x145c], ax
xor ebx, ebx
lea eax, [ebp - 0x145a]
push ebx
push eax
call fcn.10006f20
push dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x145c]
push esi
push str._s_rnd_d
push eax
call fcn.10001880
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.10006f20
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.10006f20
add esp, 0x34
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x10018870
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x20c]
push eax
push ecx
lea eax, [ebp - 0x145c]
push eax
mov edi, ebx
call fcn.100043c7
test eax, eax
je 0x100022a4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.count
push 0x10018894
call esi
push 0x155f4
call fcn.10005252
mov edi, eax
pop ecx
test edi, edi
je 0x10002297
push 0x155f4
push ebx
push edi
call fcn.10006f20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.type
mov ebx, str.Config
push ebx
call esi
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.scope
push ebx
call esi
mov dword [edi + 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.control
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [edi + 8], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1048
lea eax, [edi + 0xc]
push eax
push 0x10018598
push 0x100188dc
push ebx
call esi
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0xa2d0
push ebx
lea eax, [edi + 0x1054]
push eax
push 0x10018598
push str.clist
push str.Config
call esi
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [edi + 0xb324]
push eax
push 0x10018598
push str.mlist
push str.Config
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000486f
leave
ret 4
Function at 0x10002340
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1001b0e0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0xf01ff
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100023c9
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100023c9
mov eax, dword [esp + 0xc]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
push edi
push edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [esp + 8], edi
je 0x100023d9
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.100020e0
mov esi, eax
test esi, esi
je 0x1000240d
cmp dword [esi + 4], 1
jne 0x100023fa
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, esi
mov ecx, eax
call fcn.1000201f
push esi
push 0x100022b7
call dword [sym.imp.USER32.dll_EnumWindows]
push esi
call fcn.1000557b
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.1000486f
mov esp, ebp
pop ebp
ret 4

Function at 0x10002689
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.1000c4d0
mov eax, dword [0x1001b0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x1001f538
push esi
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100026c8
mov ecx, esi
call fcn.100040b9
jmp 0x100026ca
mov eax, edi
test eax, eax
jne 0x100027af
sub esp, 0xc
call fcn.100024e9
test al, al
je 0x100027a5
push 0x1001f530
push 0xffffffffffffffeb
push dword [0x1001f530]
call dword [sym.imp.USER32.dll_SetWindowLongW]
call fcn.10002604
test al, al
je 0x100027a5
push str.hwnd_mini_site
push dword [0x1001f530]
call dword [sym.imp.gui.dll_GetPluginByName]
mov esi, eax
push esi
call dword [sym.imp.gui.dll_Plugin_IsValid]
test eax, eax
je 0x100027a5
push dword [0x1001f534]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x190]
xor eax, eax
push 0x1046
mov word [ebp - 0x104c], ax
lea eax, [ebp - 0x104a]
push edi
push eax
call fcn.10006f20
add esp, 0xc
push 0x100189d8
call fcn.10001720
push eax
lea eax, [ebp - 0x104c]
push str._s_s_minisite.html
push eax
call fcn.10001880
add esp, 0x10
lea eax, [ebp - 0x104c]
push edi
push eax
push dword [0x1001f534]
call dword [sym.imp.wbcom.dll_Ordinal_5]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x1001f534]
call esi
push 5
push dword [0x1001f530]
call esi
mov eax, dword [0x1001f530]
jmp 0x100027b1
mov dword [0x1001d24c], 1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000486f
leave
ret
Function at 0x100029a3
Capabilities:
Acquire debug privileges
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x100029b2
pop ebp
jmp fcn.10002340
pop ebp
ret 4

Function at 0x10002b09
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.wbcom.dll_Ordinal_30]
mov dword [0x1001d250], 1
xor eax, eax
pop esi
ret 0xc

Function at 0x100031f9
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001b0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0x10]
push 0
call esi
push 1
mov dword [ebp - 0x18], eax
call esi
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp + 8]
sub eax, dword [ebp + 0xc]
push 0x10018598
lea ecx, [esi - 0xa]
mov dword [edi], ecx
push 0x10018ac4
mov dword [ebp - 0x18], eax
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x10003289
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, 0xc8
cmp eax, ecx
jge 0x10003268
sub dword [ebx], eax
jmp 0x10003289
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cmp eax, ecx
jge 0x10003276
sub dword [edi], eax
jmp 0x10003289
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000486f
leave
ret 0x10
Function at 0x1000329a
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11fc
call fcn.1000c4d0
mov eax, dword [0x1001b0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xffffffffffffffeb
push ecx
mov edi, edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
test esi, esi
je 0x100033de
push ebx
xor eax, eax
push 0x18e
mov word [ebp - 0x1f8], ax
xor ebx, ebx
lea eax, [ebp - 0x1f6]
push ebx
push eax
call fcn.10006f20
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x1f8]
push 0x10018b50
push eax
call fcn.10003b75
xor eax, eax
push 0xffe
mov word [ebp - 0x11f8], ax
lea eax, [ebp - 0x11f6]
push ebx
push eax
call fcn.10006f20
push edi
mov edi, 0x800
lea eax, [ebp - 0x11f8]
push edi
push eax
call fcn.10005813
push str._tmp
lea eax, [ebp - 0x11f8]
push edi
push eax
call fcn.100057a7
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x11f8]
push edi
push eax
call fcn.100057a7
push str.adid
lea eax, [ebp - 0x11f8]
push edi
push eax
call fcn.100057a7
add esp, 0x48
push dword [esi + 0x30]
lea eax, [ebp - 0x11f8]
push edi
push eax
call fcn.100057a7
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push str.WEATHER
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x100033dd
push ebx
push SysReAllocString
push ebx
push ebx
lea eax, [ebp - 0x11f8]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
jne 0x100033b7
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x100033dd
lea eax, [ebp - 0x11fc]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push esi
mov dword [ebp - 0x11fc], ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000486f
leave
ret