joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f03f
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x14
mov eax, 0x10135ed3
call fcn.101018b2
mov ecx, 0x1019e0a4
call fcn.1001c3eb
mov eax, dword [0x1019a028]
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov esi, 0x104
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.10001a82
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.10001c5b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str._srp__d
push eax
call fcn.100020c6
mov eax, dword [0x1019a028]
mov dword [ebp - 0x1c], eax
push 0
mov byte [ebp - 4], 2
call fcn.101029ff
push eax
push str.http:__toolbar.baidu.com_update_rp
lea eax, [ebp - 0x1c]
push str._s_t_d
push eax
call fcn.100020c6
add esp, 0x24
push 1
push 0x4e20
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.1000584b
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov byte [ebp - 4], 3
call fcn.1000584b
mov byte [ebp - 4], 2
call fcn.100dbabe
add esp, 0x10
test eax, eax
je 0x1001f16f
mov eax, dword [0x1019a028]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 4
call esi
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str._srp_dat__d
push eax
call fcn.100020c6
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10056674
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x18
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001f167
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.1000584b
mov ecx, dword [ebp + 8]
call fcn.1001e69c
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x10]
call fcn.100015d9
lea ecx, [ebp - 0x1c]
call fcn.100015d9
lea ecx, [ebp - 0x14]
call fcn.100015d9
lea ecx, [ebp - 0x18]
call fcn.100015d9
call fcn.1010198a
ret 4

Function at 0x1001f418
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
mov ebx, ecx
call fcn.101029ff
pop ecx
mov esi, 0x1019e718
mov ecx, esi
mov edi, eax
call fcn.1003a141
mov ecx, edi
sub ecx, eax
cmp ecx, 0x15180
jl 0x1001f47e
push edi
mov ecx, esi
call fcn.1003a16b
lea eax, [esp + 0xc]
push eax
push 4
push ebx
push 0x1001f18f
push 0
push 0
call fcn.1010370a
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1001f47e
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10020c96
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x101360e2
call fcn.1010191b
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax - 8], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
jne 0x10020ccb
call fcn.100015d9
xor eax, eax
lea esp, [ebp - 0x22c]
call fcn.1010199e
ret
push ebx
call fcn.10001a82
cmp eax, ebx
mov dword [ebp - 0x21c], eax
je 0x10020cea
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10020cee
xor esi, esi
jmp 0x10020d0a
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push dword [ebp - 0x21c]
push eax
call fcn.1000c619
mov esi, eax
mov ecx, esi
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x10020d0f
sub ecx, eax
push ecx
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.100e1b2b
add esp, 0xc
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10005459
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.100015d9
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call fcn.101027c0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
ja 0x10020d8b
mov ecx, edi
call fcn.10020ba7
lea ecx, [ebp + 8]
call fcn.100015d9
mov eax, ebx
jmp 0x10020cbf
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000c27f
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.10005459
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.100015d9
push 0x101562e0
mov ecx, edi
call fcn.1001c185
xor ebx, ebx
inc ebx
jmp 0x10020d7c

Function at 0x10020dca
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x10136128
call fcn.1010191b
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp + 8]
jne 0x10020dfb
call fcn.100015d9
xor eax, eax
call fcn.1010199e
ret
add eax, eax
cmp eax, ebx
je 0x10020dee
push eax
push ebx
call fcn.10001a82
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.100e1b2b
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10005459
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.100015d9
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call fcn.101027c0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
jg 0x10020e7a
mov ecx, esi
call fcn.10020ba7
lea ecx, [ebp + 8]
call fcn.100015d9
mov eax, ebx
jmp 0x10020df5
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000c27f
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10005459
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], bl
call fcn.100015d9
push 0x101562e8
mov ecx, esi
call fcn.1001c185
xor ebx, ebx
inc ebx
jmp 0x10020e6b
Function at 0x10029cc4
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [esi + 4], ebx
jle 0x10029d5f
push edi
mov edi, 0x1019ee20
push ebx
mov ecx, esi
call fcn.10029813
mov eax, dword [eax]
mov ecx, dword [esi + 0x10]
push 0x3e8
push eax
push ecx
mov ecx, edi
call fcn.100101c4
push eax
call fcn.100e023c
add esp, 0x10
cmp eax, 1
push ebx
mov ecx, esi
jne 0x10029d3e
mov dword [ebp - 4], 2
call fcn.10029813
mov eax, dword [eax]
mov ecx, dword [esi + 0x10]
push 4
lea edx, [ebp - 4]
push edx
push 4
push eax
push ecx
mov ecx, edi
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x10029d58
call fcn.10029813
mov eax, dword [eax]
mov ecx, dword [esi + 0x10]
push eax
push ecx
mov ecx, edi
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
inc ebx
cmp ebx, dword [esi + 4]
jl 0x10029ce7
pop edi
mov ecx, esi
call fcn.10029b39
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
leave
ret

Function at 0x1002b004
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002b06c
cmp dword [ebp + 0x10], 1
je 0x1002b045
cmp dword [ebp + 0x10], 2
je 0x1002b045
push 0xd
pop eax
jmp 0x1002b06c
test edi, edi
mov eax, dword [ebp - 4]
je 0x1002b066
test eax, eax
je 0x1002b062
test al, 1
jne 0x1002b040
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x1002b066
jmp 0x1002b040
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x1003550e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1019c8c8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x20], eax
call fcn.101029ff
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp], str.B6A97DF4_0C92_4b57_B5C0_91E4B1BE6942
stosw word es:[edi], ax
push 0x10153b9c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.1010314f
push 0xa0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.100567bd
add esp, 0x24
push 0xc
lea eax, [ebp - 0x24]
push eax
push 3
push str.IntegrigyProtect
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.101018a3
leave
ret 4

Function at 0x10035650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1019c8c8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x20], eax
call fcn.101029ff
mov dword [ebp - 0x1c], eax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp], str.D4F994C3_7321_4bdb_9088_1FB0C9D56A71
stosw word es:[edi], ax
push 0x10153b9c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.1010314f
push 0xa0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.100567bd
add esp, 0x24
push 0xc
lea eax, [ebp - 0x24]
push eax
push 3
push str.itdate
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.101018a3
leave
ret 4
Function at 0x10035939
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1019c8c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov esi, 0x10153b9c
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x418]
push 0x400
push eax
call fcn.1010314f
mov ebx, eax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str.89F3CC4B_0091_49B0_81A6_188CFF582735
stosw word es:[edi], ax
push esi
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.1010314f
push 0xa0
lea eax, [ebp - 0x18]
push eax
lea esi, [ebx + 1]
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.100567bd
add esp, 0x38
push esi
lea eax, [ebp - 0x418]
push eax
push 3
push str.trustlist
push 0x10155e34
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101018a3
leave
ret 4

Function at 0x10035de7
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x101387eb
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x10035e34
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10035e38
xor eax, eax
jmp 0x10035e4d
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10035e72
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100567bd
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.dnlistips
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4
Function at 0x10035ed2
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1013881b
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x10035f1f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10035f23
xor eax, eax
jmp 0x10035f38
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10035f5d
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100565d4
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.InternalRules
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4

Function at 0x10035fb2
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1013884b
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x10035fff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10036003
xor eax, eax
jmp 0x10036018
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003603d
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100567bd
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalTray
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4
Function at 0x1003609d
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1013887b
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x100360ea
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x100360ee
xor eax, eax
jmp 0x10036103
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036128
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100567bd
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalIcon
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4

Function at 0x10036188
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x101388ab
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x100361d5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x100361d9
xor eax, eax
jmp 0x100361ee
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036213
sub eax, edx
push 0xa0
mov esi, eax
push str.B6D8143E_46B5_4926_9CCD_E862519ED72F
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100567bd
add esp, 0x10
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalBmp
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4
Function at 0x10036273
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x101388db
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x100362c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x100362c4
xor eax, eax
jmp 0x100362d9
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100362fe
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100565d4
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.internalpttName
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4

Function at 0x10036353
Capabilities:
Set registry value

Disassembly:
push 0x804
mov eax, 0x1013890b
call fcn.1010191b
xor ebx, ebx
push 0x7ff
lea eax, [ebp - 0x80f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x810], bl
call fcn.101027c0
add esp, 0xc
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x100363a0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x100363a4
xor eax, eax
jmp 0x100363b9
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
push 0x10153b9c
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.1010314f
lea eax, [ebp - 0x810]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100363de
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.100565d4
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x810]
push eax
push 3
push str.UnInstallFeedBackUrl
push 0x10155e34
mov ecx, 0x1019ee20
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x820]
call fcn.1010199e
ret 4
Function at 0x100365cc
Capabilities:
Set registry value

Disassembly:
push 0x40
mov eax, 0x1013893b
call fcn.1010191b
mov esi, ecx
lea edi, [esi + 4]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], ebx
jne 0x100365fa
push edi
jmp 0x100366b6
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.10005459
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x48], bl
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
push ebx
lea ecx, [ebp + 8]
call fcn.10001a82
mov edi, eax
cmp edi, ebx
je 0x10036630
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10036634
xor eax, eax
jmp 0x10036649
lea esi, [eax + eax]
mov eax, esi
call fcn.10102de0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.1000c619
push eax
mov esi, 0x10153b9c
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push 0x20
push eax
call fcn.1010314f
xor eax, eax
mov byte [ebp - 0x24], bl
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str.89F3CC4B_0091_49B0_81A6_188CFF582735
stosw word es:[edi], ax
push esi
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 0x14
push eax
call fcn.1010314f
push 0xa0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x48]
push 0x20
push eax
call fcn.100567bd
add esp, 0x38
push 0x20
lea eax, [ebp - 0x48]
push eax
push 3
push str.qdmcmc
push 0x10155e34
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 8]
call fcn.100015d9
lea esp, [ebp - 0x5c]
call fcn.1010199e
ret 4
Function at 0x1003aa24
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x10139afb
call fcn.101018b2
push str.GetConfigDoc_n
xor edi, edi
push 7
mov dword [ebp - 0x20], edi
call fcn.100c93e3
lea eax, [ebp - 0x1c]
push eax
call fcn.100dfb58
add esp, 0xc
push str.config.dat
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], edi
call fcn.100058db
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.100015d9
push dword [ebp - 0x10]
call fcn.100dd2fb
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ecx
je 0x1003aa83
push dword [ebp - 0x10]
call esi
push 1
push 0x4e20
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.1000584b
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.http:__toolbar.baidu.com_config_config.dat
mov byte [ebp - 4], 3
call fcn.1000587e
mov byte [ebp - 4], 2
call fcn.100dbabe
add esp, 0x10
cmp eax, edi
jne 0x1003aad5
push str.GetConfigDoc_Failed_n
push 7
call fcn.100c93e3
pop ecx
pop ecx
push dword [ebp - 0x10]
call esi
jmp 0x1003ab92
push edi
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 0x14], edi
call fcn.1000584b
call fcn.100df5f3
add esp, 0xc
push dword [ebp - 0x10]
mov ebx, eax
call esi
cmp ebx, edi
jbe 0x1003ab92
cmp dword [ebp - 0x14], edi
je 0x1003ab92
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.100164bd
push dword [ebp - 0x14]
call fcn.10101095
pop ecx
mov dword [ebp - 0x18], edi
mov esi, dword [ebp - 0x20]
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jbe 0x1003ab7a
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.100e6f02
test eax, eax
pop ecx
pop ecx
jl 0x1003ab7a
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x1003ab7d
mov ecx, dword [ebp + 8]
push eax
call fcn.1003a982
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov byte [ebp - 4], 4
je 0x1003ab66
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x10]
call fcn.100015d9
mov eax, dword [ebp + 8]
jmp 0x1003aba1
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov byte [ebp - 4], 4
je 0x1003ab8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [esi], edi
call fcn.100015d9
mov eax, esi
call fcn.1010198a
ret