joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5939a7
Capabilities:
Encode data using xor

Disassembly:
invalid
add ebp, esp
loope 0x593a02
invalid
iretd
jl 0x5939c6
wait
bound edi, qword [edx]
sti
mov cl, 0x15
pop eax
stosb byte es:[edi], al
cmc
xor bl, byte [esi]
enter 0xffffffffffff9299, 0xffffffffffffffa0
out dx, al
mov edi, 0x878d28ab
in al, 0x67
mov ebp, 0x95263475
dec eax
dec esp
dec edx
add ecx, ebx
mov ebp, ebx
js 0x59398a
shr dword [ebp - 0x3a4f7d9a], cl
or eax, 0xd158bce8
in eax, 0x73
push cs
rcl byte [esi + edx*2 + 0x6e], cl
idiv byte [eax - 0x2e]
mov al, 0x61
js 0x59397e
lea eax, [eax + 0x46]
jecxz 0x593999
or byte [esp + ecx*8 + 0x22], dl
sub eax, 0xf60c6865
inc ecx
lodsb al, byte [esi]
invalid
jecxz 0x593988
sal byte [esi + 0x5a27d264], cl
jle 0x5939d9
add al, 0xad
xchg edi, eax
push esi
rol dword [edx], 1
lahf
jmp 0xfc79330d

Function at 0x5ab627
Capabilities:
Encode data using xor

Disassembly:
shr esp, cl
neg ebx
lahf
out dx, al
daa
les edi, [ecx + 6]
add byte [edx], 0x74
push 0x5397d5af
test dword ss:[ecx], ebx
lds ebx, [edx]
xchg ebx, eax
test eax, 0x410ef136
pop edx
jl 0x5ab6af
popal
imul eax, dword [ebx - 0x5f], 0x49460162
jge 0x5ab688
mov ah, 0x38
ret 0xe9c6
sub esp, dword [edi - 0x1a]
scasb al, byte es:[edi]
call 0x81fe2b51
cmp ebp, ebp
dec sp
jo 0x5ab706
aas
fisttp qword [esi - 0x41]
pop ss
repe scasb al, byte es:[edi]
hlt
jmp 0x7f6c04be
dec esi
adc dword [edi + 0xf], edi
push esi
cmp eax, 0x4337b0e1
and byte [0x6b41699], ah
sub al, 0x27
outsd dx, dword [esi]
push ecx
clc
mov eax, 0xec23841
add al, 0x7b
pushal
cli
popal
jecxz 0x5ab6ad
push ss
pop ss
call 0xe001893f
cmp dh, byte [edx + 0x6f]
xchg edx, eax
inc edx
cwde
mov ah, 0xb4
xor eax, 0xafb9d0f6
in al, 2
push esp
dec cl
pop ds
or byte [ecx], ch
mov byte [0xaf1c2e46], al
or eax, 0xc9fe9689
cwde
xlatb
mov eax, dword [0xd6eb3ac6]
pop edx
sbb bh, byte [eax + 0x25]
pop ss
xor dword [eax + 0x40], ecx
dec eax
inc eax
ror dword [ecx - 0x6e], 6
sbb ebx, ebp
xchg esp, eax
jecxz 0x5ab6e6
nop
insd dword es:[edi], dx
mov edi, ebx
pop ss
adc edx, dword [esp + edi*8 + 0x54]
je 0x5ab6d0
invalid
Function at 0x10032ed9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10032f18
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10032f18
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10032f18
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10032f18
cmp dword [ecx + 0x74], 0xe
jbe 0x10032f18
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10035b0b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10035ba8
push ebx
push esi
call fcn.10035ad4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10035a68
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10035b55
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035ba7
push edi
push eax
call fcn.10036a34
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10035b75
call fcn.100345b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035ba6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10035a68
add esp, 0x20
test eax, eax
jne 0x10035b94
push edi
call fcn.100345b0
jmp 0x10035b9c
push ebx
call fcn.100345b0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10035e15
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea00
push 0x1003e9f8
push str.FlsAlloc
push 0x1f
call fcn.10035d31
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035e49
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c174]
call esi
jmp 0x10035e4f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10035e93
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea10
push 0x1003ea08
push str.FlsGetValue
push 0x21
call fcn.10035d31
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035eca
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10035ed2
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea18
push 0x1003ea10
push str.FlsSetValue
push 0x22
call fcn.10035d31
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035f0c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003c174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1003b460
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003b48d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003b48d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10007870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10131cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10167b84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.1000aef0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10007b60
add esp, 4
push eax
lea edx, [ebp - 0x38]
push edx
call fcn.10009700
add esp, 8
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10009b70
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x30]
call fcn.1000a060
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.10009860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.1000b950
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x18], 0
jne 0x1000795a
mov edx, dword [ebp - 0x14]
add edx, 0x1c
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x1000d720
push 0
push 0
call fcn.10112840
add esp, 0x18
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], eax
mov byte [ebp - 0xd], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000be40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000bff0
mov al, byte [ebp - 0xd]
jmp 0x1000797c
mov byte [ebp - 0xe], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000be40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000bff0
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10017b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10017ba4
xor eax, eax
jmp 0x10017c24
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10017bbb
xor eax, eax
jmp 0x10017c24
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10017c07
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10017c07
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x10017bde
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10017c13
xor eax, eax
jmp 0x10017c24
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10017c21
xor eax, eax
jmp 0x10017c24
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10019e90
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10132b7b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1010db20
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.2345ExplorerUser_DataDefaultHistory
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10019f4d
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10015730
mov dword [ebp - 4], 0
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x220]
add ecx, 4
call fcn.1001a0a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.100159b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1001ab70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10132c46
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10015730
mov dword [ebp - 4], 0
cmp dword [ebp - 0x220], 0
jne 0x1001ac0b
push str.GoogleChromeUser_DataDefaultHistory
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.1001aaf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call fcn.1001b950
jmp 0x1001ac74
lea ecx, [ebp - 0x224]
call fcn.100157e0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x220]
push edx
push str.GoogleChromeUser_DataProfile__dHistory
lea eax, [ebp - 0x224]
push eax
call fcn.1001a9f0
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.10010af0
push eax
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.1001aaf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call fcn.1001b950
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.100159b0
lea ecx, [ebp - 0x21c]
call fcn.10010af0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001acb0
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x228]
add ecx, 4
call fcn.1001bca0
mov edx, dword [ebp - 0x220]
add edx, 1
mov dword [ebp - 0x220], edx
jmp 0x1001acc4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.100159b0
jmp 0x1001ace3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.100159b0
mov eax, 1
test eax, eax
jne 0x1001abbe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1001bcc0
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10132d96
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1010db20
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.MozillaFirefox
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x424]
call fcn.100157e0
mov dword [ebp - 4], 0
push str.profiles.ini
lea eax, [ebp - 0x218]
push eax
push 0x104
lea ecx, [ebp - 0x424]
call fcn.1001aaf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x424]
call fcn.1001b950
lea ecx, [ebp - 0x424]
call fcn.10010af0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001bd9a
lea ecx, [ebp - 0x424]
call fcn.10010af0
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1001bdb1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.100159b0
jmp 0x1001bea2
push 0x208
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.1010db20
add esp, 0xc
lea ecx, [ebp - 0x424]
call fcn.10010af0
push eax
push 0x104
lea edx, [ebp - 0x420]
push edx
push 0x10139514
push str.Path
push str.Profile0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x420]
test edx, edx
jne 0x1001be1f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.100159b0
jmp 0x1001bea2
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.places.sqlite
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001be90
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x428]
call fcn.10015730
mov byte [ebp - 4], 1
lea edx, [ebp - 0x428]
push edx
mov ecx, dword [ebp - 0x42c]
add ecx, 4
call fcn.1001a0a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x428]
call fcn.100159b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.100159b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1001ceb0
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10132f3b
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x428], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1010db20
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x208
push 0
lea edx, [ebp - 0x420]
push edx
call fcn.1010db20
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x430], 0x104
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x434]
push edx
push 0x10139768
push 0x10139788
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1001cf67
jmp 0x1001d02e
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
push eax
push 0x10139800
lea ecx, [ebp - 0x420]
push ecx
call fcn.1001d230
add esp, 0xc
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x424], 7
jl 0x1001cfaf
push str.Liebao7User_DataDefaultHistory
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x1001cfc1
push str.liebaoUser_DataDefaultHistory
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001d012
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x42c]
call fcn.10015730
mov dword [ebp - 4], 0
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x428]
add ecx, 4
call fcn.1001a0a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.100159b0
cmp dword [ebp - 0x424], 7
jge 0x1001d02e
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x428]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret

Function at 0x1001d270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10132b7b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1010db20
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQBrowserUser_DataDefaultHistory
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.10015730
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x220]
add ecx, 4
call fcn.1001a0a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.100159b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1001d370
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10132fa7
mov eax, dword fs:[0]
push eax
sub esp, 0x694
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x690], ecx
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1010db20
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SogouExplorer
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x67c]
call fcn.1001c790
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x680]
call fcn.10015730
mov byte [ebp - 4], 1
push str..
lea ecx, [ebp - 0x680]
push ecx
lea edx, [ebp - 0x6a0]
push edx
call fcn.1001c810
add esp, 0xc
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x69c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x69c]
call fcn.10010af0
push eax
lea ecx, [ebp - 0x67c]
call fcn.1001c980
test eax, eax
jne 0x1001d45c
mov dword [ebp - 0x688], 1
jmp 0x1001d466
mov dword [ebp - 0x688], 0
mov cl, byte [ebp - 0x688]
mov byte [ebp - 0x681], cl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6a0]
call fcn.100159b0
movzx edx, byte [ebp - 0x681]
test edx, edx
je 0x1001d4b2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x680]
call fcn.100159b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call fcn.1001c7d0
jmp 0x1001d5ee
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x680]
call fcn.10015ac0
lea ecx, [ebp - 0x67c]
call fcn.1001d050
test eax, eax
je 0x1001d55d
lea ecx, [ebp - 0x67c]
call fcn.1001d070
test eax, eax
jne 0x1001d55d
lea ecx, [ebp - 0x68c]
push ecx
lea ecx, [ebp - 0x67c]
call fcn.1001ce10
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x68c]
push edx
lea ecx, [ebp - 0x680]
call fcn.10010af0
push eax
push str._s_suhistory3.db
lea eax, [ebp - 0x680]
push eax
call fcn.1001a9f0
add esp, 0x10
lea ecx, [ebp - 0x680]
call fcn.10010af0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001d54e
lea ecx, [ebp - 0x680]
push ecx
mov ecx, dword [ebp - 0x690]
add ecx, 4
call fcn.1001bca0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68c]
call fcn.100159b0
lea ecx, [ebp - 0x67c]
call fcn.1001cae0
test eax, eax
jne 0x1001d4b2
push str.uhistory3.db
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001d5cd
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x694]
call fcn.10015730
mov byte [ebp - 4], 4
lea edx, [ebp - 0x694]
push edx
mov ecx, dword [ebp - 0x690]
add ecx, 4
call fcn.1001a0a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x694]
call fcn.100159b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x680]
call fcn.100159b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call fcn.1001c7d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x1001daa0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013307b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 1
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1010db20
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x224]
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTheWorld6
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001db99
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefaultHistory
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001db99
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10015730
mov dword [ebp - 4], 0
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x228]
add ecx, 4
call fcn.1001a0a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.100159b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret
Function at 0x10025e00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10131cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10167b84]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.1000aef0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10007b60
add esp, 4
push eax
lea edx, [ebp - 0x38]
push edx
call fcn.10009700
add esp, 8
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10029a50
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x30]
call fcn.1000a060
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.10029680
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.1000b950
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x18], 0
jne 0x10025eea
mov edx, dword [ebp - 0x14]
add edx, 0x1c
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x1000d720
push 0
push 0
call fcn.10112840
add esp, 0x18
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], eax
mov byte [ebp - 0xd], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000be40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000bff0
mov al, byte [ebp - 0xd]
jmp 0x10025f0c
mov byte [ebp - 0xe], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000be40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000bff0
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4