joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000331e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x1014f254], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x10003362
call ebx
test eax, eax
jns 0x10003358
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1014f250], eax
mov dword [0x1014f254], 1
mov eax, dword [0x1014f250]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000337e
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x100033ae
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x100033a4
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x10003399
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x1000339e
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x100033ad
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc

Function at 0x10003836
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x10003887
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10003898
push 0xd
pop eax
jmp 0x100038c5
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1000389b
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x10004217
Capabilities:
Capture webcam image

Disassembly:
push 0
push dword [esp + 8]
push 0x419
push dword [ecx]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x10004790
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push dword [ebp + 8]
xor esi, esi
push dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.100037f5
mov ebx, eax
cmp ebx, esi
je 0x100047d3
lea ecx, [ebp - 8]
call fcn.10003780
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100047ee
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 8]
call fcn.10004790
cmp eax, esi
jne 0x10004823
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x100
call ebx
test eax, eax
je 0x100047db
lea ecx, [ebp - 8]
call fcn.10003780
push dword [ebp + 8]
mov ecx, edi
call fcn.10003725
lea ecx, [ebp - 8]
mov esi, eax
call fcn.10003780
mov eax, esi
jmp 0x100047cc
Function at 0x10006bcd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x100e1749
call fcn.100c908c
sub esp, 0x418
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x424], edi
push 2
push edi
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10004c57
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, edi
jne 0x10006c1b
call fcn.10003682
mov esi, eax
jmp 0x10006d12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x10006c38
call fcn.10003682
jmp 0x10006d07
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
cmp eax, edi
je 0x10006c2e
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp + 8], esi
cmp eax, esi
jae 0x10006c94
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10006c74
lea ecx, [ebp - 0x424]
call fcn.1008c9e5
mov esi, 0x8007000e
lea ecx, [ebp - 0x18]
call fcn.10004129
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.1000543b
mov dword [ebp - 4], 1
jmp 0x10006cbf
cmp dword [ebp - 0x424], edi
jne 0x10006cce
mov esi, 0x8007000e
jmp 0x10006d09
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp + 0x10]
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x10006c2e
mov edx, dword [ebp - 0x424]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x424]
lea ecx, [ebp - 0x20]
call fcn.1000642f
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x10006c79
lea ecx, [ebp - 0x424]
call fcn.1008c9e5
jmp 0x10006c79
Function at 0x10008ed9
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100e196f
call fcn.100c908c
sub esp, 0x48
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0xb4]
cdq
idiv ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
mov edi, eax
mov eax, dword [esi + 0x84]
imul edi, ecx
lea ecx, [eax + 0xb8]
mov eax, dword [ecx]
call dword [eax + 0x5c]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0xc]
push ebx
push eax
push 0x419
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x44]
push ecx
push eax
push 0x41d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
jne 0x10008f6d
xor edi, edi
jmp 0x10008f7f
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x44]
sub eax, dword [esi + 0xb4]
cmp eax, edi
jge 0x10008f7f
mov edi, eax
mov ecx, dword [esi + 0xbc]
mov eax, dword [esi + 0xb0]
cmp ecx, eax
jge 0x10008fca
cmp edi, dword [esi + 0xa8]
jle 0x10008fca
cmp edi, ecx
jle 0x10008fca
cmp edi, eax
mov bl, 1
mov dword [esi + 0xbc], edi
jle 0x10008fad
mov dword [esi + 0xbc], eax
mov eax, dword [esi + 0x48]
mov esi, dword [esi + 0x84]
lea ecx, [esi + 0xb8]
mov edx, dword [ecx]
push eax
push str.ChangeItem
call dword [edx + 0xb8]
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x1000906e
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100e1989
call fcn.100c908c
sub esp, 0x50
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x84]
lea ecx, [eax + 0xb8]
mov eax, dword [ecx]
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
call dword [eax + 0x5c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push eax
push 0x419
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x4c]
push ecx
push eax
push 0x41d
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov edx, dword [esi + 0xbc]
mov ecx, edx
jne 0x100090f9
xor ecx, ecx
jmp 0x1000910b
mov eax, dword [ebp - 0x54]
sub eax, dword [esi + 0xb4]
sub eax, dword [ebp - 0x4c]
cmp eax, ecx
jge 0x1000910b
mov ecx, eax
mov eax, dword [esi + 0xa8]
cmp ecx, eax
jge 0x10009117
mov ecx, eax
cmp ecx, edx
setl byte [ebp - 0x11]
cmp byte [ebp - 0x11], bl
je 0x10009145
mov eax, dword [esi + 0x48]
mov dword [esi + 0xbc], ecx
mov esi, dword [esi + 0x84]
lea ecx, [esi + 0xb8]
mov edx, dword [ecx]
push eax
push str.ChangeItem
call dword [edx + 0xb8]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1000a532
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100e1b5c
call fcn.100c908c
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [esi + 0xb8], ecx
mov eax, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
call dword [eax + 0x5c]
push 0x20
pop edi
push edi
mov dword [ebp + 8], eax
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.100c7c60
add esp, 0xc
push ebx
lea ecx, [esi + 0x34]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], 0xa
mov byte [ebp - 0x57], 0x30
call fcn.100054ad
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x68]
push ecx
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0xc]
push eax
push 0x440
push dword [ebp + 8]
call edi
mov eax, dword [esi + 0xc]
push ebx
push eax
push 0x419
push dword [ebp + 8]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call edi
lea ecx, [ebp - 0x48]
push ecx
push eax
push 0x41d
push dword [ebp + 8]
call edi
call fcn.1004ade8
mov ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x3c]
push ebx
add eax, ecx
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x3c]
push ecx
add eax, ecx
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x3c], eax
mov eax, dword [esi + 0xc]
add dword [ebp - 0x48], 2
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx], eax
push dword [esi + 0xb4]
push dword [esi + 0xb0]
push ebx
push ecx
mov dword [ebp - 0x14], esp
mov eax, esp
lea ecx, [ebp - 0x48]
push dword [ebp + 8]
mov dword [eax], ecx
lea ecx, [esi + 0x8c]
call fcn.100098ad
mov eax, dword [esi + 0xb8]
push 1
push dword [eax + 4]
push 0x30
push dword [esi + 0x90]
call edi
xor eax, eax
jmp 0x1000a6d9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x1000a6ea
Capabilities:
Capture webcam image
Hide graphical window

Disassembly:
mov eax, 0x100e1b76
call fcn.100c908c
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
xor edi, edi
mov ebx, ecx
mov dword [ebp - 4], edi
call fcn.1000a0d4
mov ecx, dword [ebx + 0x84]
lea eax, [ebp - 0x11]
push eax
push ebx
mov byte [ebp - 0x11], 0
call fcn.1007943b
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x18], eax
mov byte [ebp + 0xb], 1
jne 0x1000a757
push edi
push dword [ebx + 0x68]
lea eax, [ebx + 0x48]
push ecx
mov dword [ebp + 8], esp
mov ecx, esp
push eax
call fcn.1000548f
mov ecx, dword [ebx + 0x84]
add ecx, 0xf4
call fcn.1006951b
cmp eax, edi
setne byte [ebp + 0xb]
movzx eax, byte [ebp + 0xb]
neg eax
sbb eax, eax
and eax, 5
push eax
lea esi, [ebx + 0x90]
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp + 0xb], 0
jne 0x1000a78a
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
push edi
push edi
push 0xf1
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push 7
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
pop ecx
xor eax, eax
mov dword [ebp - 0x6c], 0x20
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0x34]
push eax
mov dword [ebp - 0x68], 0xa
mov byte [ebp - 0x5b], 0x70
mov dword [ebp + 8], ecx
call fcn.100054ad
lea ecx, [ebp - 0x6c]
push ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebx + 0xc]
push eax
mov edi, 0x440
push edi
push dword [ebp - 0x18]
call esi
mov eax, dword [ebx + 0xc]
push 0
push eax
push 0x419
push dword [ebp - 0x18]
call esi
lea ecx, [ebp - 0x4c]
push ecx
push eax
push 0x41d
push dword [ebp - 0x18]
call esi
cmp byte [ebp - 0x11], 0
jne 0x1000a82d
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x6c]
push ecx
mov word [ebp - 0x5a], ax
mov eax, dword [ebx + 0xc]
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x68], 0x48
mov byte [ebp - 0x5b], 0x60
call esi
call fcn.1004ade8
sub eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x48]
cdq
sub eax, edx
sar eax, 1
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
add dword [ebp - 0x4c], 2
push 1
lea eax, [ebp - 0x4c]
lea edi, [ebx + 0x90]
push eax
mov ecx, edi
call fcn.10003f7a
mov eax, dword [ebx + 0x84]
mov eax, dword [eax + 0xbc]
push 1
push eax
push 0x30
push dword [edi]
call esi
mov ecx, dword [ebp + 8]
push 0
call fcn.100054ad
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1000a777
Function at 0x1000b820
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ec812
call fcn.100c908c
push ecx
push esi
mov esi, ecx
push edi
mov byte [esi + 4], 0
mov dword [esi + 8], vtable.XMLNode_mix1.0
mov edi, 0x101519f8
lea ecx, [esi + 0xc]
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.TransformXML::Transform.1.0
mov dword [esi + 8], vtable.TransformXML::Transform.0
call fcn.1007170f
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
lea ecx, [esi + 0x14]
call fcn.100bf73d
and dword [esi + 0x2c], 0
push edi
lea ecx, [esi + 0x30]
call fcn.1007170f
push edi
lea ecx, [esi + 0x34]
call fcn.1007170f
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1000e3cb
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x100e1fb0
call fcn.100c908c
push ecx
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], ebx
call fcn.100b7ad3
push 1
mov dword [esi], vtable.AdBubbleWindow.0
mov dword [esi + 0x28], ebx
push esi
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push ebx
lea ecx, [esi + 0x3c]
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
call fcn.1000dafd
push 2
push esi
push ebx
lea ecx, [esi + 0x64]
call fcn.1000dafd
push 3
push esi
push ebx
lea ecx, [esi + 0x8c]
call fcn.1000dafd
mov eax, dword [ebp + 8]
mov dword [esi + 0xb8], ebx
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 3
mov dword [esi + 0xbc], eax
mov byte [esi + 0xd4], bl
mov byte [esi + 0xd6], bl
mov byte [esi + 0xd7], bl
mov dword [esi + 0xd8], ebx
mov byte [esi + 0xdc], bl
call fcn.1000dedd
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10015bd9
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100e4706
call fcn.100c908c
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 0x1010d92c
mov esi, ecx
push 0x100f40ec
mov ecx, edi
call dword [eax + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10009dc1
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.chevron
lea ecx, [ebp + 8]
call fcn.10004959
test eax, eax
jne 0x10015cc4
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x84]
call fcn.1000688b
mov eax, dword [edi + 0xc]
mov ecx, dword [esi + 0xb4]
push 0
mov dword [esi + 0x78], eax
push dword [edi + 0xc]
mov eax, dword [ecx]
push 0x419
call dword [eax + 0x5c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov ecx, dword [esi + 0xb4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [edi + 0xc]
sub eax, 0x400
push eax
mov eax, dword [ecx]
push 0x41d
call dword [eax + 0x5c]
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x7c], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
lea esi, [esi + 0x80]
mov dword [esi], eax
jne 0x10015ca4
mov dword [esi], 0x11
mov bl, 1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret 4
xor bl, bl
jmp 0x10015ca6
Function at 0x10015cc8
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100e4706
call fcn.100c908c
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 0x1010d92c
mov esi, ecx
push 0x100f40ec
mov ecx, edi
call dword [eax + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10009dc1
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.chevron_spacing
lea ecx, [ebp + 8]
call fcn.10004959
test eax, eax
jne 0x10015daf
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x98]
call fcn.1000688b
mov eax, dword [edi + 0xc]
mov ecx, dword [esi + 0xb4]
push 0
mov dword [esi + 0x8c], eax
push dword [edi + 0xc]
mov eax, dword [ecx]
push 0x419
call dword [eax + 0x5c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov ecx, dword [esi + 0xb4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [edi + 0xc]
sub eax, 0x400
push eax
mov eax, dword [ecx]
push 0x41d
call dword [eax + 0x5c]
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x90], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov bl, 1
mov dword [esi + 0x94], eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret 4
xor bl, bl
jmp 0x10015d91

Function at 0x10015db3
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100e4706
call fcn.100c908c
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 0x1010d92c
mov esi, ecx
push 0x100f40ec
mov ecx, edi
call dword [eax + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10009dc1
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.align_spacing
lea ecx, [ebp + 8]
call fcn.10004959
test eax, eax
jne 0x10015ea1
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0xac]
mov byte [esi + 0xb1], 1
call fcn.1000688b
mov eax, dword [edi + 0xc]
mov ecx, dword [esi + 0xb4]
push 0
mov dword [esi + 0xa0], eax
push dword [edi + 0xc]
mov eax, dword [ecx]
push 0x419
call dword [eax + 0x5c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov ecx, dword [esi + 0xb4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [edi + 0xc]
sub eax, 0x400
push eax
mov eax, dword [ecx]
push 0x41d
call dword [eax + 0x5c]
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov bl, 1
mov dword [esi + 0xa8], eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10003f60
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret 4
xor bl, bl
jmp 0x10015e83
Function at 0x10018dc1
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov eax, 0x100e2799
call fcn.100c908c
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
add ecx, 0x50
mov dword [ebp - 4], edi
call fcn.100054ad
push 0x24
push str.Alert
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x10018e00
mov eax, 0xfffffe6f
jmp 0x10018e91
push 0x7a
mov esi, 0x1000
xor ebx, ebx
pop eax
test eax, eax
je 0x10018e47
cmp eax, 0x7a
jne 0x10018e7d
test edi, edi
je 0x10018e1e
push edi
call fcn.100c8402
pop ecx
push esi
call fcn.100c74ae
mov edi, eax
pop ecx
lea eax, [ebp - 0x14]
push eax
mov dword [edi], esi
mov dword [ebp - 0x14], esi
push edi
test ebx, ebx
jne 0x10018e61
push ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x10018e68
test dword [edi + 0xc], 0x100000
jne 0x10018e59
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
push edi
push ebx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x10018e70
xor eax, eax
jmp 0x10018e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x14]
xor ecx, ecx
je 0x10018e0a
push edi
call fcn.100c8402
pop ecx
test ebx, ebx
je 0x10018e8f
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x10018ffd
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
mov eax, 0x100e27cd
call fcn.100c908c
sub esp, 0x2c
push ebx
push esi
add ecx, 0x50
mov eax, dword [ecx]
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], edi
cmp dword [eax - 0xc], edi
je 0x10019043
push edi
call fcn.100054ad
push 0x24
push str.Alert
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x10019043
mov eax, 0xfffffe6f
jmp 0x10019174
push 0x7a
mov esi, 0x1000
xor ebx, ebx
pop eax
test eax, eax
je 0x10019126
cmp eax, 0x7a
jne 0x10019160
push edi
call fcn.100c8402
push esi
call fcn.100c74ae
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 0x14]
push eax
mov dword [edi], esi
mov dword [ebp - 0x14], esi
push edi
test ebx, ebx
jne 0x10019140
push ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x10019147
test dword [edi + 0xc], 0x100000
je 0x10019138
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
push edi
push ebx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x1001914f
xor eax, eax
jmp 0x10019158
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x14]
xor ecx, ecx
je 0x1001904d
push edi
call fcn.100c8402
pop ecx
test ebx, ebx
je 0x10019172
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8