joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100034f7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x1000350f
xor eax, eax
jmp 0x1000355e
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 1
push eax
push esi
push connect
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x1000354d
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 4], 0
je 0x1000355c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003563
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.100023f8
push 0x1fe
xor esi, esi
mov dword [ebx], vtable.CMyMainTrans.0
lea eax, [ebp - 0x202]
push esi
push eax
call fcn.10005730
add esp, 0xc
mov dword [ebx + 0x4860], esi
lea edi, [ebx + 0x486c]
mov dword [ebx + 0x4864], esi
mov dword [ebx + 0x4868], esi
push 0x25
pop eax
push 0x30
mov word [ebp - 0x204], ax
pop eax
push 0x38
mov word [ebp - 0x202], ax
pop eax
push 0x78
mov word [ebp - 0x200], ax
pop eax
push 0x2e
mov word [ebp - 0x1fe], ax
pop eax
push 0x74
mov word [ebp - 0x1fc], ax
pop eax
push 0x6d
mov word [ebp - 0x1fa], ax
pop eax
push 0x70
mov word [ebp - 0x1f8], ax
pop eax
mov word [ebp - 0x1f6], ax
xor eax, eax
push edi
push 0xfa
mov word [ebp - 0x1f4], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call esi
mov ecx, 0x104
sub ecx, eax
push ecx
push edi
call esi
add eax, 0x2436
lea ecx, [ebx + eax*2]
push ecx
call fcn.10001026
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000423e
mov esp, ebp
pop ebp
ret
Function at 0x100037d6
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x38], eax
lea esi, [edi + 0x220]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ebx, [edi + 0x18]
push ebx
lea eax, [edi + 0x10]
push eax
lea ecx, [edi + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor esi, esi
test eax, eax
jne 0x1000382a
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebx], esi
mov dword [ebx + 4], esi
push 0x30
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], esi
push esi
push eax
mov dword [ebp - 0x3c], esi
call fcn.10005730
push dword [ebp - 0x38]
lea eax, [ebp - 0x34]
push 0x1001a9c8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [edi + 0x120]
mov ecx, 0x80
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
push ecx
lea eax, [edi + 0x20]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000423e
mov esp, ebp
pop ebp
ret 8

Function at 0x10003895
Capabilities:
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.10003ba9
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100038c8
mov dword [esi + 0x4860], 0x1b69
jmp 0x10003971
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10005730
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1000396a
lea esi, [eax - 1]
shr esi, 2
lea edi, [ebp - 0x210]
inc esi
push edi
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [edi]
cmp eax, 0x41
je 0x10003962
cmp eax, 0x42
je 0x10003962
and dword [ebp - 0x470], 0
lea eax, [ebp - 0x468]
push 0x258
push 0
push eax
call fcn.10005730
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
push edi
call fcn.100037d6
and dword [ebp - 0x474], 0
lea eax, [ebp - 0x474]
push 0
push eax
push 0x260
lea eax, [ebp - 0x470]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 8
sub esi, 1
jne 0x10003901
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000423e
mov esp, ebp
pop ebp
ret
Function at 0x10003982
Capabilities:
Enumerate files on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe9c
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x820]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.10005730
push edi
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.10005730
add esp, 0x18
lea eax, [ebp - 0x410]
push dword [esi + 0x4868]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x250
lea eax, [ebp - 0xa70]
push ebx
push eax
call fcn.10005730
add esp, 0x18
lea eax, [ebp - 0xa70]
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10003a2b
mov dword [esi + 0x4860], 0x1b58
jmp 0x10003b98
mov ecx, esi
call fcn.10003ba9
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10003a4f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4860], 0x1b69
jmp 0x10003b98
push 0x1fe
lea eax, [ebp - 0x206]
push 0
push eax
call fcn.10005730
push 0x25
pop edx
push 0x73
pop ecx
push 0x5c
pop eax
push 0x208
mov word [ebp - 0x204], ax
xor esi, esi
lea eax, [ebp - 0x618]
mov word [ebp - 0x208], dx
push esi
push eax
mov word [ebp - 0x206], cx
mov word [ebp - 0x202], dx
mov word [ebp - 0x200], cx
call fcn.10005730
add esp, 0x18
push 0x1001a9e0
lea eax, [ebp - 0xa44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x10003b62
push 0x1001a9e4
lea eax, [ebp - 0xa44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x10003b62
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x424
lea eax, [ebp - 0xe98]
push 0
push eax
call fcn.10005730
add esp, 0x1c
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0xe74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xe98]
push eax
push 0
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10003b62
and dword [ebp - 0xe9c], 0
lea eax, [ebp - 0xe9c]
push 0
push eax
push 0x424
lea eax, [ebp - 0xe98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0xa70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003b82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10003b8a
xor esi, esi
inc esi
test esi, esi
je 0x10003aa5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000423e
mov esp, ebp
pop ebp
ret

Function at 0x10003ba9
Capabilities:
Delete file

Disassembly:
push esi
lea esi, [ecx + 0x486c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
ret
Function at 0x10003bd1
Capabilities:
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor ecx, ecx
push ecx
push 0x80
push 3
push ecx
push 1
lea eax, [esi + 0x486c]
mov dword [esi + 0x4864], ecx
push connect
push eax
mov edi, ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10003c4e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x4864], eax
test eax, eax
je 0x10003c3a
push eax
call fcn.1000459c
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x4864]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x486c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0x4860]
mov ecx, esi
push dword [esi + 0x4864]
push edi
call fcn.10002742
mov esi, eax
test edi, edi
je 0x10003c6f
push edi
call fcn.100045a5
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003dfe
Capabilities:
Create thread
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x25b4
call fcn.10013f40
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x2598
push edi
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x25a0]
push ecx
call fcn.10013f70
add esp, 0xc
lea esi, [ebp - 0x25a0]
mov eax, edi
call fcn.10013f40
mov edi, esp
mov ecx, 0x966
rep movsd dword es:[edi], dword [esi]
push 0x3ed
mov ecx, ebx
call fcn.10002495
test eax, eax
je 0x10003f82
mov ecx, ebx
call fcn.10003f95
test eax, eax
je 0x10003f82
push ebx
xor edi, edi
push edi
push 0x10003dc6
call fcn.100091a8
mov esi, edi
mov dword [ebp - 0x25a8], edi
add esp, 0xc
mov dword [ebp - 0x25b0], edi
mov dword [ebp - 0x25ac], edi
mov dword [ebp - 0x25a4], esi
test esi, esi
je 0x10003eaa
push esi
call fcn.100045a5
mov esi, edi
pop ecx
mov dword [ebp - 0x25a4], esi
push edi
push dword [ebx + 0x4880]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10003f19
lea eax, [ebp - 0x25ac]
mov ecx, ebx
push eax
lea eax, [ebp - 0x25a8]
push eax
lea eax, [ebp - 0x25a4]
push eax
call fcn.10002898
test eax, eax
je 0x10003f13
cmp dword [ebp - 0x25a8], edi
je 0x10003eed
mov eax, dword [ebx + 0x4868]
test eax, eax
jne 0x10003ef5
mov esi, dword [ebp - 0x25a4]
jmp 0x10003e97
mov esi, dword [ebp - 0x25a4]
lea ecx, [ebp - 0x25b0]
push edi
push ecx
push dword [ebp - 0x25a8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10003e97
mov esi, dword [ebp - 0x25a4]
mov ecx, ebx
call fcn.10002720
test esi, esi
je 0x10003f2b
push esi
call fcn.100045a5
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x4860], edi
je 0x10003f42
push edi
mov dword [ebx + 0x4860], edi
call esi
cmp dword [ebx + 0x4870], edi
je 0x10003f53
push edi
mov dword [ebx + 0x4870], edi
call esi
cmp dword [ebx + 0x4868], edi
je 0x10003f64
push edi
mov dword [ebx + 0x4868], edi
call esi
cmp dword [ebx + 0x4874], edi
je 0x10003f75
push edi
mov dword [ebx + 0x4874], edi
call esi
push edi
push dword [ebx + 0x4880]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000423e
mov esp, ebp
pop ebp
ret 0x2598
Function at 0x10003f95
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], 0xc
push 0xfffffffffffffff5
mov esi, ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebx
lea ecx, [ebp - 0xc]
mov dword [esi + 0x487c], eax
push ecx
lea edi, [esi + 0x4870]
lea eax, [esi + 0x486c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x100040c2
push dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0xfffffffffffffff5
call edi
test eax, eax
je 0x100040c2
push 2
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esi + 0x4874]
push eax
call ebx
push eax
push dword [esi + 0x486c]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x100040c2
push dword [esi + 0x486c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea edx, [ebp - 0xc]
mov dword [esi + 0x4878], eax
push edx
lea eax, [esi + 0x4864]
lea ecx, [esi + 0x4860]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x100040c2
push dword [esi + 0x4860]
push 0xfffffffffffffff6
call edi
test eax, eax
je 0x100040c2
push 2
push 0
push 0
lea eax, [esi + 0x4868]
push eax
call ebx
push eax
push dword [esi + 0x4864]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x100040c2
push dword [esi + 0x4864]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.100040cb
test eax, eax
je 0x100040c2
push dword [esi + 0x4878]
push 0xfffffffffffffff6
call edi
test eax, eax
je 0x100040c2
push dword [esi + 0x487c]
push 0xfffffffffffffff5
call edi
test eax, eax
je 0x100040c2
xor eax, eax
inc eax
jmp 0x100040c4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100040cb
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x43
mov edi, ecx
pop eax
push 0x4d
lea esi, [edi + 0x4884]
mov word [esi], ax
pop eax
push 0x44
pop ebx
push 0x2e
mov word [edi + 0x4886], ax
pop eax
push 0x45
pop ecx
push 0x58
mov word [edi + 0x488a], ax
pop eax
mov word [edi + 0x488e], ax
xor eax, eax
push ebx
push eax
mov word [edi + 0x4892], ax
lea eax, [ebp - 0x54]
push eax
mov word [edi + 0x4888], bx
mov word [edi + 0x488c], cx
mov word [edi + 0x4890], cx
call fcn.10005730
add esp, 0xc
mov dword [ebp - 0x54], ebx
xor eax, eax
mov dword [ebp - 0x28], 0x101
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov eax, dword [edi + 0x4860]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x4870]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], ecx
push eax
push ecx
push ecx
push 0x8000000
push 1
push ecx
push ecx
push esi
push ecx
mov dword [ebp - 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10004189
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [edi + 0x4880], ecx
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a975
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3d30
mov eax, dword fs:[0]
push eax
sub esp, 0x660
mov eax, dword [0x100dd3e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x664], ecx
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 0x43c], 0
push 0x424
push 0
lea eax, [ebp - 0x438]
push eax
call fcn.10070cb0
add esp, 0xc
and dword [ebp - 0x658], 0
and word [ebp - 0x654], 0
push 0x208
push 0
lea eax, [ebp - 0x652]
push eax
call fcn.10070cb0
add esp, 0xc
lea ecx, [ebp - 0x440]
call fcn.10003b07
and dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x654]
push eax
call fcn.10099bc0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x1003aa8c
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x440]
call fcn.10003bbe
lea ecx, [ebp - 0x440]
call fcn.10010553
push eax
push 0x5c
lea ecx, [ebp - 0x440]
call fcn.10003bf0
inc eax
push eax
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x440]
call fcn.10010642
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x66c], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x66c]
lea ecx, [ebp - 0x440]
call fcn.10003ba5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x65c]
call fcn.100104e6
mov eax, dword [ebp - 0x664]
push dword [eax + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1003aaa7
jmp 0x1003aafb
mov dword [ebp - 0x43c], 0x428
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x1003aac6
jmp 0x1003aafb
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x440]
call fcn.1003b53b
test eax, eax
jne 0x1003aae8
mov dword [ebp - 0x658], 1
jmp 0x1003aafb
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1003aac6
cmp dword [ebp - 0x10], 0xffffffff
je 0x1003ab0a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x660], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.100104e6
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006e011
leave
ret

Function at 0x1003ab42
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x100c35d0
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x1003ab7e
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
leave
ret
Function at 0x1003adfd
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x1003ae39
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
leave
ret

Function at 0x1003cb23
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3cff
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100dd3e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1003c872
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.1003cc83
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CQQChannelDownload.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], vtable.CQQChannelDownload.1.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100016d0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
and dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x10]
and dword [eax + 0x10], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 0x30], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 8
Function at 0x10046628
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x100dd3e0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, ecx
push edi
je 0x10046695
cmp dword [ebp + 0xc], ecx
jle 0x10046695
cmp ebx, ecx
je 0x10046695
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.10046753
pop ecx
lea edi, [esp + 8]
call fcn.100467fa
mov al, 1
jmp 0x10046697
xor al, al
mov ecx, dword [esp + 0x64]
pop edi
pop ebx
xor ecx, esp
call fcn.1006e011
mov esp, ebp
pop ebp
ret

Function at 0x1004e831
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x100b7046
call fcn.10075f38
mov esi, ecx
push str.CDownload::Init__
push 3
call fcn.100515ea
xor edi, edi
cmp dword [esi + 0xc], edi
pop ecx
pop ecx
je 0x1004e85c
xor eax, eax
inc eax
jmp 0x1004e8e6
cmp dword [esi + 0x64], edi
mov dword [esi + 0xb8], 0x5dc
jne 0x1004e8a4
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x68], eax
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x6c], eax
call ebx
mov dword [esi + 0x70], eax
lea eax, [esi + 0x74]
push eax
push edi
push esi
push 0x1004ff67
push edi
push edi
call fcn.100717ac
add esp, 0x18
mov dword [esi + 0x64], eax
lea eax, [esi + 0x8c]
mov dword [ebp - 0x10], eax
add eax, 4
push eax
mov dword [ebp - 0x14], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
inc edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x1c], edi
call fcn.1005059e
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea esi, [ebp - 0x14]
call fcn.10050ab4
mov eax, edi
call fcn.10075fd7
ret
Function at 0x1004e967
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push 0x10
mov eax, 0x100b7046
call fcn.10075f38
push str.CDownload::Uninit__
push 3
call fcn.100515ea
pop ecx
lea eax, [edi + 0x8c]
mov dword [ebp - 0x10], eax
pop ecx
add eax, 4
push eax
mov dword [ebp - 0x14], vtable.QQDectector::fund::lock::scoped_lock_class_QQDectector::fund::lock::critical_section_.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 0x78]
mov dword [ebp - 0x1c], 2
call fcn.1005059e
push dword [edi + 0x70]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
call ebx
lea esi, [ebp - 0x14]
call fcn.10050ab4
push dword [edi + 0x68]
call ebx
push dword [edi + 0x70]
call ebx
cmp dword [edi + 0x64], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1004ea0f
push 0x7530
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1004ea06
push 0x3ff
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push str.Uninit::TerminateThread
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [edi + 0x64]
call esi
and dword [edi + 0x64], 0
push dword [edi + 0x70]
call esi
push dword [edi + 0x68]
call esi
push dword [edi + 0x6c]
call esi
call fcn.10075fd7
ret

Function at 0x1005027f
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x238
lea ebp, [esp - 4]
mov eax, dword [0x100dd3e0]
xor eax, ebp
mov dword [ebp + 0x238], eax
push 0x20
mov eax, 0x100b5b07
call fcn.10075f38
and word [ebp + 0x2c], 0
push 0x208
lea eax, [ebp + 0x2e]
push 0
push eax
call fcn.10070cb0
add esp, 0xc
lea eax, [ebp]
push eax
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
lea esi, [ebp]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp + 0x2c]
movsd dword es:[edi], dword [esi]
call fcn.10055b0a
add esp, 0x10
test eax, eax
je 0x1005037e
lea ecx, [ebp + 0x10]
call fcn.100016d0
and dword [ebp - 4], 0
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp + 0x10]
call fcn.10009f34
lea edi, [ebp + 0x10]
call fcn.100503a1
push eax
push 0
mov ecx, edi
call fcn.100017a8
push 0xffffffffffffffff
mov ebx, edi
call fcn.10050402
inc eax
push eax
mov ecx, edi
call fcn.100017a8
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.10001841
mov esi, eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.10001863
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.10001841
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.100513ae
add esp, 0x1c
mov ecx, ebx
call fcn.10004d1a
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, ebx
mov esi, eax
call fcn.10001767
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.1006e011
add ebp, 0x23c
leave
ret