joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70278a30
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, eax
xor eax, eax
xor ebx, ebx
mov ecx, esi
push edi
mov dword [esp + 0xc], ebx
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x70278a45
sub ecx, edi
mov edi, ecx
jne 0x70278a5b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, edi
and ecx, 0x80000003
jns 0x70278a6a
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x70278a52
xor ecx, ecx
push ebp
test edi, edi
jle 0x70278a90
mov dl, byte [ecx + esi]
cmp dl, 0x3d
je 0x70278a8b
movsx edx, dl
cmp byte [edx + 0x703528c8], 0xff
je 0x70278bb0
inc ecx
cmp ecx, edi
jl 0x70278a73
mov al, byte [edi + esi - 1]
cmp al, 0x3d
jne 0x70278ab0
mov ebx, 1
mov dword [esp + 0x10], ebx
cmp byte [edi + esi - 2], al
jne 0x70278ab0
mov ebx, 2
mov dword [esp + 0x10], ebx
lea eax, [edi - 4]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ebp, edi
sub ebp, eax
sub ebp, ebx
push ebp
call fcn.702e20da
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x70278adb
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edx, edx
mov ecx, eax
test edi, edi
jle 0x70278ba0
jmp 0x70278af0
movsx ebx, byte [esi]
movsx eax, byte [esi + 1]
mov bl, byte [ebx + 0x703528c8]
mov al, byte [eax + 0x703528c8]
add bl, bl
shr al, 4
add bl, bl
add al, bl
mov byte [ecx], al
lea eax, [edi - 4]
cmp edx, eax
jne 0x70278b50
mov eax, dword [esp + 0x10]
test eax, eax
je 0x70278b50
cmp eax, 1
jne 0x70278b45
movsx eax, byte [esi + 2]
movsx ebx, byte [esi + 1]
mov al, byte [eax + 0x703528c8]
mov bl, byte [ebx + 0x703528c8]
shr al, 2
shl bl, 4
add al, bl
mov byte [ecx + 1], al
mov eax, dword [esp + 0x10]
mov ebx, 3
sub ebx, eax
add ecx, ebx
jmp 0x70278b8e
movsx eax, byte [esi + 2]
movzx eax, byte [eax + 0x703528c8]
movsx ebx, byte [esi + 1]
mov bl, byte [ebx + 0x703528c8]
shr al, 2
shl bl, 4
add al, bl
mov byte [ecx + 1], al
movsx eax, byte [esi + 2]
movzx eax, byte [eax + 0x703528c8]
movsx ebx, byte [esi + 3]
shl al, 6
add al, byte [ebx + 0x703528c8]
add ecx, 3
mov byte [ecx - 1], al
add edx, 4
add esi, 4
cmp edx, edi
jl 0x70278af0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov byte [eax + ebp - 1], 0
test ecx, ecx
je 0x70278bb0
dec ebp
mov dword [ecx], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x70279670
Capabilities:
Create thread

Disassembly:
sub esp, 0x210
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push esi
push edi
mov edi, ecx
push str..exe_http:
push edi
call ebp
mov esi, eax
test esi, esi
je 0x70279771
push 0x208
lea eax, [esp + 0x14]
push 0
push eax
call fcn.702e95e0
add esp, 0xc
push 0x5c
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrIW]
test eax, eax
je 0x70279771
sub esi, eax
add esi, 6
cmp esi, 0x208
ja 0x702796f5
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x702796e7
xor ecx, ecx
mov word [esp + 0x10], cx
jmp 0x702796f5
lea ecx, [eax + 2]
mov eax, esi
lea edx, [esp + 0x10]
call fcn.70279790
push ebx
lea ebx, [esp + 0x14]
call fcn.70279630
pop ebx
test eax, eax
je 0x70279771
push str.http:
push edi
call ebp
mov edi, eax
test edi, edi
je 0x70279771
push 0x1000
call fcn.702e20da
mov esi, eax
add esp, 4
test esi, esi
je 0x70279771
push 0x1000
push 0
push esi
call fcn.702e95e0
add esp, 0xc
push edi
mov eax, SysReAllocString
mov ecx, 0x800
mov edx, esi
call fcn.7020f5f0
lea edx, [esp + 0xc]
push edx
push 0
push esi
push 0x70279530
push 0
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x70279771
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.702e1c2f
add esp, 0x210
ret
Function at 0x70279f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x703153d8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
cmp ebx, edi
jne 0x70279f5d
mov eax, 0x80004005
jmp 0x7027a030
mov eax, dword [0x703548b4]
mov dword [ebp - 0x14], edi
cmp eax, 0xffffffff
je 0x7027a020
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
cmp eax, edi
je 0x70279f8b
mov dword [ebp + ecx*4 - 0x14], eax
mov eax, dword [eax + 0x1f0]
inc ecx
cmp ecx, 1
jb 0x70279f77
cmp ecx, 1
jne 0x7027a020
mov esi, dword [ebp - 0x14]
cmp esi, edi
je 0x7027a020
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], edi
call fcn.7023f9d0
test eax, eax
je 0x7027a018
mov ebx, dword [ebp - 0x14]
cmp ebx, edi
je 0x70279fdd
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x70279ff0
xor eax, eax
mov ebx, eax
call fcn.702078c0
lea eax, [ebp - 0x14]
call fcn.7020c950
jmp 0x7027a02e
lea edi, [eax + eax]
mov eax, edi
call fcn.702e98d0
mov esi, esp
xor edx, edx
mov ecx, edi
mov eax, ebx
call fcn.7020c920
mov ebx, eax
call fcn.702078c0
lea eax, [ebp - 0x14]
call fcn.7020c950
jmp 0x7027a02e
lea eax, [ebp - 0x14]
call fcn.7020c950
mov ecx, 0xb
xor edx, edx
mov word [ebx], cx
mov word [ebx + 8], dx
xor eax, eax
lea esp, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret 4
Function at 0x7027a650
Capabilities:
Create directory
Get common file path
Write file on windows

Disassembly:
sub esp, 0x420
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebp
mov ebp, dword [esp + 0x428]
push esi
xor esi, esi
push 0x208
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x14], esi
call fcn.702e95e0
push 0x208
lea ecx, [esp + 0x22c]
push esi
push ecx
call fcn.702e95e0
add esp, 0x18
lea edx, [esp + 0x14]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.paramfile
lea eax, [esp + 0x18]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x21c]
push eax
push esi
push str.param
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x7027a7b4
push esi
push 0x80
push 2
push esi
push 2
push 0x40000000
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x7027a7b4
push edi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jle 0x7027a7a8
push edi
call fcn.702df932
mov esi, eax
add esp, 4
test esi, esi
je 0x7027a7a4
push edi
push 0
push esi
call fcn.702e95e0
add esp, 0xc
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push esi
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov eax, 0x7032fc38
call fcn.7020f580
push ebx
lea eax, [esp + 0x224]
call fcn.70219390
push esi
mov dword [esp + 0x10], 1
call fcn.702e1ea6
add esp, 4
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x424]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.702e1c2f
add esp, 0x420
ret

Function at 0x7027d4a0
Capabilities:
Encode data using xor

Disassembly:
test esi, esi
je 0x7027d4e8
test edi, edi
je 0x7027d4e8
cmp byte [0x703593d0], 0
jne 0x7027d4be
push 0x703593d0
call fcn.70215770
add esp, 4
push 0x703593d0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 8
mov cl, byte [0x703593d7]
jge 0x7027d4d6
mov cl, 0x6d
xor eax, eax
test edi, edi
jbe 0x7027d4e8
lea esp, [esp]
xor byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x7027d4e0
ret
Function at 0x7027e720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70315e00
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
xor ebx, ebx
mov ecx, 1
mov dword [ebp - 0x14], ecx
cmp eax, ebx
je 0x7027e7c5
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x7027e7c5
cmp dword [ebp + 0x14], ebx
je 0x7027e7c5
mov edi, dword [ebp + 0x10]
push ebx
lea ecx, [ebp + 0xc]
push ecx
push edi
push esi
mov dword [ebp - 4], ebx
push eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x7027e78f
call fcn.7020df50
cmp eax, ebx
jne 0x7027e7db
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 1
jne 0x7027e79d
call fcn.7027d4a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
cmp eax, ebx
je 0x7027e7db
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x7027e930
Capabilities:
Read file on windows

Disassembly:
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x7027e94e
call fcn.7020df50
ret 4
xor eax, eax
ret 4
Function at 0x7027fab0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x70318e0b
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x834]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, edx
cmp dword [0x70371010], ebx
jne 0x7027fc26
cmp byte [0x7034d3e7], bl
je 0x7027fc26
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x83c], ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0xf8]
lea edx, [esp + 0x14]
push edx
call eax
test eax, eax
je 0x7027fc12
cmp dword [esp + 0x28], ebx
je 0x7027fc12
push 0x800
lea ecx, [esp + 0x34]
push ebx
push ecx
call fcn.702e95e0
mov eax, dword [esi + 0x88]
push eax
mov eax, 0x400
lea edx, [esp + 0x40]
call fcn.7023dce0
add esp, 0x10
test eax, eax
jne 0x7027fb78
lea ecx, [esp + 0x14]
call fcn.7020cb20
jmp 0x7027fc26
push 0x38
call fcn.702e1f8d
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x7027fb6a
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
xor edx, edx
mov word [esi + 4], dx
lea edi, [esi + 0x1c]
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push esi
lea eax, [esp + 0x34]
mov byte [edi + 4], bl
call fcn.7020f580
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.7020c5f0
lea ecx, [esp + 0x10]
push ecx
push ebx
push esi
push 0x7027f470
push ebx
push ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, ebx
je 0x7027fbfb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.7020cb20
mov eax, 1
jmp 0x7027fc28
mov eax, esi
call fcn.7027fa40
lea ecx, [esp + 0x14]
call fcn.7020cb20
mov eax, 1
jmp 0x7027fc28
cmp dword [esp + 0x2c], 0x10
jb 0x7027fc26
mov edx, dword [esp + 0x18]
push edx
call fcn.702e1c24
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x834]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x830
ret

Function at 0x70280110
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, 0x70351fbc
mov ebx, 3
lea ecx, [ecx]
lea ecx, [esi - 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x70280128
sub eax, edi
mov edx, eax
lea eax, [esi - 0x20]
test eax, eax
je 0x70280149
xor eax, eax
test edx, edx
jbe 0x70280149
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x70280140
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x70280150
sub eax, edx
mov ecx, eax
test esi, esi
je 0x7028016e
xor eax, eax
test ecx, ecx
jbe 0x7028016e
xor byte [esi + eax], 6
inc eax
cmp eax, ecx
jb 0x70280165
lea ecx, [esi + 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x70280176
sub eax, edi
mov edx, eax
test ecx, ecx
je 0x70280199
xor eax, eax
test edx, edx
jbe 0x70280199
jmp 0x70280190
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x70280190
add esi, 0x6c
sub ebx, 1
jne 0x70280120
pop edi
pop esi
pop ebx
ret
Function at 0x702801b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov ecx, str.bop_qtgvvct8bop_s8uvgh_suct8g_sh
mov edi, 3
lea esp, [esp]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x702801c5
sub eax, esi
mov edx, eax
test ecx, ecx
je 0x702801e9
xor eax, eax
test edx, edx
jbe 0x702801e9
lea ebx, [ebx]
xor byte [ecx + eax], 6
inc eax
cmp eax, edx
jb 0x702801e0
add ecx, 0x68
sub edi, 1
jne 0x702801c0
pop edi
pop esi
ret

Function at 0x70280e50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, 0x70351e74
mov ebx, 3
lea ecx, [ecx]
lea ecx, [esi - 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x70280e68
sub eax, edi
mov edx, eax
lea eax, [esi - 0x20]
test eax, eax
je 0x70280e89
xor eax, eax
test edx, edx
jbe 0x70280e89
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x70280e80
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x70280e90
sub eax, edx
mov ecx, eax
test esi, esi
je 0x70280eae
xor eax, eax
test ecx, ecx
jbe 0x70280eae
xor byte [esi + eax], 6
inc eax
cmp eax, ecx
jb 0x70280ea5
lea ecx, [esi + 0x20]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x70280eb6
sub eax, edi
mov edx, eax
test ecx, ecx
je 0x70280ed9
xor eax, eax
test edx, edx
jbe 0x70280ed9
jmp 0x70280ed0
xor byte [eax + ecx], 6
inc eax
cmp eax, edx
jb 0x70280ed0
add esi, 0x6c
sub ebx, 1
jne 0x70280e60
pop edi
pop esi
pop ebx
ret
Function at 0x70281c10
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x220
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [0x70357588]
push esi
cmp eax, 0xffffffff
je 0x70281c4e
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
pop esi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x220
ret
xor esi, esi
cmp dword [0x70359484], esi
je 0x70281c66
mov edx, dword [0x70371034]
cmp dword [0x70359484], edx
je 0x70281c94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x70359488]
cmp ecx, eax
jae 0x70281c80
add ecx, 0x1388
cmp ecx, eax
jae 0x70281c94
mov dword [0x70359488], eax
call fcn.702264e0
mov eax, dword [0x70371034]
mov dword [0x70359484], eax
cmp byte [0x7034d493], 0
je 0x70281d6a
mov eax, 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push str.WDBlockCheatInPage
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x70281cfb
push str.WDBlockCheatInPage
push str.SOFTWARE360Safe_safemon
mov eax, 1
call fcn.70216870
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x70281d6a
push 0x208
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.Adfilter.dll
push 0x70359d48
lea edx, [esp + 0x18]
push edx
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x70281d3a
lea esi, [eax + 1]
jmp 0x70281d6a
push str.adfilterextadfilter.ini
push 0x70359d48
lea ecx, [esp + 0x18]
push ecx
call esi
lea edx, [esp + 0x10]
push edx
push 1
push str.1000
push str.UrlRules
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
dec esi
neg esi
sbb esi, esi
inc esi
mov ecx, dword [esp + 0x21c]
xor eax, eax
test esi, esi
setne al
mov dword [0x70357588], eax
mov eax, esi
pop esi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x220
ret
Function at 0x70283f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x70316d08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esp + 0x38], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0xe8]
lea edx, [esp + 0xc]
push edx
call eax
test eax, eax
je 0x70284038
cmp dword [esp + 0x20], 0
je 0x70284038
lea edi, [esi + 0x130c]
push edi
lea ecx, [esp + 0x10]
call fcn.70281eb0
test eax, eax
jne 0x70283fc3
push edi
call fcn.70244c60
cmp dword [esp + 0x24], 0x10
jb 0x7028404c
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x70284044
cmp dword [esi + 0x1308], 0
je 0x70283ffc
mov edx, dword [esi + 0x70]
push edx
push edi
call fcn.702821f0
cmp dword [esi + 0xcc], 0
je 0x7028401d
mov ecx, esi
call fcn.70289f00
test eax, eax
je 0x7028401d
mov eax, dword [esi + 0xa4]
push 0
push 0x1f4
push 0x13
push eax
jmp 0x70284017
mov ecx, esi
call fcn.70289f00
test eax, eax
je 0x7028401d
mov ecx, dword [esi + 0xa4]
push 0
push 0x12c
push 0x12
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [esp + 0x24], 0x10
jb 0x70284031
mov edx, dword [esp + 0x10]
push edx
call fcn.702e1c24
add esp, 4
mov eax, 1
jmp 0x7028404e
cmp dword [esp + 0x24], 0x10
jb 0x7028404c
mov eax, dword [esp + 0x10]
push eax
call fcn.702e1c24
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret
Function at 0x70284320
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x70310058
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c]
mov esi, ecx
lea edi, [esi + 0x1350]
call fcn.702444b0
cmp byte [0x7034d407], 0
je 0x70284451
test byte [0x7036e624], 1
jne 0x70284391
or dword [0x7036e624], 1
call fcn.7021b8d0
push 0x7031ac80
call fcn.702e1d65
add esp, 4
mov eax, 0x7036e628
call fcn.7021c7c0
test eax, eax
je 0x70284451
mov eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.IEWebShopping
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp dword [esp + 0x10], eax
setne al
test eax, eax
je 0x70284451
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
mov dword [esp + 0x44], 0
mov eax, dword [ebp]
mov edx, dword [eax + 0x104]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call edx
test eax, eax
je 0x70284448
cmp dword [esp + 0x30], 0
je 0x70284448
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.7020c5f0
call fcn.70242520
lea ecx, [esp + 0x1c]
call fcn.7020cb20
mov eax, 1
jmp 0x70284453
lea ecx, [esp + 0x1c]
call fcn.7020cb20
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x38
ret 4

Function at 0x70286050
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
push 0x18
call fcn.702e1f8d
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
je 0x702860d3
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push esi
mov dword [esi + 8], 0x3e8
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
call edi
lea eax, [esp + 0xc]
push eax
push ebx
push esi
push 0x70285e80
push ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, ebx
jne 0x702860db
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70286100
push esi
call fcn.702e1c24
add esp, 4
jmp 0x70286100
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x702860ed
mov ebx, dword [esi + 4]
jmp 0x702860f9
cmp eax, 0x102
jne 0x702860f9
mov ebx, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
test eax, eax
jne 0x70286115
push esi
call fcn.702e1c24
add esp, 4
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 0xc
Function at 0x702862b0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x70318ddb
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
push 0x38
call fcn.702e1f8d
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
test eax, eax
je 0x702862fb
push eax
call fcn.702863a0
mov esi, eax
jmp 0x702862fd
xor esi, esi
mov dword [esp + 0x20], 0xffffffff
test esi, esi
jne 0x7028631d
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x70286322
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
call fcn.7020f4d0
mov ax, word [edi]
lea ecx, [esi + 0x20]
lea ebx, [edi + 4]
push ecx
mov word [esi + 0x1c], ax
call fcn.7025e430
lea edx, [esp + 0x14]
push edx
push 0
push esi
push 0x70286120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x70286377
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x70286385
call fcn.70286250
push esi
call fcn.702e1c24
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x7028a890
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
mov esi, eax
mov eax, dword [esi + 0x70]
push edi
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x94]
call eax
test eax, eax
jl 0x7028a912
cmp dword [esp + 0xc], 0
je 0x7028a912
mov ecx, dword [esi + 0x70]
lea edi, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.702035e0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x7028a912
push 0
push str.IE_ToolBar_Wnd
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x7028a912
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x7028a912
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
add esp, 0x14
ret