joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10076dcd
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jne 0x10076de3
xor eax, eax
jmp 0x10076e4f
push ebx
push str.55E0EDFC_C641_42f6_8FB4_879D6B792559
push edi
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, edi
je 0x10076e4b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10076e44
mov esi, dword [esi + 8]
lea ecx, [esi + 0x814]
cmp ecx, edi
je 0x10076e3d
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 1
mov esi, ecx
mov ecx, dword [esi]
cmp ecx, edi
je 0x10076e3a
mov dword [edx + eax*4], ecx
inc eax
add esi, 4
cmp eax, 0x3e8
jl 0x10076e24
jmp 0x10076e3d
mov dword [edx + eax*4], edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x10076edb
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x10076ee9
xor eax, eax
jmp 0x10076f32
push edi
push str.AB7C7D1F_DA44_4524_9F0F_8FD206274D7A
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x10076f2f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10076f28
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [eax + 0x17b8], ecx
inc ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4

Function at 0x10076f38
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x10076f46
xor eax, eax
jmp 0x10076f91
push edi
push str.AB7C7D1F_DA44_4524_9F0F_8FD206274D7A
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x10076f8e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10076f87
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x17b8]
mov ecx, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [ecx], eax
inc ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4
Function at 0x10076f96
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x10076fa5
xor eax, eax
jmp 0x10076ff8
push edi
push str.A4219FCC_A677_4304_90E9_9E8FFD251C27
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x10076ff5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10076fee
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x17c0], ecx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [eax + 0x17c4], ecx
inc ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 8

Function at 0x10076ffd
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x1007700c
xor eax, eax
jmp 0x10077060
push edi
push str.A4219FCC_A677_4304_90E9_9E8FFD251C27
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x1007705d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10077056
mov eax, dword [esi + 8]
mov edx, dword [eax + 0x17c0]
mov ecx, dword [esp + 0x10]
mov dword [ecx], edx
mov eax, dword [eax + 0x17c4]
xor ebx, ebx
push edi
mov dword [ecx + 4], eax
inc ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4

Function at 0x10077081
Capabilities:
Check mutex on windows

Disassembly:
push 0x10
mov eax, 0x1013fd76
call fcn.1010191b
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
jne 0x100770b1
lea ecx, [ebp + 8]
call fcn.100015d9
mov eax, ebx
lea esp, [ebp - 0x2c]
call fcn.1010199e
ret 8
push str.0CFD92D0_DF92_4576_804D_CBC56D65DD08
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x1007715e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10077155
cmp dword [ebp + 8], ebx
mov edi, dword [esi + 8]
je 0x1007714c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x1007714c
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push dword [ebp + 8]
push eax
call fcn.1000c619
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x1007714c
mov esi, 0x100
push esi
lea ebx, [edi + 0x17c8]
push 0
push ebx
call fcn.101027c0
push dword [ebp - 0x1c]
push 0x10153b9c
push 0xffffffffffffffff
push esi
push ebx
call fcn.1010314f
mov eax, dword [ebp + 0xc]
add esp, 0x20
mov dword [edi + 0x18c8], eax
mov dword [ebp - 0x14], 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x14]
jmp 0x1007709c
Function at 0x10077166
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x1013fda3
call fcn.1010191b
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
jne 0x10077196
lea ecx, [ebp + 8]
call fcn.100015d9
mov eax, ebx
lea esp, [ebp - 0x28]
call fcn.1010199e
ret 4
push str.1527EF2E_D6CD_4f03_B7C8_EBD258F7073B
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x10077242
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10077239
cmp dword [ebp + 8], ebx
mov esi, dword [esi + 8]
je 0x10077230
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x10077230
lea edi, [eax + eax]
mov eax, edi
call fcn.10102de0
mov eax, esp
push ebx
push edi
push dword [ebp + 8]
push eax
call fcn.1000c619
mov edi, eax
cmp edi, ebx
je 0x10077230
push dword [ebp + 8]
push str.SetErrorTxt:_s_n
push 2
call fcn.100c93e3
push 0x4d
add esi, 0x18cc
push ebx
push esi
call fcn.101027c0
push edi
push 0x10153b9c
push 0xffffffffffffffff
push 0x4d
push esi
call fcn.1010314f
add esp, 0x2c
mov dword [ebp - 0x18], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x18]
jmp 0x10077181

Function at 0x10077292
Capabilities:
Check mutex on windows

Disassembly:
push 4
mov eax, 0x1013fdd0
call fcn.101018b2
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jne 0x100772bc
lea ecx, [ebp + 8]
call fcn.100015d9
mov eax, edi
call fcn.1010198a
ret 8
push str.0C7DC658_EC69_48a5_9084_5261BD6F8A92
push edi
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x100772aa
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1007732a
cmp dword [ebp + 0xc], edi
mov esi, dword [esi + 8]
je 0x100772f7
mov dword [esi + 0x804], edi
xor edi, edi
inc edi
jmp 0x10077321
push edi
lea ecx, [ebp + 8]
call fcn.10001a82
push eax
push 0x1015719c
push 0xffffffffffffffff
push 0x400
push esi
call fcn.10101c5e
xor eax, eax
add esp, 0x14
inc eax
mov edi, eax
mov dword [esi + 0x804], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100772aa
Function at 0x10077383
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x10077392
xor eax, eax
jmp 0x100773e3
push edi
push str.0C7DC658_EC69_48a5_9084_5261BD6F8A92
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x100773e0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100773d9
mov esi, dword [esi + 8]
cmp dword [esi + 0x804], ebx
je 0x100773d2
mov ecx, dword [esp + 0x10]
xor ebx, ebx
push esi
inc ebx
call fcn.10001cbf
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4

Function at 0x100773e8
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x100773f7
xor eax, eax
jmp 0x10077452
push edi
push str.0CFD92D0_DF92_4576_804D_CBC56D65DD08
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x1007744f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10077448
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x17c8]
push eax
call fcn.100274f6
mov eax, dword [esi + 0x18c8]
mov ecx, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [ecx], eax
inc ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 8

Function at 0x10077457
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x10077466
xor eax, eax
jmp 0x100774c7
push edi
push str.1527EF2E_D6CD_4f03_B7C8_EBD258F7073B
push ebx
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
cmp edi, ebx
je 0x100774c4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100774bd
mov eax, dword [esi + 8]
mov esi, dword [esp + 0x10]
add eax, 0x18cc
push eax
mov ecx, esi
call fcn.100274f6
push dword [esi]
push str.GetErrorTxt:_s_n
push 2
call fcn.100c93e3
add esp, 0xc
xor ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
ret 4
Function at 0x100774cc
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x1013fe03
call fcn.101018b2
mov esi, ecx
lea eax, [esi + 0x24]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x101594b4
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100058db
push str.561D6DF8_61B9_488f_84EB_643646A2344F
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.100058db
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.100015d9
push dword [ebp - 0x10]
lea ebx, [esi + 0x3c]
mov eax, dword [ebx]
push eax
call fcn.10101e50
test eax, eax
pop ecx
pop ecx
je 0x10077593
mov eax, dword [esi + 8]
cmp eax, edi
je 0x10077542
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], edi
mov eax, dword [esi + 4]
cmp eax, edi
je 0x10077553
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
push dword [ebp - 0x10]
lea ecx, [esi + 0xc]
push 0x100000
push edi
push 4
call fcn.1001018e
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x10077588
push edi
push edi
push edi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.10005459
cmp dword [esi + 8], edi
je 0x100775e3
push str.EC8B189D_24A4_4cb1_8C82_63C437EA7E9A
push edi
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, edi
je 0x100775e3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100775dc
mov esi, dword [esi + 8]
cmp esi, edi
je 0x100775d5
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x10]
call fcn.100015d9
lea ecx, [ebp + 8]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret 0xc
Function at 0x10077606
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x1013fe36
call fcn.101018b2
mov esi, ecx
lea eax, [esi + 0x24]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x101594b4
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100058db
push str.561D6DF8_61B9_488f_84EB_643646A2344F
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.100058db
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.100015d9
push dword [ebp - 0x10]
lea ebx, [esi + 0x3c]
mov eax, dword [ebx]
push eax
call fcn.10101e50
test eax, eax
pop ecx
pop ecx
je 0x100776cd
mov eax, dword [esi + 8]
cmp eax, edi
je 0x1007767c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], edi
mov eax, dword [esi + 4]
cmp eax, edi
je 0x1007768d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
push dword [ebp - 0x10]
lea ecx, [esi + 0xc]
push 0x100000
push edi
push 4
call fcn.1001018e
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x100776c2
push edi
push edi
push edi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.10005459
cmp dword [esi + 8], edi
je 0x10077719
push str.EC8B189D_24A4_4cb1_8C82_63C437EA7E9A
push edi
lea ecx, [esi + 0xc]
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, edi
je 0x10077719
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10077712
mov esi, dword [esi + 8]
cmp esi, edi
je 0x1007770b
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x10]
call fcn.100015d9
lea ecx, [ebp + 8]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret 0xc

Function at 0x10078304
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x1015dfa4
mov dword [esi + 4], 0x1015df8c
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x10077a57
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x10079f33
Capabilities:
Check http status code
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x1007a0b4
cmp dword [edi], esi
je 0x1007a0b4
cmp dword [edi + 4], esi
je 0x1007a0b4
push 0xffffffffffffffff
push dword [0x1019f298]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push esi
push esi
push esi
push str.sobar_get
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
mov dword [ebp + 8], esi
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x1007a0a3
push esi
push esi
push 3
push esi
push esi
push 0x50
push dword [edi]
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x1007a09a
push esi
push esi
push esi
push esi
push esi
push dword [edi + 4]
push 0x1015e748
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
cmp edi, esi
mov dword [ebp - 8], edi
je 0x1007a091
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
cmp eax, esi
mov dword [ebp + 8], eax
je 0x1007a088
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
cmp eax, esi
mov dword [ebp + 8], eax
je 0x1007a088
cmp dword [ebp - 4], 0xc8
je 0x1007a00f
mov dword [ebp + 8], esi
jmp 0x1007a088
push ebx
mov edi, 0x32000
push edi
call fcn.10100af4
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x1007a087
push edi
push esi
push ebx
call fcn.101027c0
push edi
push ebx
push dword [ebp - 8]
call fcn.100dba04
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x18
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
mov dword [ebp + 8], eax
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
inc eax
push eax
call fcn.10001a82
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.10001a82
push eax
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
call fcn.10001c5b
push ebx
call fcn.10101095
cmp dword [ebp + 8], esi
pop ecx
je 0x1007a087
mov dword [ebp + 8], 1
pop ebx
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [0x1019f298]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp + 8]
jmp 0x1007a0b6
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1007a972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
shr eax, 5
push ebx
mov ebx, ecx
lea ecx, [eax - 4]
cmp ecx, 0xa
mov dword [ebp - 4], ebx
ja 0x1007aadd
push esi
xor ecx, ecx
test eax, eax
push edi
jbe 0x1007a9b2
mov edx, dword [ebp + 8]
sub edx, 0x1019f2d8
mov esi, dword [edx + ecx*4 + 0x1019f2d8]
mov dword [ecx*4 + 0x1019f2d8], esi
inc ecx
cmp ecx, eax
jb 0x1007a99f
push 0xf
mov dword [eax*4 + 0x1019f2d8], eax
inc eax
pop ecx
cmp eax, ecx
jae 0x1007a9ce
lea edi, [eax*4 + 0x1019f2d8]
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
push 4
xor esi, esi
lea edi, [ebx + 4]
pop edx
xor eax, eax
mov ecx, dword [eax + 0x1019bcbc]
mov ecx, dword [ecx*4 + 0x1019f2d8]
mov ebx, dword [eax + 0x1019bcf8]
xor ecx, dword [ebx*4 + 0x1019f2d8]
lea ebx, [eax + esi]
rol ecx, 3
xor ecx, ebx
xor dword [eax + 0x1019f2d8], ecx
add eax, edx
cmp eax, 0x3c
jb 0x1007a9d8
mov dword [ebp + 0xc], edx
xor ecx, ecx
mov ebx, dword [ecx + 0x1019bc80]
mov ebx, dword [ebx*4 + 0x1019f2d8]
and ebx, 0x1ff
mov ebx, dword [ebx*4 + 0x1019b480]
lea eax, [ecx + 0x1019f2d8]
add ebx, dword [eax]
add ecx, edx
rol ebx, 9
cmp ecx, 0x3c
mov dword [eax], ebx
jb 0x1007aa0c
dec dword [ebp + 0xc]
jne 0x1007aa0a
mov eax, edi
xor ecx, ecx
mov edi, dword [ecx + 0x1019bd34]
mov edi, dword [edi*4 + 0x1019f2d8]
mov dword [eax], edi
add ecx, edx
add eax, edx
cmp ecx, 0x28
jb 0x1007aa43
inc esi
cmp esi, edx
mov edi, eax
jb 0x1007a9d6
mov esi, dword [ebp - 4]
add esi, 0x18
mov dword [ebp + 0xc], 0x10
mov ecx, dword [esi]
mov edx, ecx
or edx, 3
mov eax, edx
shr eax, 1
mov edi, edx
not edi
xor eax, edi
and eax, 0x7fffffff
mov edi, eax
shr edi, 2
mov ebx, eax
shr ebx, 1
and edi, ebx
and eax, edi
mov edi, eax
mov ebx, eax
shr edi, 6
shr ebx, 3
and edi, ebx
and eax, edi
je 0x1007aad1
add eax, eax
lea edi, [eax + eax]
or eax, edi
and ecx, 3
mov edi, eax
shl edi, 2
or eax, edi
mov edi, dword [ecx*4 + 0x1019bd70]
mov cl, byte [esi - 4]
rol edi, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and edi, ecx
and edi, 0xfffffffc
xor edx, edi
mov dword [esi], edx
add esi, 8
dec dword [ebp + 0xc]
jne 0x1007aa73
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1007c77d
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0x1015e880
call fcn.101027c0
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x100833b5
Capabilities:
Delete registry key

Disassembly:
push 0x1c
mov eax, 0x10140d42
call fcn.101018b2
call fcn.100db982
mov dword [ebp - 0x28], eax
mov eax, dword [0x1019a028]
mov dword [ebp - 0x14], eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], eax
push 0x11b
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1000201d
push 0x11c
lea ecx, [ebp - 0x1c]
call fcn.1000201d
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], esi
je 0x1008356b
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 8], esi
je 0x1008356b
mov eax, dword [0x1019a028]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x1019e718
mov byte [ebp - 4], 2
call fcn.10036494
push esi
push 0x10153ae0
lea ecx, [ebp - 0x14]
call fcn.100015a7
cmp eax, 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
jne 0x10083454
push str._tn
push eax
call fcn.1000c27f
mov byte [ebp - 4], 3
jmp 0x10083463
push str.tn
push eax
call fcn.1000c27f
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x14]
call fcn.1000be54
lea ecx, [ebp - 0x24]
call fcn.100015d9
mov eax, dword [0x1019a028]
mov dword [ebp - 0x10], eax
mov ebx, str.B8E20CD7_BAC2_4820_9AA6_1060B3AF25E2
push ebx
mov edi, str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push edi
lea eax, [ebp - 0x10]
push 0x10155274
push eax
mov byte [ebp - 4], 5
call fcn.100020c6
add esp, 0x10
push dword [ebp - 0x10]
mov esi, SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x1c]
push str.DisplayName
push dword [ebp - 0x10]
push esi
call fcn.100dfc9c
push dword [ebp - 0x14]
push 0x1015ea08
push dword [ebp - 0x10]
push esi
call fcn.100dfc9c
push ebx
push str.DefaultScope
push edi
push esi
call fcn.100dfc9c
add esp, 0x30
call fcn.100dce86
fcomp qword [0x1015a6d0]
fnstsw ax
test ah, 1
jne 0x10083557
mov eax, dword [0x1019a028]
mov dword [ebp - 0x24], eax
push 0x118
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.1000201d
mov eax, dword [0x1019a028]
mov dword [ebp - 0x20], eax
push 0x127
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.1000201d
push dword [ebp - 0x24]
push str.FaviconURL
push dword [ebp - 0x10]
push esi
call fcn.100dfc9c
push dword [ebp - 0x20]
push str.SuggestionsURL_JSON
push dword [ebp - 0x10]
push esi
call fcn.100dfc9c
add esp, 0x20
lea ecx, [ebp - 0x20]
call fcn.100015d9
lea ecx, [ebp - 0x24]
call fcn.100015d9
lea ecx, [ebp - 0x10]
call fcn.100015d9
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.100015d9
cmp dword [ebp - 0x28], 1
jne 0x10083576
call fcn.100db93f
lea ecx, [ebp - 0x1c]
call fcn.100015d9
lea ecx, [ebp - 0x14]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret