joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100be420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.101845c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100be484
push str.SystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbweMicrosoftEdge.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x21c]
or edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret

Function at 0x100be4c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0x101c5600
push str.Software360360se6Chrome
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100be611
cmp dword [ebp - 0xc], 1
jne 0x100be611
xor eax, eax
mov word [ebp - 0x428], ax
push 0x40e
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x14], 0x410
mov dword [ebp - 0x42c], 1
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push 0x101c5654
push 0x101c5690
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x100be611
push str.....Smartpreheat.dll
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100be611
call fcn.10001140
mov dword [ebp - 0x440], eax
lea edx, [ebp - 0x428]
push edx
call fcn.1005bd90
add esp, 4
push eax
call fcn.1000b5e0
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x100be611
push 0x101c575c
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x100be611
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [ebp - 0x448]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret
Function at 0x100be620
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push str.smart_preheat
push str.Software360chromechrome
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100be771
cmp dword [ebp - 0xc], 1
jne 0x100be771
xor eax, eax
mov word [ebp - 0x428], ax
push 0x40e
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x14], 0x410
mov dword [ebp - 0x42c], 1
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push 0x101c57a0
push str.Software360chromeupdateclientstate27D39816_7A3D_406c_9ABC_97FB55674016
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x100be771
push str....._smart_preheat.dll
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100be771
call fcn.10001140
mov dword [ebp - 0x440], eax
lea edx, [ebp - 0x428]
push edx
call fcn.1005bd90
add esp, 4
push eax
call fcn.1000b5e0
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
je 0x100be771
push str.SmartPreheat
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
je 0x100be771
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [ebp - 0x448]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret

Function at 0x100c08e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x100c08e9
xor ecx, ecx
jne 0x100c08e9
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100c0922
call fcn.100014f0
jmp 0x100c0938
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x100c0936
push 0x26
call section..text
add esp, 4
jmp 0x100c0938
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100c2550
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x210]
push ecx
push str._s360Safe360SoftMgrLiteSMLUrlPageThumbnail_x__x.png
mov edx, dword [ebp + 8]
push edx
call fcn.10009fc0
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov ecx, dword [ebp + 8]
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x100c262b
mov dword [ebp - 0x218], 0
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x100c262d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100c8c00
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac97b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.liebaoUser_DataDefaulthistory
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100c8cb4
push 0x101c3204
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp + 8]
jmp 0x100c8d63
lea eax, [ebp - 0x220]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_liebao
lea ecx, [ebp - 0x220]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x220]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100c8d30
push 0x101c3228
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100c8d63
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x224]
or ecx, 1
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4

Function at 0x100c8d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.liebaoUser_DataDefaultBookmarks
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100c9090
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac97b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQBrowserUser_DataDefaulthistory
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100c9144
push 0x101c2ea8
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp + 8]
jmp 0x100c91f3
lea eax, [ebp - 0x220]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_qq
lea ecx, [ebp - 0x220]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x220]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100c91c0
push 0x101c2ec4
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100c91f3
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x224]
or ecx, 1
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4

Function at 0x100c9210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQBrowserUser_DataDefaultBookmarks
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100c92b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac97b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQBrowserUser_DataDefaultFavicons
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x220]
push ecx
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.Favicons_qq
lea ecx, [ebp - 0x220]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x220]
call fcn.1004f530
push eax
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100c93ab
push 0x101c2f9c
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov eax, dword [ebp - 0x224]
or eax, 1
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100c93de
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4

Function at 0x100c9400
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af4f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x100c9442
push 0
push 0x1c
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x100c9449
xor al, al
jmp 0x100c94d6
push str.TencentQQBrowserUser_DataDefaultQuick_Links
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100c94d4
lea eax, [ebp - 0x10]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str._tb_quick.db
lea ecx, [ebp - 0x10]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x10]
call fcn.1004f530
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100c94bc
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.1004f530
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.101815fa
add esp, 0xc
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100056e0
mov al, byte [ebp - 0x11]
jmp 0x100c94d6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c94f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af4f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
je 0x100c9532
push 0
push 0x1c
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x100c9539
xor al, al
jmp 0x100c95c6
push str.TencentQQBrowserUser_DataDefaultTop_Sites
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100c95c4
lea eax, [ebp - 0x10]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str._tb_top.db
lea ecx, [ebp - 0x10]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x10]
call fcn.1004f530
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100c95ac
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.1004f530
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.101815fa
add esp, 0xc
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100056e0
mov al, byte [ebp - 0x11]
jmp 0x100c95c6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ca0e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac97b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SogouExploreruhistory3.db
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100ca194
push 0x101c2c70
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov eax, dword [ebp + 8]
jmp 0x100ca243
lea eax, [ebp - 0x220]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_sougou
lea ecx, [ebp - 0x220]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x220]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100ca210
push 0x101c2c94
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100ca243
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x224]
or ecx, 1
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100cb010
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acddb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x220], 1
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0x101c2b10
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTheWorld6
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100cb0cb
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x101c2bac
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100cb100
push 0x101c2be0
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp + 8]
jmp 0x100cb1af
lea eax, [ebp - 0x224]
push eax
call fcn.100b81c0
mov ecx, eax
call fcn.100b81d0
mov dword [ebp - 4], 0
push str.history_theworld
lea ecx, [ebp - 0x224]
call fcn.10044dc0
push 0
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100cb17c
push 0x101c2c08
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
jmp 0x100cb1af
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x22c]
or ecx, 1
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x100cc250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x101c0cd4
lea ecx, [ebp + 8]
call fcn.1004f530
push eax
lea eax, [ebp - 4]
push eax
call fcn.1018188e
add esp, 0xc
test eax, eax
jne 0x100cc28b
cmp dword [ebp - 4], 0
jne 0x100cc29f
mov dword [ebp - 0x64], 1
lea ecx, [ebp + 8]
call fcn.100056e0
mov eax, dword [ebp - 0x64]
jmp 0x100cc305
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x60]
push edx
call fcn.10181b81
add esp, 0x10
push 0
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10181c28
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.10181b81
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.10181d24
add esp, 4
movzx edx, word [ebp - 0x18]
xor eax, eax
cmp edx, 0x14c
sete al
mov dword [ebp - 0x68], eax
lea ecx, [ebp + 8]
call fcn.100056e0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret

Function at 0x100d2ca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x104]
neg ecx
sbb ecx, ecx
and ecx, 9
add ecx, 0x10
mov dword [ebp - 0xc], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x104
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1000b350
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1000aa20
cmp dword [ebp - 4], 0
jne 0x100d2cf8
xor eax, eax
jmp 0x100d2d29
push 0
push 0x42000000
push 3
push 0
push 3
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100d2d26
xor eax, eax
jmp 0x100d2d29
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x100d3c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x104]
neg ecx
sbb ecx, ecx
and ecx, 0xb
add ecx, 0xb
mov dword [ebp - 0xc], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x104
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1000b350
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1000aa20
cmp dword [ebp - 4], 0
jne 0x100d3cb8
xor eax, eax
jmp 0x100d3ce9
push 0
push 0x42000000
push 3
push 0
push 3
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100d3ce6
xor eax, eax
jmp 0x100d3ce9
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret