joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f4f0
Capabilities:
Capture webcam image

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0xeac4
mov dword [esp + 4], ecx
jne 0x1002f50c
mov eax, 1
pop edi
pop ecx
ret 0x18
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push esi
push 0
push 0
lea esi, [ecx + 4]
push 0x418
push eax
call ebx
cmp edi, 0xeac4
mov ebp, eax
jbe 0x1002f556
cmp edi, 0xebf0
jae 0x1002f556
mov ecx, dword [esi]
push 0
push edi
push 0x419
push ecx
call ebx
test eax, eax
jle 0x1002f556
cmp eax, ebp
jge 0x1002f556
push eax
mov ecx, esi
call fcn.1000f010
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push edi
push ebp
call fcn.1002e0e0
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret 0x18
Function at 0x1002fab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007c22d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10007c30
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov dword [esp + 0x18], 0
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
mov byte [esp + 0x1c], 1
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
mov byte [esp + 0x20], 2
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
sub eax, 0x10
push eax
mov byte [esp + 0x24], 3
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
mov byte [esp + 0x28], 4
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
sub eax, 0x10
push eax
mov byte [esp + 0x2c], 5
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
sub eax, 0x10
push eax
mov byte [esp + 0x30], 6
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
sub eax, 0x10
push eax
mov byte [esp + 0x34], 7
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
sub eax, 0x10
push eax
mov byte [esp + 0x38], 8
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x30], eax
mov byte [esp + 0x38], 9
mov eax, dword [edi + 0x34]
sub eax, 0x10
push eax
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
sub eax, 0x10
push eax
mov byte [esp + 0x40], 0xa
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
sub eax, 0x10
push eax
mov byte [esp + 0x44], 0xb
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
sub eax, 0x10
push eax
mov byte [esp + 0x48], 0xc
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
sub eax, 0x10
push eax
mov byte [esp + 0x4c], 0xd
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
sub eax, 0x10
push eax
mov byte [esp + 0x50], 0xe
call fcn.10002a40
add eax, 0x10
mov dword [esi + 0x48], eax
mov edi, dword [edi + 0x4c]
sub edi, 0x10
push edi
mov byte [esp + 0x54], 0xf
call fcn.10002a40
mov ecx, dword [esp + 0x4c]
add esp, 0x40
add eax, 0x10
mov dword [esi + 0x4c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10030250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x10096d68]
sub esp, 0x64
push esi
mov esi, ecx
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx - 0xc]
test edx, edx
je 0x10030474
mov edx, dword [eax + 0x38]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x10030474
mov ecx, dword [esi + 4]
push ebx
push ebp
push edi
lea eax, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x418
push edx
call edi
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x41d
push ecx
call edi
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebp, 1
sub ebx, ecx
cmp eax, ebp
jle 0x1003034b
nop
mov ecx, dword [esi + 4]
xor edx, edx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], edx
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x68], edx
push ebp
mov dword [esp + 0x70], edx
push 0x441
mov dword [esp + 0x78], edx
push ecx
mov dword [esp + 0x64], 0x20
mov dword [esp + 0x68], 0x80000024
mov dword [esp + 0x80], edx
call edi
test eax, eax
je 0x10030342
test byte [esp + 0x64], 8
jne 0x10030342
cmp dword [esp + 0x5c], 0xea6c
je 0x10030342
mov eax, dword [esi + 4]
lea edx, [esp + 0x24]
push edx
push ebp
push 0x41d
push eax
call edi
test eax, eax
je 0x1003034b
mov ecx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x24]
add ebx, ecx
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jl 0x100302d0
mov edx, dword [esp + 0x3c]
mov eax, dword [esi + 4]
push 0
push 0xea6c
sub edx, ebx
cmp edx, 0x64
push 0x419
push eax
jge 0x100303a0
call edi
cmp eax, 0xffffffff
je 0x1003037b
mov ecx, dword [esi + 4]
push 0
push eax
push 0x416
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0
push 0x418
push edx
call edi
mov ecx, esi
mov dword [esi + 0x68], 0
call fcn.1002a680
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x64
ret
call edi
cmp eax, 0xffffffff
jne 0x100303cd
mov ecx, dword [esi + 4]
push 0
push 0
push 0x418
push ecx
call edi
push 0
push 0x64
push 0xfffffffffffffffe
push 0
push 0
push 0xea6c
push eax
mov ecx, esi
call fcn.1002e0e0
mov edx, dword [esi + 4]
push 0
push 0
push 0x418
push edx
call edi
mov eax, dword [esp + 0x3c]
sub eax, ebx
mov dword [esi + 0x68], eax
mov eax, dword [0x10096d68]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx - 0xc]
test edx, edx
je 0x1003046a
mov edx, dword [eax + 0x38]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x1003046a
mov cx, word [esi + 0x68]
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
lea edx, [esp + 0x54]
push edx
mov dword [esp + 0x70], eax
push 0xea6c
mov dword [esp + 0x78], eax
mov eax, dword [esi + 4]
push 0x442
sub cx, 5
push eax
mov dword [esp + 0x64], 0x20
mov dword [esp + 0x68], 0x40
mov word [esp + 0x76], cx
call edi
mov edx, dword [esi + 4]
lea ecx, [esp + 0x44]
push ecx
push 0xea6c
push 0x41d
push edx
call edi
test eax, eax
je 0x1003046a
mov eax, dword [esp + 0x44]
mov dword [esi + 0x54], eax
mov ecx, esi
call fcn.1002a680
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x64
ret
Function at 0x100352d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x1007c9e8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esi + 0x354]
mov ecx, ebx
mov eax, dword [ecx + 4]
cmp byte [eax + 0x9d], 0
push edi
mov edi, dword [esp + 0x30]
mov edx, dword [edi + 0xc]
jne 0x10035327
lea esp, [esp]
cmp dword [eax + 0xc], edx
jge 0x1003531a
mov eax, dword [eax + 8]
jmp 0x1003531e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0x9d], 0
je 0x10035310
mov eax, dword [esi + 0x354]
cmp ecx, eax
mov dword [esp + 0x10], ecx
je 0x10035340
cmp edx, dword [ecx + 0xc]
jl 0x10035340
lea eax, [esp + 0x10]
jmp 0x10035348
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
cmp dword [eax], ebx
je 0x1003536c
mov dword [esi + 0x1a8], edx
mov ecx, dword [0x10096d74]
mov eax, dword [0x10096d70]
cmp eax, ecx
je 0x1003536c
cmp dword [eax], edx
je 0x10035383
add eax, 4
cmp eax, ecx
jne 0x10035361
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
cmp eax, ecx
je 0x1003536c
mov eax, dword [esi + 4]
push 1
add edi, 0x14
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [esi + 0x1a8]
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], ecx
lea ebx, [esi + 0x1a4]
push edx
mov ecx, ebx
call fcn.10028db0
mov ebp, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x350]
mov dword [esp + 0x28], 0
call fcn.10031ed0
add eax, 4
mov eax, dword [eax]
push eax
mov ecx, 0x10098870
call fcn.10042400
mov ecx, dword [ebp]
neg eax
sbb eax, eax
inc eax
push eax
push 0xafb4
push ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
lea edx, [esp + 0x1c]
push edx
mov ecx, ebx
call fcn.10028db0
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x30]
mov eax, dword [eax]
push 0
push ecx
mov ecx, dword [edx + 0x18]
mov edx, dword [edi]
push 0
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x100373e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1007cc1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov eax, esp
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esp
mov dword [eax], ebx
call fcn.1002abd0
push fcn.10040c60
push fcn.10040ac0
push 0xa
push 0x8c
lea eax, [esi + 0x64]
mov dword [esi], 0x10084094
push eax
mov dword [esp + 0x30], ebx
mov dword [esi + 0x60], ebx
call fcn.100697e1
mov dword [esi + 0x5e0], ebx
mov dword [esi + 0x5e4], ebx
mov dword [esi + 0x5e8], ebx
lea edi, [esi + 0x5ec]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.10029be0
mov ecx, dword [esp + 0x24]
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x5f8], ebx
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4
Function at 0x1003a6b0
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
test eax, eax
push ebx
mov ebx, ecx
push ebp
mov dword [esp + 8], ebx
je 0x1003a6c4
mov byte [eax], 0
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x1003a6d4
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
test eax, eax
jne 0x1003a74c
push esi
push edi
push 0x201
mov esi, 0x200
call fcn.10067994
add esp, 4
mov edi, eax
mov eax, dword [ebx + 4]
push eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov ebx, eax
lea ecx, [ebx + 2]
cmp ecx, esi
jb 0x1003a738
push edi
add esi, 0x200
call fcn.1006917d
lea edx, [esi + 1]
push edx
call fcn.10067994
mov edi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
add esp, 8
push ecx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov ebx, eax
lea edx, [ebx + 2]
cmp edx, esi
jae 0x1003a704
push edi
call fcn.1006917d
add esp, 4
pop edi
pop esi
pop ebp
lea eax, [ebx + 2]
pop ebx
pop ecx
ret 0xc
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x1003a770
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push ebp
mov ebp, ecx
jne 0x1003a7f2
push ebx
push esi
push edi
push 0x201
mov esi, 0x200
call fcn.10067994
add esp, 4
mov edi, eax
mov eax, dword [ebp + 4]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ebx, eax
lea ecx, [ebx + 2]
cmp ecx, esi
jb 0x1003a7df
jmp 0x1003a7b0
push edi
add esi, 0x200
call fcn.1006917d
lea edx, [esi + 1]
push edx
call fcn.10067994
add esp, 8
mov edi, eax
mov eax, dword [ebp + 4]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ebx, eax
lea ecx, [ebx + 2]
cmp ecx, esi
jae 0x1003a7b0
push edi
call fcn.1006917d
add esp, 4
pop edi
pop esi
lea eax, [ebx + 2]
pop ebx
pop ebp
ret 8
mov edx, dword [ebp + 4]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
pop ebp
ret 8
Function at 0x1003a850
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [esp + 8]
test eax, eax
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
je 0x1003a909
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1003a909
push 0x201
mov esi, 0x200
call fcn.10067994
mov edi, eax
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
jne 0x1003a894
mov eax, 0x10081bf2
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
push 0x200
push edi
push eax
push ebp
push edx
call ebx
inc eax
cmp eax, 0x200
jb 0x1003a8ff
jmp 0x1003a8c0
push edi
add esi, 0x200
call fcn.1006917d
lea eax, [esi + 1]
push eax
call fcn.10067994
mov edi, eax
mov eax, dword [esp + 0x28]
add esp, 8
test eax, eax
jne 0x1003a8e7
mov eax, 0x10081bf2
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
push edx
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
call ebx
inc eax
cmp eax, esi
jae 0x1003a8c0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x1003a926
push 1
call fcn.10067994
add esp, 4
pop edi
pop esi
pop ebp
mov byte [eax], 0
pop ebx
pop ecx
ret 0xc
mov eax, edi
lea edx, [eax + 1]
jmp 0x1003a930
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003a930
sub eax, edx
inc eax
push eax
call fcn.10067994
mov esi, eax
add esp, 4
mov ecx, edi
sub esi, edi
lea esp, [esp]
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x1003a950
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x1003f270
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARESohu_RDDownload
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1003f2ce
mov ecx, dword [esp]
push 0x100846c0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4
mov eax, dword [esp]
push 4
lea edx, [esp + 8]
push edx
push 4
push 0
push 0x100846c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4

Function at 0x1003f300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWARESohu_RDDownload
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xff
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x100846c0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10040650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x1007d71b
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x10]
test eax, eax
push esi
push edi
jne 0x10040807
movzx eax, word [esp + 0x2c]
mov ecx, dword [0x10098990]
push str.PATTERN
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10040807
mov edx, dword [0x10098990]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100406b3
sub eax, edx
inc eax
push eax
call fcn.10067994
mov ebp, eax
mov edx, ebp
add esp, 4
mov dword [esp + 0x14], ebp
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100406d2
mov ax, word [0x10084708]
mov cl, byte [0x1008470a]
lea edx, [esp + 0x2c]
push edx
push ebp
mov word [esp + 0x34], ax
mov byte [esp + 0x36], cl
call fcn.1006b45a
mov edi, eax
add esp, 8
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x100407ed
push 0x4e8
call fcn.10067970
add esp, 4
mov dword [esp + 0x10], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x24], esi
je 0x10040737
mov ecx, eax
call fcn.100663f0
mov esi, eax
push 0
sub esp, 0x1c
mov ecx, esp
mov eax, edi
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], esp
mov byte [ecx + 4], 0
lea ebp, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10040765
sub eax, ebp
push eax
push edi
call fcn.10006830
mov ecx, esi
call fcn.10066570
test al, al
je 0x100407c4
mov edx, dword [ebx + 4]
test edx, edx
jne 0x1004078b
xor ecx, ecx
jmp 0x10040793
mov ecx, dword [ebx + 8]
sub ecx, edx
sar ecx, 2
test edx, edx
je 0x100407b0
mov eax, dword [ebx + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x100407b0
mov eax, dword [ebx + 8]
mov dword [eax], esi
add eax, 4
mov dword [ebx + 8], eax
jmp 0x100407d0
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
mov ecx, ebx
call fcn.10040450
jmp 0x100407d0
test esi, esi
je 0x100407d0
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.1006b45a
mov edi, eax
add esp, 8
test edi, edi
jne 0x10040713
mov ebp, dword [esp + 0x14]
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
mov dword [ebx + 0x10], 1
call fcn.10069196
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 4
Function at 0x10040e60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1007da08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 8], edi
mov eax, dword [0x10098a04]
mov ecx, 0x10098a04
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esi + 4]
push ecx
push edx
lea eax, [esp + 0x10]
push str.DownloadToolbarPlugin_s_s
push eax
mov dword [esp + 0x24], edi
call fcn.10004e20
mov esi, dword [esp + 0x18]
add esi, 0xfffffff0
push esi
call fcn.10002a40
mov edi, dword [esp + 0x30]
add eax, 0x10
add esp, 0x14
mov dword [edi], eax
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10040ee8
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x100422d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1007da08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x70]
mov ecx, dword [eax - 0xc]
push edi
xor edi, edi
cmp ecx, edi
jne 0x10042309
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 8]
push str.alert
push ecx
call fcn.1001f310
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x70]
push 0x1388
push edi
push 1
push edx
push eax
mov dword [esp + 0x30], edi
call fcn.10021df0
add esp, 0x1c
test eax, eax
je 0x10042347
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.100421e0
mov edi, eax
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10042378
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10048f40
Capabilities:
Set global application hook

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push edi
push 0x10096e88
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x10096ee0
call fcn.10046880
mov eax, dword [esp + 0x18]
cmp eax, dword [0x10096ee8]
jne 0x10048fbe
push ebx
call esi
push eax
push 0
push 0x10046d70
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov edi, eax
mov ebx, 1
call esi
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, 0x10096ee0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
call fcn.10048990
pop ebx
jmp 0x10048fc1
inc dword [eax + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x10096e88
call edi
push 0x10096ec8
call ebp
mov esi, dword [esp + 0x28]
mov ecx, dword [esi]
lea edx, [esp + 0x20]
push edx
push esi
call dword [ecx + 0x94]
test eax, eax
jne 0x1004900b
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, 0x10096ea0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
call fcn.10048c00
push 0x10096ec8
call edi
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x10049f80
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x1007e280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x10098a04]
mov ecx, 0x10098a04
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp], eax
push 0
push 0x207
mov dword [esp + 0x1c], 0
call fcn.10001450
add esp, 8
test eax, eax
je 0x10049fd5
push 0x207
push eax
lea ecx, [esp + 8]
call fcn.10004800
mov edx, dword [0x10098a04]
push ebx
push esi
push edi
mov ecx, 0x10098a04
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
lea ebx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.100497e0
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
add esp, 4
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor ebx, ebx
cmp eax, ebx
je 0x1004a07a
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004a044
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004a066
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
mov byte [esp + 0x20], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1004a0b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004a0d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret