joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6076e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x6076fd
add esp, 0xfffffff0
call fcn.00403a3c
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x6077d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.006024f4
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041c17c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x28], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041c17c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041c17c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x38], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041c17c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041c1a4
push esi
lea edi, [esi + 0x44]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x56], 0
mov byte [esi + 0x57], 0
mov byte [esi + 0x58], 0
mov byte [esi + 0x59], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6077df
lea eax, [ebp - 4]
call fcn.004044ec
ret
Function at 0x61f2d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.0061ffbc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0061f258
pop ecx
call fcn.005fa554
test al, al
je 0x61f380
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x61f380
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.0045a7f4
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.0045a7f4
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x61f369
mov eax, dword [edi]
call fcn.0045a7f4
xor edx, edx
call fcn.005fa590
jmp 0x61f380
mov eax, dword [edi]
call fcn.0045a7f4
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.005fa590
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.0045a7f4
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.00453ec4
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x61f419
cmp byte [ebx + 0x60], 0
je 0x61f419
call fcn.005fa554
test al, al
je 0x61f419
mov eax, dword [0x644548]
mov eax, dword [eax]
call fcn.00473a30
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 5
jbe 0x61f409
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x61f3fb
mov ebx, eax
mov eax, dword [edi]
call fcn.0045a7f4
mov edx, ebx
call fcn.005fa590
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x61f3d3
mov eax, dword [edi]
call fcn.006204fc
mov eax, dword [edi]
call fcn.0045a7f4
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x622ea8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x622f11
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x643ab4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x622efb
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00622e98
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x622ca0]
call fcn.00622f38
mov dword [0x643b18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622f18
lea eax, [ebp - 8]
call fcn.00406428
ret
Function at 0x62fc3c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x62fdc8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, dword [0x644548]
mov eax, dword [eax]
call fcn.004741ec
lea edx, [ebp - 4]
mov eax, dword [0x643f38]
call fcn.00475504
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0x62fdd4
call fcn.0040646c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0x62fde4
call fcn.0040646c
mov eax, dword [ebp - 0x14]
call fcn.004049c8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 0x14]
call fcn.00409cc8
mov eax, dword [ebp - 0x128]
call fcn.004049c8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x10]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x121]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x62fdfc
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.00409098
push dword [ebp - 0x12c]
push 0x62fe08
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404888
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.0040475c
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 0x1c]
call fcn.004047d0
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x18]
call fcn.00404d68
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404d78
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62fdcf
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00404510
lea eax, [ebp - 0x1c]
call fcn.004044ec
lea eax, [ebp - 0x18]
call fcn.00404c14
lea eax, [ebp - 0x14]
call fcn.004044ec
lea eax, [ebp - 0xc]
call fcn.00406428
lea eax, [ebp - 8]
call fcn.00406428
lea eax, [ebp - 4]
call fcn.00406428
ret
Function at 0x62fe10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x62ff22
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00575258
mov ebx, eax
test ebx, ebx
jbe 0x62fefc
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.00575278
jmp 0x62fef2
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.0040475c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408e44
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.00408e44
mov edx, dword [ebp - 0x138]
pop eax
call fcn.00404914
jne 0x62fee5
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
jbe 0x62fee5
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.00575298
test eax, eax
jne 0x62fe77
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62ff29
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00404510
lea eax, [ebp - 4]
call fcn.004044ec
ret
Function at 0x10001240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035a18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10046f20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.10020753
add esp, 4
cmp eax, ebx
je 0x10001324
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x18]
push 8
mov dword [edi], ebx
call fcn.10020753
add esp, 4
cmp eax, ebx
je 0x10001300
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.1002061a
push 0x10042528
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.10021d71
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.1002061a
push 0x10042528
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], vtable.std::bad_alloc.0
call fcn.10021d71
int3
Function at 0x10007930
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035b40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x10046f20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1001c310
add esp, 8
push eax
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.100080e0
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000799c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.1001c050
add esp, 4
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], 1
call fcn.100080e0
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100079d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
mov ecx, str.rundll32.exe
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007a06
test dx, dx
je 0x10007a02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007a06
add eax, 4
add ecx, 4
test dx, dx
jne 0x100079e0
xor eax, eax
jmp 0x10007a0a
sbb eax, eax
sbb eax, esi
test eax, eax
sete al
test al, al
je 0x10007b02
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x10]
call fcn.10007b20
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], 2
call fcn.10007e70
push eax
call fcn.10007f00
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jge 0x10007a49
mov eax, esi
jmp 0x10007a64
push str..dll
push eax
call fcn.10020e29
add esp, 8
test eax, eax
jne 0x10007a5f
mov eax, esi
jmp 0x10007a64
sub eax, dword [ebp - 0x10]
sar eax, 1
add eax, 4
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.10007c40
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.100080e0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10007aa2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
jne 0x10007ab3
xor ecx, ecx
jmp 0x10007ad2
mov ecx, eax
lea esi, [ecx + 2]
jmp 0x10007ac0
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10007ac0
sub ecx, esi
sar ecx, 1
or esi, 0xffffffff
push ecx
push eax
mov ecx, edi
call fcn.10008250
mov ecx, dword [ebp + 8]
call fcn.10007e00
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x10007b02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10008780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000879b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100087d2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100087ce
jmp 0x100087c0
cmp esi, eax
jae 0x100087d2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100087c0
cmp esi, eax
jb 0x100087d9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10009cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10009dd9
mov edx, dword [ebp - 4]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.DisplayName
mov esi, 1
push edx
mov dword [ebp - 0xc], esi
call edi
cmp eax, 2
jne 0x10009d52
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x10009daa
cmp dword [ebp - 0xc], esi
jne 0x10009dcd
mov eax, dword [ebp - 8]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100200ee
mov esi, eax
mov eax, dword [ebp - 8]
inc eax
push eax
push 0
push esi
call fcn.10022440
mov eax, dword [ebp - 4]
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push 0
push str.DisplayName
push eax
call edi
push esi
test eax, eax
je 0x10009dbc
call fcn.1002089d
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
call fcn.10007bf0
push esi
call fcn.1002089d
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a770
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036028
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10046f20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10046a68]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x10046a68
mov byte [ebp - 0x34], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10046a68]
mov edx, dword [eax + 0xc]
mov ecx, 0x10046a68
call edx
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [0x10046a68]
mov edx, dword [eax + 0xc]
mov ecx, 0x10046a68
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0xb
push 0x1003de70
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.10008250
push 0x26
push str.590AAAA2_739E_485e_BF4D_08DDD39C93F6
lea ecx, [ebp - 0x18]
call fcn.10008250
push 0x18
push str.Internet_Explorer_Server
lea ecx, [ebp - 0x14]
call fcn.10008250
lea eax, [ebp - 0x34]
push eax
push 0x100090e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov bl, byte [ebp - 0x34]
lea esi, [ebp - 0x34]
call fcn.1000a860
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002020d
mov esp, ebp
pop ebp
ret

Function at 0x1000aa30
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10046f20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.BDMSusDetailFrame
lea ecx, [ebp - 0x38]
call fcn.10007b20
mov eax, dword [ebp - 0x38]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x1000aa86
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000aa86
mov bl, 1
jmp 0x1000aa88
xor bl, bl
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000aaa7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x1000aaaf
mov al, 1
jmp 0x1000ab03
lea esi, [ebp - 0x34]
call fcn.100093c0
push 0xf
push str.BaiduAnTray.exe
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.10008250
push 0
push 0x1003e050
lea ecx, [ebp - 0x18]
call fcn.10008250
push 8
push str.wnd_base
lea ecx, [ebp - 0x14]
call fcn.10008250
mov ecx, esi
push ecx
push 0x100090e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov bl, byte [ebp - 0x34]
call fcn.1000a860
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002020d
mov esp, ebp
pop ebp
ret
Function at 0x1000b350
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035ac8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10046f20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
push eax
call fcn.1001b3b0
push 0x1003dff8
push eax
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 4], 0
call fcn.10007cc0
add esp, 0x10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000b3ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000b3d2
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x10046a68]
mov edx, dword [eax + 0xc]
mov ecx, 0x10046a68
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x1003e050
push str.SoftwareSystemSres
push 0x80000001
mov byte [ebp - 4], 3
call fcn.1001c510
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov ecx, 0x1003e00c
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000b436
test dx, dx
je 0x1000b432
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000b436
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000b410
xor eax, eax
jmp 0x1000b43b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x1000b456
push str.SoftwareSystemSres
push 0x80000001
call fcn.1001c4c0
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000b479
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000b49f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000bfa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003615d
mov eax, dword fs:[0]
push eax
mov eax, 0x5018
call fcn.10022990
mov eax, dword [0x10046f20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x5018], eax
mov dword [ebp - 0x5024], esi
mov dword [ebp - 4], 2
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
push 0x5000
lea eax, [ebp - 0x5010]
push esi
push eax
mov dword [ebp - 0x5024], 1
call fcn.10022440
mov edx, dword [0x10046a68]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x10046a68
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x5014], edi
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ecx
push 0x2800
lea edx, [ebp - 0x5010]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor eax, eax
mov dword [ebp - 0x501c], eax
lea ebx, [ebp + eax*2 - 0x5010]
movzx eax, word [ebx]
test ax, ax
je 0x1000c0b7
mov ebx, dword [edi - 0xc]
lea esi, [ebx + 1]
mov ecx, eax
mov dword [ebp - 0x5020], ecx
test esi, esi
js 0x1000c190
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x1000c098
push esi
lea ecx, [ebp - 0x5014]
call fcn.10008300
mov edi, dword [ebp - 0x5014]
mov dx, word [ebp - 0x5020]
mov word [edi + ebx*2], dx
cmp esi, dword [edi - 8]
jg 0x1000c190
xor eax, eax
mov dword [edi - 0xc], esi
mov word [edi + esi*2], ax
jmp 0x1000c0ee
lea esi, [ebp - 0x5014]
call fcn.1000b910
test al, al
je 0x1000c0e8
mov ecx, esi
push ecx
mov ecx, dword [ebp - 0x5018]
call fcn.10008be0
push 0x1003cacf
mov ecx, esi
call fcn.1000b7c0
mov edi, dword [ebp - 0x5014]
jmp 0x1000c0ee
cmp word [ebx], 0
je 0x1000c106
mov eax, dword [ebp - 0x501c]
inc eax
mov dword [ebp - 0x501c], eax
cmp eax, 0x2800
jl 0x1000c050
add edi, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x1000c126
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000c149
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000c16c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x5018]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002020d
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.100087f0
int3