joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008358e
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 4
mov eax, 0x10140d65
call fcn.101018b2
call fcn.100db982
mov ebx, eax
mov eax, dword [0x1019a028]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push str.B8E20CD7_BAC2_4820_9AA6_1060B3AF25E2
mov edi, str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push edi
lea eax, [ebp - 0x10]
push 0x10155274
push eax
call fcn.100020c6
add esp, 0x10
push dword [ebp - 0x10]
mov esi, SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.DefaultScope
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp ebx, 1
jne 0x100835ef
call fcn.100db93f
lea ecx, [ebp - 0x10]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret

Function at 0x100848e7
Capabilities:
Find taskbar

Disassembly:
push 0xffffffffffffffff
push 0x10140e39
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1019c8c8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esp + 0x20], edi
mov dword [esi], 0x1015f11c
mov dword [esi + 0x9c], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0x98], esi
mov dword [esi + 0x24], edi
call fcn.1005c1e3
test eax, eax
je 0x10084975
push 0x12c
push 0x1015b26c
call fcn.100daab3
pop ecx
pop ecx
mov dword [esi + 0x24], eax
call fcn.1005b4ae
mov ebx, dword [sym.imp.USER32.dll_SetRect]
push 0x19
push 0xa
push edi
push edi
lea eax, [esi + 0x28]
push eax
call ebx
push 0x19
push 0x80
push edi
push 0xb
lea eax, [esi + 0x38]
push eax
call ebx
push 0x19
push 0xcf
push edi
push 0x8c
lea eax, [esi + 0x48]
push eax
call ebx
push 0x6e
push 1
push 0x1a
push edi
lea eax, [esi + 0x58]
push eax
call ebx
push 0x72
mov ebp, 0xcc
push ebp
push 0x1a
push 2
lea eax, [esi + 0x68]
push eax
call ebx
push 0x72
push 0xcf
push 0x1a
push 0xce
lea eax, [esi + 0x78]
push eax
call ebx
push 0x75
push ebp
push 0x74
push edi
lea eax, [esi + 0x88]
push eax
call ebx
mov ebx, dword [sym.imp.GDI32.dll_CreateFontW]
mov ebp, 0x1015f148
push ebp
push edi
push edi
push edi
push edi
push 1
push edi
push edi
push edi
push 0x2bc
push edi
push edi
push edi
push 0xfffffffffffffff3
call ebx
push ebp
push edi
push edi
push edi
push edi
push 1
push edi
push edi
push edi
push 0x190
push edi
mov dword [esi + 0xa4], eax
push edi
push edi
push 0xfffffffffffffff3
call ebx
push ebp
push edi
push edi
push edi
push edi
push 1
push edi
push 1
push edi
push 0x190
push edi
push edi
push edi
push 0xfffffffffffffff3
mov dword [esi + 0xa0], eax
call ebx
push edi
lea ebx, [esi + 0xac]
push str.Shell_TrayWnd
mov dword [esi + 0xa8], eax
mov dword [ebx], edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebx], eax
call fcn.100dc995
mov dword [esi + 0xb8], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10084af0
Capabilities:
Initialize iwebbrowser2
Log keystrokes

Disassembly:
push 0x64
mov eax, 0x10140e8c
call fcn.101018b2
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 0x1016f3c8
push 0x15
push ebx
push 0x1016f388
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x10084c3a
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x10084c3a
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x94]
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10084bc5
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
call esi
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call edi
push dword [ebp - 0x1c]
call esi
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call edi
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov word [ebp - 0x30], bx
call fcn.1000e222
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x70]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x50]
push eax
call esi
lea eax, [ebp - 0x40]
push eax
call esi
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x50]
push edx
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0x70]
push edx
lea edx, [ebp - 0x30]
push edx
push eax
mov byte [ebp - 4], 6
call dword [ecx + 0xd0]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x40]
push eax
call esi
lea eax, [ebp - 0x50]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x70]
push eax
call esi
lea eax, [ebp - 0x30]
push eax
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x10084c50
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp + 8]
call fcn.100015d9
call fcn.1010198a
ret 4

Function at 0x10085553
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
push dword [esi + 4]
mov ecx, 0x1019ee80
push 0
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x10085589
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10085589
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x1008a959
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x1019c8c8]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 4
mov eax, 0x10141834
call fcn.101018b2
push 0
push 2
mov edi, ecx
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x1008a9c2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.101018a3
add ebp, 0x230
leave
ret
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000587e
and dword [ebp - 4], 0
test ebx, ebx
je 0x1008aa22
lea ebx, [edi + 0x3c]
lea ecx, [ebp - 0x10]
call fcn.10001ada
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.1008a809
cmp eax, 0xffffffff
jne 0x1008aa2d
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
mov edi, eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.10001cbf
test edi, edi
jne 0x1008a9e5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x1008aa30
xor esi, esi
inc esi
lea ecx, [ebp - 0x10]
call fcn.100015d9
mov eax, esi
jmp 0x1008a99f
Function at 0x1008af71
Capabilities:
Check mutex on windows

Disassembly:
push 8
mov eax, 0x10141924
call fcn.101018b2
mov esi, ecx
cmp dword [ebp + 0xc], 0x4d7e
jne 0x1008b0bf
mov edi, 0x1019e718
mov ecx, edi
call fcn.1003a3eb
test eax, eax
je 0x1008b0bf
mov ecx, edi
call fcn.1003a620
test eax, eax
jne 0x1008b0bf
push str.F4BA5F21_544E_4949_A937_1DCCA2D06C3B
lea ecx, [ebp + 0xc]
call fcn.1000587e
push dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov ecx, 0x1019ee80
mov dword [ebp - 4], ebx
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1008b0b7
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1008b0ae
push ebx
call fcn.101029ff
pop ecx
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.1003a5d1
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, edi
call fcn.1003a43a
cmp dword [ebp - 0x14], eax
jbe 0x1008b0a5
mov ecx, esi
call fcn.1008aa3f
test eax, eax
je 0x1008b0a5
cmp dword [esi + 0x48], ebx
jne 0x1008b055
push 0xbc
call fcn.10102177
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x1008b04d
call fcn.100848e7
jmp 0x1008b04f
xor eax, eax
mov byte [ebp - 4], bl
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x48]
cmp eax, ebx
je 0x1008b096
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1008b08e
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push 0x80088
push SysReAllocString
push ebx
push ecx
mov dword [eax], ebx
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], ebx
mov ecx, dword [esi + 0x48]
push ebx
call fcn.1008aeb3
mov ecx, dword [esi + 0x48]
call fcn.10084899
push ebx
call fcn.101029ff
pop ecx
push eax
mov ecx, edi
call fcn.1003a5fb
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0xc]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret 0x10
Function at 0x1008b18d
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xc
mov eax, 0x1014195d
call fcn.101018b2
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], 0x1015330c
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], eax
lea ebx, [esi + 0x3c]
mov dword [esi], fcn.1008a8e0
mov dword [esi + 4], 0x1015f9cc
mov dword [esi + 8], 0x1015f9bc
mov dword [esi + 0x38], edi
mov dword [ebp - 4], edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
push 0x1019f32c
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x2c], 0x1770
cmp dword [0x1019f328], edi
jne 0x1008b23a
push 0x1019f328
push 4
push esi
push 0x1008b0c9
push edi
push edi
call fcn.1010370a
add esp, 0x18
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x1008b23a
push 0x4000
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1019f32c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x1019e718
call fcn.1003a4de
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x1019e718
mov dword [esi + 0x48], edi
call fcn.100368ce
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.10001ada
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_CharLowerW]
push ebx
push 0x7c
push dword [ebp - 0x10]
call fcn.100e1c7b
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.100015d9
mov eax, esi
call fcn.1010198a
ret
Function at 0x10093500
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, ecx
push dword [edi + 0x114]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009353d
mov ecx, dword [esp + 8]
push esi
mov esi, 0x100
push esi
call fcn.10001a82
push esi
push eax
push dword [edi + 0x114]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
call fcn.10001c5b
pop esi
pop edi
ret 4

Function at 0x10093d0d
Capabilities:
Get graphical window text

Disassembly:
push 0x28
mov eax, 0x10142981
call fcn.101018b2
mov ebx, ecx
lea esi, [ebx + 0x154]
push esi
lea ecx, [ebp - 0x18]
call fcn.1000584b
mov eax, dword [0x1019a028]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
push 0x401
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001a82
push 0x400
push eax
push dword [ebx + 0x114]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.10001c5b
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.10005459
push dword [ebp - 0x18]
push dword [esi]
call fcn.10002de4
test eax, eax
pop ecx
pop ecx
je 0x10093e86
mov esi, 0x101577fc
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
lea esi, [ebx + 0x28]
push eax
mov ecx, esi
call fcn.100332f0
mov eax, dword [esi + 4]
push esi
push eax
lea ecx, [ebp - 0x24]
call fcn.1003260d
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x24]
call fcn.10031e5d
test al, al
jne 0x10093e72
lea ecx, [ebp - 0x34]
call fcn.10031f1a
mov edi, dword [eax + 0x10]
test edi, edi
je 0x10093e72
mov eax, dword [edi + 4]
push edi
push eax
lea ecx, [ebp - 0x24]
call fcn.10032631
mov eax, dword [edi + 8]
push edi
push eax
jmp 0x10093e56
lea ecx, [ebp - 0x24]
call fcn.10031e88
cmp dword [eax], 0
je 0x10093e4a
lea ecx, [ebp - 0x24]
call fcn.10031e88
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.1003257c
mov esi, dword [ebp - 0x14]
test esi, esi
mov byte [ebp - 4], 2
je 0x10093e3c
push dword [ebx + 0x154]
lea ecx, [ebp - 0x1c]
call fcn.10003abd
push dword [ebx + 0x10]
mov eax, dword [eax]
mov ecx, dword [esi]
push eax
push esi
mov byte [ebp - 4], 3
call dword [ecx + 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x14]
test esi, esi
mov byte [ebp - 4], 1
je 0x10093e4a
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [ebp - 0x24]
call fcn.10031ea9
push edi
push dword [edi + 8]
lea ecx, [ebp - 0x34]
call fcn.10032631
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x34]
call fcn.10031ecd
test al, al
je 0x10093de8
lea esi, [ebx + 0x14c]
cmp dword [esi], 0
je 0x10093e86
mov eax, dword [ebx]
push ebx
call dword [eax + 0x54]
and dword [esi], 0
mov eax, dword [ebp + 0x14]
and dword [eax], 0
lea ecx, [ebp - 0x10]
call fcn.100015d9
lea ecx, [ebp - 0x18]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret 0x10
Function at 0x10093ff3
Capabilities:
Delete registry key

Disassembly:
push 0x20
mov eax, 0x101429d7
call fcn.101018b2
mov esi, ecx
mov ebx, str.SoftwareBaiduBaiduToolbarHistory
mov edi, 0x1019ee20
push ebx
mov ecx, edi
call fcn.100101c4
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, 0x1019e718
call fcn.100387ca
mov ecx, dword [esi + 0x164]
cmp ecx, eax
mov dword [ebp - 0x10], ecx
jbe 0x10094034
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov ecx, edi
push str.count
push ebx
call fcn.100101c4
push eax
call fcn.100dfc56
mov eax, dword [esi + 0x160]
mov eax, dword [eax]
and dword [ebp - 0x14], 0
add esi, 0x15c
add esp, 0x10
push esi
push eax
lea ecx, [ebp - 0x24]
call fcn.10092acd
mov eax, dword [esi + 4]
push esi
push eax
jmp 0x10094116
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x10]
jae 0x10094132
mov eax, dword [0x1019a028]
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
push ecx
lea eax, [ebp - 0x1c]
push str.kw_d
push eax
mov byte [ebp - 4], 1
call fcn.100020c6
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push str.type_d
push eax
call fcn.100020c6
add esp, 0x18
lea ecx, [ebp - 0x24]
call fcn.10092af1
push dword [eax]
mov ecx, edi
push dword [ebp - 0x1c]
push ebx
call fcn.100101c4
push eax
call fcn.100dfc9c
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.10092af1
push dword [eax + 4]
mov ecx, edi
push dword [ebp - 0x18]
push ebx
call fcn.100101c4
push eax
call fcn.100dfc9c
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.100015d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100015d9
lea ecx, [ebp - 0x24]
call fcn.100924f8
push esi
push dword [esi + 4]
lea ecx, [ebp - 0x2c]
call fcn.10092acd
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x24]
call fcn.10092520
test al, al
je 0x10094073
call fcn.1010198a
ret
Function at 0x100a5605
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x101446bd
call fcn.101018b2
mov esi, ecx
mov ecx, 0x1019e6e0
call fcn.100ad6c4
test eax, eax
je 0x100a5649
mov ecx, dword [ebp + 0xc]
cmp cx, 0x26
je 0x100a5654
cmp cx, 0x28
je 0x100a5654
cmp cx, 0x22
je 0x100a5654
cmp cx, 0x21
je 0x100a5654
cmp cx, 0x2e
jne 0x100a5649
mov ecx, esi
call fcn.100a4c3c
mov eax, dword [ebp + 0x14]
and dword [eax], 0
jmp 0x100a573c
mov eax, dword [esi + 0x34]
xor edi, edi
cmp eax, edi
je 0x100a572c
push dword [ebp + 0x10]
push ecx
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1019a028]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
mov ecx, dword [esi + 0x34]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], edi
call fcn.10053040
test eax, eax
je 0x100a56f6
cmp dword [esi + 0x48], edi
je 0x100a56c1
lea ebx, [esi + 0x4c]
push 0x401
mov ecx, ebx
mov dword [esi + 0x48], edi
call fcn.10001a82
push 0x400
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.10001c5b
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x100a56d9
cmp dword [eax], 1
jne 0x100a56d9
add eax, 8
push eax
lea ecx, [ebp - 0x18]
call fcn.10005459
push dword [ebp - 0x18]
add esi, 0xc
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.100172f7
mov ecx, esi
jmp 0x100a5711
push dword [esi + 0x4c]
lea ebx, [esi + 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.100172f7
mov ecx, ebx
push edi
push edi
push 0xffffffffffffffff
call fcn.100172f7
lea ecx, [ebp - 0x14]
call fcn.100015d9
lea ecx, [ebp - 0x18]
call fcn.100015d9
jmp 0x100a5733
mov ecx, esi
call fcn.100a4c3c
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
xor eax, eax
call fcn.1010198a
ret 0x10
Function at 0x100a63f4
Capabilities:
Terminate thread

Disassembly:
mov dword [ecx], 0x10161064
mov dword [ecx + 4], 0x1016105c
mov dword [ecx + 8], 0x1016104c
jmp fcn.100a59bb

Function at 0x100a8152
Capabilities:
Create thread
Get graphical window text
Resume thread

Disassembly:
push 0
mov eax, 0x10144c7f
call fcn.101018b2
mov esi, ecx
mov eax, dword [esi + 0x54]
xor edi, edi
cmp eax, edi
je 0x100a8249
cmp eax, dword [ebp + 0xc]
jne 0x100a8249
mov eax, dword [ebp + 0x14]
xor ebx, ebx
inc ebx
mov dword [eax], ebx
push dword [esi + 0x50]
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x54], edi
mov eax, dword [0x1019a028]
mov dword [ebp + 0x14], eax
push 0x801
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], edi
call fcn.10001a82
push 0x800
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.10001c5b
lea ecx, [ebp + 0x14]
call fcn.10025598
lea ecx, [ebp + 0x14]
call fcn.10025545
mov eax, dword [ebp + 0x14]
cmp dword [eax - 8], edi
jne 0x100a81f0
mov ecx, dword [esi + 0x34]
cmp ecx, edi
je 0x100a81e6
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov dword [esi + 0x34], edi
lea ecx, [ebp + 0x14]
call fcn.100015d9
jmp 0x100a824e
mov eax, dword [esi + 0x58]
cmp eax, edi
mov dword [esi + 0x30], ebx
je 0x100a8204
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x58], edi
mov ecx, dword [esi + 0x38]
lea eax, [ebp + 0x14]
push eax
add ecx, 8
call fcn.10005459
push edi
push 4
push dword [esi + 0x38]
push 0x100a7f5b
push edi
push edi
call fcn.1010370a
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x58], eax
je 0x100a8244
push 0x4000
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x2c], edi
jmp 0x100a81e6
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
call fcn.1010198a
ret 0x10
Function at 0x100a8812
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xfa0]
mov eax, 0x1020
call fcn.10102790
mov eax, dword [0x1019c8c8]
xor eax, ebp
mov dword [ebp + 0xf9c], eax
mov eax, dword [ebp + 0xfa8]
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xfac]
push ebx
push str.toolbar_get
mov dword [ebp - 0x74], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x80], edi
jne 0x100a8863
xor eax, eax
jmp 0x100a88e1
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [ebp - 0x68]
push eax
push 2
push edi
mov dword [ebp - 0x68], 0xfa0
call esi
test eax, eax
je 0x100a88d7
push 4
lea eax, [ebp - 0x68]
push eax
push 5
push edi
call esi
test eax, eax
je 0x100a88d7
push 4
lea eax, [ebp - 0x68]
push eax
push 5
push edi
call esi
test eax, eax
je 0x100a88d7
push 4
lea eax, [ebp - 0x68]
push eax
push 6
push edi
mov dword [ebp - 0x68], ebx
call esi
test eax, eax
je 0x100a88d7
push 4
lea eax, [ebp - 0x68]
push eax
push 6
push edi
call esi
test eax, eax
je 0x100a88d7
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, ebx
mov dword [ebp - 0x78], eax
jne 0x100a88f8
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp + 0xf9c]
pop edi
xor ecx, ebp
pop ebx
call fcn.101018a3
add ebp, 0xfa0
leave
ret
push 0xfff
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.101027c0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x74], eax
jne 0x100a8946
push dword [ebp - 0x78]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
mov eax, ebx
jmp 0x100a88e0
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x70], ebx
mov edi, 0x1000
jmp 0x100a897f
cmp dword [ebp - 0x6c], ebx
je 0x100a8993
push ebx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100a899a
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x6c]
jne 0x100a899a
lea eax, [ebp - 0x6c]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x100a8956
jmp 0x100a899a
mov dword [ebp - 0x70], 1
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x70]
mov edi, dword [ebp - 0x80]
jmp 0x100a8934