joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a0e30
Capabilities:
Check if file exists
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a0ee3
push 0
push 0x80
push 3
push 0
push 1
push 0x10000000
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100a0ed6
cmp dword [ebp - 4], 0xffffffff
je 0x100a0ed6
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100a0ea9
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
jne 0x100a0ecc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x101c9740
jmp 0x100a0ee8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.1004f530
jmp 0x100a0ee8
mov eax, 0x101c9744
mov esp, ebp
pop ebp
ret 4

Function at 0x100a20b0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x1c
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a20df
mov ecx, dword [ebp - 4]
add ecx, 0x1c
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a2107
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x100a6270
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a6ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp + 0xc], 0
jne 0x100a6384
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40]
sub edx, 0x1c
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax - 0x1c]
push edx
mov edx, dword [ecx + 0x34]
call edx
cmp dword [ebp - 0x10], 0
jne 0x100a62e3
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40]
sub edx, 0x1c
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax - 0x1c]
push edx
mov edx, dword [ecx + 0x6c]
call edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100a6384
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 0x2c]
call ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100a6321
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [eax + 0x2c]
call edx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.100a2230
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x28]
call fcn.100056e0
cmp dword [ebp - 0x24], 0
je 0x100a6376
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.100a2230
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2c]
call fcn.100056e0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x40]
add eax, 0x24
push eax
lea ecx, [ebp - 0x20]
call fcn.10007270
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x40]
add ecx, 4
call fcn.10056300
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x100a63be
lea ecx, [ebp - 0x1c]
call fcn.10056c10
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x40]
add ecx, 4
call fcn.10020880
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009a10
movzx edx, al
test edx, edx
je 0x100a640b
lea ecx, [ebp - 0x1c]
call fcn.100d2e80
cmp dword [eax], 0
je 0x100a6409
lea ecx, [ebp - 0x1c]
call fcn.100d2e80
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
call edx
jmp 0x100a63b6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100072a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100abd60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
push 0
push 0x2000000
push 3
push 0
push 7
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x100abdbb
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x100b3d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a45ab
mov eax, dword fs:[0]
push eax
mov eax, 0x2af4
call fcn.1019a6e0
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b00], ecx
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2af4], eax
cmp dword [ebp - 0x2af4], 0xffffffff
jne 0x100b3d87
xor al, al
jmp 0x100b3f87
mov dword [ebp - 0x10], 0x104
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea ecx, [ebp - 0x11b]
push ecx
call fcn.101845c0
add esp, 0xc
mov byte [ebp - 0x2aec], 0
push 0x103
push 0
lea edx, [ebp - 0x2aeb]
push edx
call fcn.101845c0
add esp, 0xc
push 0
push 2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_UrlGetPartA]
mov dword [ebp - 0x2af0], eax
push 0x2f
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.10181230
add esp, 8
mov dword [ebp - 0x2af8], eax
cmp dword [ebp + 0x10], 0
je 0x100b3e3e
cmp dword [ebp + 0x14], 0
je 0x100b3e3e
mov ecx, dword [ebp - 0x2af8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str._dm__d__d_90_s
push 0x104
lea ecx, [ebp - 0x2aec]
push ecx
call fcn.100b4360
add esp, 0x18
lea edx, [ebp - 0x2aec]
mov dword [ebp - 0x2af8], edx
lea ecx, [ebp - 0x1dc]
call fcn.100b2ef0
mov dword [ebp - 4], 0
push str.Mozilla_4.0__compatible___
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.100b5c00
movzx ecx, al
test ecx, ecx
je 0x100b3e8f
push 0
push 0
mov edx, dword [ebp - 0x2af8]
push edx
lea ecx, [ebp - 0x1dc]
call fcn.100b6260
movzx eax, al
test eax, eax
jne 0x100b3eb3
mov byte [ebp - 0x2af9], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.100b2fc0
mov al, byte [ebp - 0x2af9]
jmp 0x100b3f87
mov byte [ebp - 0x29e4], 0
push 0x27ff
push 0
lea ecx, [ebp - 0x29e3]
push ecx
call fcn.101845c0
add esp, 0xc
push 0x2800
lea edx, [ebp - 0x29e4]
push edx
lea ecx, [ebp - 0x1dc]
call fcn.100b76c0
mov dword [ebp - 0x1e0], eax
xor eax, eax
cmp eax, dword [ebp - 0x1e0]
sbb ecx, ecx
neg ecx
mov edx, 0x2800
cmp edx, dword [ebp - 0x1e0]
sbb eax, eax
add eax, 1
and ecx, eax
je 0x100b3f50
push 0
lea ecx, [ebp - 0x1e0]
push ecx
mov edx, dword [ebp - 0x1e0]
push edx
lea eax, [ebp - 0x29e4]
push eax
mov ecx, dword [ebp - 0x2af4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2800
lea edx, [ebp - 0x29e4]
push edx
lea ecx, [ebp - 0x1dc]
call fcn.100b76c0
mov dword [ebp - 0x1e0], eax
jmp 0x100b3eed
lea ecx, [ebp - 0x1dc]
call fcn.100b6210
mov eax, dword [ebp - 0x2af4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2afa], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.100b2fc0
mov al, byte [ebp - 0x2afa]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100b4670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 8
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100b4730
push 0
push 0
call fcn.101813ef
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100b76c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a2c20
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0xc], 0
jne 0x100b771b
mov dword [ebp - 0x1c], str.connection_failed...
push 0x101f1634
lea ecx, [ebp - 0x1c]
push ecx
call fcn.101840c8
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x100b774d
mov dword [ebp - 0x20], str.response_failed...
push 0x101f1634
lea ecx, [ebp - 0x20]
push ecx
call fcn.101840c8
jmp 0x100b780b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100b8410
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac97b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.2345ExplorerUser_DataDefaulthistory
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100b84c4
push 0x101c657c
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp + 8]
jmp 0x100b8573
lea eax, [ebp - 0x220]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_2345
lea ecx, [ebp - 0x220]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x220]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100b8540
push 0x101c681c
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100b8573
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x224]
or ecx, 1
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100b8590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.2345ExplorerUser_DataDefaultBookmarks
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4

Function at 0x100b89c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acddb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x220], 1
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0x101c6008
push 0x101c6028
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100b8a7b
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefaultHistory
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100b8ab0
push 0x101c60d8
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp + 8]
jmp 0x100b8b5f
lea eax, [ebp - 0x224]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_360chrome
lea ecx, [ebp - 0x224]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100b8b2c
push 0x101c6104
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100b8b5f
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x22c]
or ecx, 1
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100b8b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 1
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0x101c6108
push 0x101c6128
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100b8c23
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefaultBookmarks
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x21c]
or edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4

Function at 0x100b8d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acddb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x220], 1
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0x101c62d4
push 0x101c62f8
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100b8e1b
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefaultFavicons
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x224]
push ecx
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.Favicons_360chrome
lea ecx, [ebp - 0x224]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100b8e97
push 0x101c62f4
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100b8eca
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100bad20
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acddb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x228], 0x206
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0x101c5b48
push 0x101c5b68
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100baddb
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefaulthistory
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100bae10
push 0x101c5c14
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp + 8]
jmp 0x100baebf
lea eax, [ebp - 0x224]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_360se
lea ecx, [ebp - 0x224]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100bae8c
push 0x101c5c38
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100baebf
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x22c]
or ecx, 1
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100baee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acddb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x228], 0x206
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0x101c5c3c
push 0x101c5c78
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100baf9b
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.appsdatausersdefault360sefav.db
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x224]
push ecx
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.360sefav.db
lea ecx, [ebp - 0x224]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100bb017
push 0x101c5d38
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100bb04a
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100bb070
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acd0b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x10], 1
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x220], 0x206
lea edx, [ebp - 0x21c]
test edx, edx
je 0x100bb1b7
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x101c5d3c
push 0x101c5d78
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100bb1b7
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x101c5df0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100bb1b7
lea eax, [ebp - 0x224]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.360setop.db
lea ecx, [ebp - 0x224]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100bb196
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000f500
mov byte [ebp - 0x225], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov al, byte [ebp - 0x225]
jmp 0x100bb1b9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4