joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043997
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call fcn.1003fd8c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
shr edi, 0xf
and edi, 1
call dword [sym.imp.USER32.dll_GetClientRect]
movzx eax, word [ebp + 8]
mov ebx, dword [esi + 0x88]
add eax, 0xffffffdf
cmp eax, 7
ja case.default.0x100439db
jmp dword [eax*4 + 0x10043aef]
mov eax, dword [esi + 0x1dc]
dec eax
lea ecx, [ebx + 1]
cmp ecx, eax
jge 0x100439f2
mov eax, ecx
push 0
mov dword [esi + 0x88], eax
push eax
mov ecx, esi
call fcn.10042d6c
jmp 0x10043ada
lea eax, [ebx - 1]
test eax, eax
jg 0x100439f2
xor eax, eax
jmp 0x100439f2
mov edi, dword [esi + 0x1dc]
push 0
mov ecx, esi
dec ebx
call fcn.1003d158
add eax, ebx
dec edi
cmp eax, edi
jge case.0x100439db.35
push 0
mov ecx, esi
call fcn.1003d158
add eax, ebx
jmp 0x100439f2
mov eax, dword [esi + 0x1dc]
dec eax
jmp 0x100439f2
xor edi, edi
push edi
mov ecx, esi
call fcn.1003d158
mov ecx, ebx
sub ecx, eax
inc ecx
test ecx, ecx
jle 0x10043a5f
push edi
mov ecx, esi
call fcn.1003d158
sub ebx, eax
inc ebx
jmp 0x10043a61
xor ebx, ebx
push edi
mov dword [esi + 0x88], ebx
push ebx
jmp 0x100439fb
xor eax, eax
push eax
jmp 0x100439f4
mov ebx, dword [sym.imp.USER32.dll_GetScrollPos]
neg edi
sbb edi, edi
push 0
push dword [esi + 4]
and edi, 0x2d
add edi, 5
call ebx
sub eax, edi
test eax, eax
jle 0x10043a98
push 0
push dword [esi + 4]
call ebx
sub eax, edi
jmp 0x10043acc
xor eax, eax
jmp 0x10043acc
mov ebx, dword [sym.imp.USER32.dll_GetScrollPos]
push 0
push dword [esi + 4]
call ebx
mov ecx, dword [ebp - 8]
neg edi
sbb edi, edi
sub ecx, dword [ebp - 0x10]
and edi, 0x2d
add edi, 5
add eax, edi
cmp eax, ecx
jge 0x10043aca
push 0
push dword [esi + 4]
call ebx
add eax, edi
jmp 0x10043acc
mov eax, ecx
push 1
push eax
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetScrollPos]
push dword [esi + 0x88]
mov ecx, esi
call fcn.1003fd62
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1004e11f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x20], eax
call fcn.10146fd5
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp], str.B6A97DF4_0C92_4b57_B5C0_91E4B1BE6942
stosw word es:[edi], ax
push 0x101a047c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.10147724
push 0xa0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.10073949
add esp, 0x24
push 0xc
lea eax, [ebp - 0x24]
push eax
push 3
push str.IntegrigyProtect
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10145d71
leave
ret 4

Function at 0x1004e261
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x20], eax
call fcn.10146fd5
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp], str.D4F994C3_7321_4bdb_9088_1FB0C9D56A71
stosw word es:[edi], ax
push 0x101a047c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.10147724
push 0xa0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.10073949
add esp, 0x24
push 0xc
lea eax, [ebp - 0x24]
push eax
push 3
push str.itdate
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10145d71
leave
ret 4
Function at 0x1004e54a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov esi, 0x101a047c
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x418]
push 0x400
push eax
call fcn.10147724
mov ebx, eax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str.89F3CC4B_0091_49B0_81A6_188CFF582735
stosw word es:[edi], ax
push esi
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.10147724
push 0xa0
lea eax, [ebp - 0x18]
push eax
lea esi, [ebx + 1]
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.10073949
add esp, 0x38
push esi
lea eax, [ebp - 0x418]
push eax
push 3
push str.trustlist
push str.SoftwareBaiduBaiduToolbar
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10145d71
leave
ret 4

Function at 0x1004e605
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.10146c80
add esp, 0xc
test edi, edi
je 0x1004e64d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004e651
xor eax, eax
jmp 0x1004e667
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x804]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004e68c
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x804]
push eax
push 3
push str.pttimsu
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea esp, [ebp - 0x80c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10145d71
leave
ret 4
Function at 0x1004e6ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.10146c80
add esp, 0xc
test edi, edi
je 0x1004e734
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004e738
xor eax, eax
jmp 0x1004e74e
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x804]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004e773
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x804]
push eax
push 3
push str.pttimst
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea esp, [ebp - 0x80c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10145d71
leave
ret 4

Function at 0x1004e7d3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.10146c80
add esp, 0xc
test edi, edi
je 0x1004e81b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004e81f
xor eax, eax
jmp 0x1004e835
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x804]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004e85a
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x804]
push eax
push 3
push str.pttdsf
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea esp, [ebp - 0x80c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10145d71
leave
ret 4
Function at 0x1004e8ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.10146c80
add esp, 0xc
test edi, edi
je 0x1004e902
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004e906
xor eax, eax
jmp 0x1004e91c
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x804]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004e941
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x804]
push eax
push 3
push str.pttdst
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea esp, [ebp - 0x80c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10145d71
leave
ret 4

Function at 0x1004e9a1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.10146c80
add esp, 0xc
test edi, edi
je 0x1004e9e9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004e9ed
xor eax, eax
jmp 0x1004ea03
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x804]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004ea28
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x804]
push eax
push 3
push 0x101a509c
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea esp, [ebp - 0x80c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10145d71
leave
ret 4
Function at 0x1004ea88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x7ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.10146c80
add esp, 0xc
test edi, edi
je 0x1004ead0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004ead4
xor eax, eax
jmp 0x1004eaea
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x804]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004eb0f
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x804]
push eax
push 3
push 0x101a50a4
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea esp, [ebp - 0x80c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10145d71
leave
ret 4

Function at 0x1004efad
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fcbf
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004effa
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004effe
xor eax, eax
jmp 0x1004f013
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f038
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.dnlistips
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4
Function at 0x1004f098
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fcef
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f0e5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f0e9
xor eax, eax
jmp 0x1004f0fe
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f123
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalTray
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4

Function at 0x1004f183
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fd1f
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f1d0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f1d4
xor eax, eax
jmp 0x1004f1e9
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f20e
sub eax, edx
push 0xa0
mov esi, eax
push str.B7B34A41_DB8F_4513_B083_A52FF9FE0299
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalPng
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4
Function at 0x1004f26e
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fd4f
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f2bb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f2bf
xor eax, eax
jmp 0x1004f2d4
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f2f9
sub eax, edx
push 0xa0
mov esi, eax
push str.B7B34A41_DB8F_4513_B083_A52FF9FE0299
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalJpeg
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4

Function at 0x1004f359
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fd7f
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f3a6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f3aa
xor eax, eax
jmp 0x1004f3bf
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f3e4
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalIcon
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4
Function at 0x1004f444
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fdaf
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f491
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f495
xor eax, eax
jmp 0x1004f4aa
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f4cf
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10073949
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalBmp
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4

Function at 0x1004f52f
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fddf
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f57c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f580
xor eax, eax
jmp 0x1004f595
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f5ba
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.1007358e
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalpttName
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4
Function at 0x1004f60f
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fe0f
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f65c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f660
xor eax, eax
jmp 0x1004f675
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004f69a
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.1007358e
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.UnInstallFeedBackUrl
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4

Function at 0x1004f71b
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1017fe3f
call fcn.10145de9
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.10146c80
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.1000401e
mov edi, eax
cmp edi, ebx
je 0x1004f768
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1004f76c
xor eax, eax
jmp 0x1004f781
lea esi, [eax + eax]
mov eax, esi
call fcn.101473b0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000ff6e
push eax
push 0x101a047c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.10147724
lea eax, [ebp - 0x810]
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1004f7a6
sub eax, ecx
mov esi, eax
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.1007358e
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.PushTipsInputMethodList
push str.SoftwareBaiduBaiduToolbar
mov ecx, 0x101f8c08
call fcn.10016a41
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.100041f7
lea ecx, [ebp + 8]
call fcn.10003b75
lea esp, [ebp - 0x820]
call fcn.10145e6c
ret 4