joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407692
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x44
lea ebp, [esp - 4]
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x44], eax
push 0x8c
mov eax, 0x51fd4c
call fcn.00506664
mov ebx, ecx
mov dword [ebp + 0x24], ebx
call fcn.0042a99f
test al, al
je 0x407890
call fcn.0040dbda
mov al, byte [eax]
test al, al
jne 0x407743
lea eax, [ebp - 0x98]
push eax
call fcn.0040d9e1
and dword [ebp - 4], 0
push ebx
push 0x543368
lea eax, [ebp - 0x90]
push str.Uninstall:_OpenDefaultBrowser_with_Page:
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp + 0x28]
push eax
lea ecx, [ebp - 0x98]
call fcn.0040bf31
lea edi, [ebp + 0x28]
mov byte [ebp - 4], 1
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x98]
call fcn.0040c22b
jmp 0x40786f
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 4], 2
call fcn.0040b935
mov byte [ebp - 4], 3
call fcn.0040dbda
lea ecx, [ebp]
call fcn.0040b84b
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x407776
mov esi, dword [eax + 4]
jmp 0x407779
lea esi, [eax + 4]
lea eax, [ebp - 0x90]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.Uninstall:_OpenDefaultBrowser_with_Page:
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push eax
call fcn.0040b612
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp]
mov byte [ebp - 4], 3
call fcn.0040dac5
lea eax, [ebp + 0x1c]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 5
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x407828
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x90]
call fcn.0040b831
push 0x2d8
push str..ToolbarUnInstaller.cpp
push eax
push esi
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp]
call fcn.0040dac5
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.0040b8a0
jmp 0x40786f
cmp dword [ebx + 0x18], 8
jb 0x40787a
mov eax, dword [ebx + 4]
jmp 0x40787d
lea eax, [ebx + 4]
push 1
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x44]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x48
leave
ret
Function at 0x40b05c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40b073
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40b0a8
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40b0a4
cmp edi, eax
jae 0x40b0a8
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40b096
cmp edi, eax
jb 0x40b0ac
xor eax, eax
jmp 0x40b0b5
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x40e208
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x5311e6
call fcn.0050669a
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
push 0x54323c
lea esi, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.0040b812
push str.vToolbarUpdater
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.0040b812
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0041d902
pop ecx
pop ecx
xor edi, edi
push ebx
inc edi
push edi
call fcn.0040dac5
push ebx
push edi
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.0040dac5
cmp dword [ebp - 0x18], ebx
jne 0x40e28d
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.0040dac5
xor al, al
call fcn.0050671d
ret
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x48]
call fcn.0040be1c
push str.log4cplusU.dll
mov eax, esi
push eax
mov byte [ebp - 4], 3
call fcn.0040b547
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x40e2b6
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e2cd
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.0040dac5
jmp 0x40e27b
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40e2d9
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
test eax, eax
jne 0x40e32f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CLogger::SetDllDirectory_____SetDllDirectory_failed
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x50], eax
call fcn.0040b812
push dword [ebp - 0x50]
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040db7f
pop ecx
push ebx
push edi
call fcn.0040dac5
mov byte [ebp - 0x49], bl
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.0040dac5
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.0040dac5
mov al, byte [ebp - 0x49]
jmp 0x40e287
mov byte [ebp - 0x49], 1
jmp 0x40e313

Function at 0x40e42f
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x5a1510], 0
jne 0x40e45f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40e458
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5a1514], eax
mov byte [0x5a1510], 1
mov eax, dword [0x5a1514]
test eax, eax
je 0x40e477
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x40e483
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x40e58f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e5f3
cmp dword [ebp + 0xc], 1
je 0x40e5cb
cmp dword [ebp + 0xc], 2
je 0x40e5cb
push 0xd
pop eax
jmp 0x40e5f3
mov eax, dword [ebp - 4]
test edi, edi
je 0x40e5ed
test eax, eax
je 0x40e5e8
test al, 1
jne 0x40e5c6
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40e5ed
jmp 0x40e5c6
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x40e5f7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test edi, edi
je 0x40e609
cmp dword [esi], 2
jae 0x40e609
push 0x7a
pop eax
jmp 0x40e66a
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e66a
cmp dword [ebp + 0xc], 7
je 0x40e63a
push 0xd
jmp 0x40e606
mov ecx, dword [ebp - 4]
test edi, edi
je 0x40e664
test cl, 1
jne 0x40e636
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x40e636
cmp word [edi + eax*2 - 2], 0
jne 0x40e636
cmp eax, 1
jbe 0x40e664
cmp word [edi + eax*2 - 4], 0
jne 0x40e636
shr ecx, 1
mov dword [esi], ecx
xor eax, eax
leave
ret 8

Function at 0x40e66e
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc

Function at 0x40e6c1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x59d300]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [esp + 0x24], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call fcn.0040e4e4
mov ebx, eax
cmp ebx, esi
je 0x40e72d
lea esi, [esp + 0x10]
call fcn.0040e486
mov eax, ebx
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ffa47
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40e747
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.0040e6c1
cmp eax, esi
jne 0x40e780
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x40e735
lea esi, [esp + 0x10]
call fcn.0040e486
push dword [esp + 0x1c]
mov esi, edi
call fcn.0040e42f
lea esi, [esp + 0x10]
mov edi, eax
call fcn.0040e486
mov eax, edi
jmp 0x40e716
Function at 0x4114f7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x14], 0
jne 0x411506
push 0xd
pop eax
leave
ret
and dword [ebp - 4], 0
cmp dword [eax + 0x1c], 8
jb 0x411515
mov ecx, dword [eax + 8]
jmp 0x411518
lea ecx, [eax + 8]
push edi
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push ecx
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x41155c
cmp dword [ebp - 4], eax
je 0x41155c
cmp dword [esi + 0x18], 8
jb 0x411544
mov eax, dword [esi + 4]
jmp 0x411547
lea eax, [esi + 4]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret

Function at 0x412037
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51f0f4
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x59d300]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
mov eax, dword [0x59d300]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push ecx
push eax
mov eax, 0x20019
lea ecx, [esp + 0x18]
mov dword [esp + 0x260], ebx
call fcn.0040e4e4
cmp eax, ebx
je 0x4120d7
mov ebx, 0x3e80
lea esi, [esp + 0x10]
call fcn.0040e486
mov eax, ebx
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.004ffa47
mov esp, ebp
pop ebp
ret
xor edi, edi
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x58]
push eax
push edi
push dword [esp + 0x2c]
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x41213d
cmp eax, ebx
jne 0x41213a
lea eax, [esp + 0x44]
push eax
lea esi, [esp + 0x2c]
call fcn.0040b812
mov eax, esi
push eax
mov eax, dword [esp + 0x20]
mov byte [esp + 0x25c], 1
call fcn.00412811
push ebx
push 1
mov byte [esp + 0x260], bl
call fcn.0040dac5
inc edi
jmp 0x4120d9
lea esi, [esp + 0x10]
call fcn.0040e486
jmp 0x4120a8
Function at 0x41214b
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftInternet_ExplorerUser_Preferences
push SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x4121ee
mov eax, edi
mov dword [ebp - 0x14], edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x412184
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x4121c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4121ee
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 3
push esi
push str.88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x419eed
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x144
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x74], eax
push edi
push 9
pop ecx
xor eax, eax
push 0x11c
lea edi, [ebp - 0xcc]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8]
push eax
call fcn.005060b0
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop edi
test eax, eax
je 0x41a025
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419f6b
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x419f78
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 2
pop ecx
cmp dword [ebp - 0x98], ecx
jne 0x41a025
cmp dword [ebp - 0xa4], 4
jbe 0x41a025
cmp dword [ebp - 0xa4], 6
jne 0x419fdf
xor eax, eax
cmp dword [ebp - 0xa0], eax
jne 0x419fb2
cmp byte [ebp + 0x72], 1
setne al
add eax, ecx
jmp 0x41a027
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x419fca
xor ecx, ecx
cmp byte [ebp + 0x72], al
sete cl
add ecx, 4
mov eax, ecx
jmp 0x41a027
cmp dword [ebp - 0xa0], ecx
jne 0x41a025
xor ecx, ecx
cmp byte [ebp + 0x72], al
sete cl
add ecx, 6
jmp 0x419fc6
cmp dword [ebp - 0xa4], 5
jne 0x41a025
cmp dword [ebp - 0xa0], ecx
jne 0x41a025
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41a001
xor eax, eax
inc eax
jmp 0x41a027
test dword [ebp + 0x70], 0x2000
jne 0x419ffc
xor eax, eax
inc eax
test dword [ebp + 0x70], 0x8000
jne 0x41a027
cmp byte [ebp + 0x72], al
jne 0x41a027
cmp word [ebp - 0xcc], 9
jne 0x41a027
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x78
leave
ret
Function at 0x41d7d5
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, dword [ebp + 0x1bc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x80], eax
cmp eax, ebx
je 0x41d865
xor ecx, ecx
cmp cx, word [eax]
je 0x41d865
push edi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x22c
mov edi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.005060b0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push dword [ebp - 0x80]
lea eax, [ebp - 0x58]
push eax
call fcn.00500f36
pop ecx
pop ecx
test eax, eax
je 0x41d857
lea eax, [ebp - 0x7c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41d835
jmp 0x41d859
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
jmp 0x41d867
xor al, al
mov ecx, dword [ebp + 0x1b0]
xor ecx, ebp
pop ebx
call fcn.004ffa47
add ebp, 0x1b4
leave
ret
Function at 0x41e174
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
sub esp, 0x4c
lea ebp, [esp - 4]
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x4c], eax
push 0x8c
mov eax, 0x530df0
call fcn.00506664
lea ecx, [ebp + 8]
call fcn.0047582f
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00485eca
test eax, eax
jne 0x41e324
call fcn.0040dbda
cmp byte [eax], bl
jne 0x41e216
lea eax, [ebp - 0x98]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0x90]
push str.CSystemCommands::CloseAllIEWindows___NOT_host_Browser___Exit
push eax
mov byte [ebp - 4], 1
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp - 0x98]
call fcn.0040bf31
lea edi, [ebp + 0x30]
mov byte [ebp - 4], 2
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.0040c22b
jmp 0x41e345
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 3
call fcn.0040b935
mov byte [ebp - 4], 4
call fcn.0040dbda
lea ecx, [ebp + 0x30]
call fcn.0040b84b
mov byte [ebp - 4], 5
cmp dword [eax + 0x18], 8
jb 0x41e246
mov esi, dword [eax + 4]
jmp 0x41e249
lea esi, [eax + 4]
lea eax, [ebp - 0x90]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CSystemCommands::CloseAllIEWindows___NOT_host_Browser___Exit
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp + 0x30]
mov byte [ebp - 4], 4
call fcn.0040dac5
lea eax, [ebp]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
cmp al, bl
je 0x41e2e0
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp - 0x90]
call fcn.0040b831
push 0x448
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp]
mov byte [ebp - 4], 7
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp + 0x30]
call fcn.0040dac5
lea ecx, [ebp]
mov byte [ebp - 4], 4
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.0040b8a0
jmp 0x41e345
call fcn.0041e10a
push ebx
mov esi, eax
call fcn.0041e053
pop ecx
push ebx
push 0x41dfb3
call dword [sym.imp.USER32.dll_EnumWindows]
push esi
call fcn.0041e053
pop ecx
lea edi, [ebp + 8]
call fcn.004759ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4c]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x50
leave
ret
Function at 0x423edf
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51f12a
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x59d300]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0xc], esi
call fcn.00419eed
test eax, eax
jne 0x423f48
lea eax, [esp + 0x10]
push str.USERPROFILE
push eax
call fcn.004208f1
push 0x548728
push eax
push edi
mov dword [esp + 0x4c], esi
call fcn.0040aaf4
add esp, 0x14
push esi
push 1
lea esi, [esp + 0x18]
call fcn.0040dac5
jmp 0x423f55
push str.LOCALAPPDATA
push edi
call fcn.004208f1
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423f68
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x530b3c
call fcn.0050669a
lea eax, [ebp - 0x2c]
push eax
mov edi, ecx
call fcn.004121f1
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x423f9d
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040dac5
xor al, al
call fcn.0050671d
ret
lea eax, [ebp - 0x4c]
push str.ProgramFiles
push eax
call fcn.004208f1
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040bd91
push ebx
push 1
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.0040dac5
cmp dword [edi + 0x14], ebx
je 0x423f8a
push 0x5418b4
push edi
call fcn.0040b547
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
mov ecx, edi
call fcn.0040b405
push 0x542c94
push edi
call fcn.0040b547
cmp dword [edi + 0x18], 8
jb 0x423ffc
mov edi, dword [edi + 4]
jmp 0x423fff
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424020
mov byte [ebp - 0x2d], bl
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040dac5
mov al, byte [ebp - 0x2d]
jmp 0x423f97
mov byte [ebp - 0x2d], 1
jmp 0x42400d
Function at 0x439e75
Capabilities:
Check if file exists
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52fbf1
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x59d300]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push esi
mov eax, dword [0x59d300]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
push eax
call fcn.0048d8fa
pop ecx
xor ebx, ebx
mov dword [esp + 0xb8], ebx
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], ax
mov byte [esp + 0xb8], 1
jmp 0x43a030
lea eax, [esp + 0x8c]
push eax
lea esi, [esp + 0x20]
call fcn.0040be1c
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x40]
mov ecx, esi
mov byte [esp + 0xc0], 2
call fcn.0040b405
mov eax, esi
push eax
lea esi, [esp + 0x58]
call fcn.0040be1c
push str._search.json
mov eax, esi
push eax
mov byte [esp + 0xc0], 3
call fcn.0040b547
push str._searchplugins_
lea eax, [esp + 0x20]
push eax
call fcn.0040b547
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x24]
call fcn.0040b405
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x439f7a
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x43a010
cmp byte [ebp + 0x14], bl
je 0x439fbb
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x439f9e
lea eax, [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x439fb6
lea eax, [esp + 0x58]
push eax
call esi
jmp 0x43a010
mov eax, dword [esp + 0x14]
mov byte [eax], 1
cmp dword [edi + 0x14], ebx
je 0x43a010
cmp dword [esp + 0x34], 8
mov ecx, dword [esp + 0x20]
jae 0x439fd6
lea ecx, [esp + 0x20]
lea eax, [esp + 0x70]
push eax
mov edx, str.SearchPlugin_ShortName
call fcn.0041ac4c
pop ecx
lea ecx, [esp + 0x70]
mov eax, edi
mov byte [esp + 0xb8], 4
call fcn.004127e2
test eax, eax
jne 0x43a004
mov eax, dword [esp + 0x18]
mov byte [eax], 1
push ebx
push 1
lea esi, [esp + 0x78]
call fcn.0040dac5
push ebx
push 1
lea esi, [esp + 0x5c]
call fcn.0040dac5
push ebx
push 1
lea esi, [esp + 0x24]
mov byte [esp + 0xc0], 1
call fcn.0040dac5
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.0048de2d
pop ecx
test al, al
jne 0x439f04
push ebx
push 1
lea esi, [esp + 0x40]
call fcn.0040dac5
push ebx
push 1
lea esi, [esp + 0x94]
call fcn.0040dac5
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004ffa47
mov esp, ebp
pop ebp
ret 0x10