joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017cf
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x549bac
push str._s.util
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d5add
lea eax, [ebp - 0x20c]
push eax
call fcn.00436f6b
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.0043eb15
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x40183e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40183e
xor eax, eax
inc eax
jmp 0x401840
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5a7d
leave
ret

Function at 0x401d0f
Capabilities:
Create thread
Resume thread
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00401c95
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00421fa3
xor ebp, ebp
mov esi, eax
inc ebp
cmp dword [esi + 0x14], edi
jne 0x401d7a
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push ebp
push edi
call ebx
push edi
push edi
push ebp
push edi
mov dword [esi], eax
call ebx
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x42208e
push edi
push edi
call fcn.004d67c7
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, edi
je 0x401d77
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x14], ebp
call fcn.0040235b
push eax
push dword [esp + 0x1c]
call fcn.0042253f
mov ecx, 0x549db4
mov esi, eax
call fcn.00422565
push edi
push 0x543d10
push 0x546fac
call sub.gdiplus.dll_GdiplusStartup
call fcn.00401e66
call fcn.004029e7
call fcn.0044d384
mov esi, eax
cmp esi, edi
je 0x401dca
mov eax, dword [esp + 0x18]
push esi
call fcn.00401ea9
push esi
call fcn.0044d89c
push 4
lea eax, [esp + 0x14]
push eax
push 4
push str.firstrun
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [esp + 0x28], edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.0042253f
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401e26
push edi
push edi
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x7d0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x24]
call ebx
mov eax, dword [0x549b54]
cmp eax, edi
je 0x401e38
push eax
call ebx
mov dword [0x549b54], edi
mov eax, dword [0x549b60]
cmp eax, edi
je 0x401e56
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x549b60]
call ebx
mov dword [0x549b60], edi
call dword [sym.imp.ole32.dll_OleUninitialize]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x40201c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [0x549ba8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x549ba4], eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x401efd
push esi
push esi
mov dword [ebp - 4], esi
call fcn.004d67c7
add esp, 0x18
cmp eax, esi
pop esi
je 0x40205c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
call fcn.004020a9
leave
ret 4

Function at 0x4021af
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3f4]
sub esp, 0x474
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x3f0], eax
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x549b60], eax
cmp eax, esi
je 0x4022c8
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x1e]
push esi
push eax
call fcn.004dbcc0
xor eax, eax
push edi
mov word [ebp + 0x1e8], ax
lea eax, [ebp + 0x1ea]
push esi
push eax
call fcn.004dbcc0
add esp, 0x18
mov edi, 0x103
push edi
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.__procid
push dword [0x549b60]
lea eax, [ebp - 0x20]
push str.__dword
push 8
push str.__class
push eax
push str.__s___s_d__s_d__s_d
lea eax, [ebp + 0x1e8]
push edi
push eax
call fcn.004d5add
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.004dbcc0
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
add esp, 0x34
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp + 0x1e8]
push eax
push esi
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4022c8
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp + 0x3f0]
pop edi
xor ecx, ebp
pop esi
call fcn.004d5a7d
add ebp, 0x3f4
leave
ret

Function at 0x40239a
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push edi
push 0x549db4
mov edi, eax
push str._sUser_Cache_
mov ecx, 0x103
call fcn.0040299a
pop ecx
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4023d0
push ebx
mov ebx, edi
call fcn.004371a4
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebx
cmp dword [esp + 8], 0
je 0x4023e5
push dword [esp + 8]
push 0x103
call fcn.00402968
pop edi
ret 4
Function at 0x402404
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x402477
push edi
call esi
cmp dword [ebp - 4], 0
je 0x402473
push ebx
push dword [ebp - 4]
and dword [0x549b58], 0
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x402457
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
mov dword [0x549b58], 1
call esi
cmp dword [ebp - 4], 0
jne 0x402427
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40268b
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x549ba8], esi
je 0x4026ef
xor eax, eax
lea edi, [ebp - 0x420]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x549ba4]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x424]
push eax
mov dword [ebp - 0x424], 0x29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00402948
push eax
push dword [0x5473c8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4027b2
cmp dword [ebp + 0xc], esi
je 0x4026ff
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.004dbcc0
mov ecx, dword [ebp + 8]
add esp, 0xc
push esi
lea edx, [ebp - 0x210]
call fcn.0040255d
lea ecx, [ebp - 0x210]
call fcn.00436ebe
push esi
push esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0043f4cc
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x10
cmp dword [ebp + 8], 0xffffffff
je 0x402783
push 0x208
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004dbcc0
add esp, 0xc
push esi
lea edx, [ebp - 0x210]
or ecx, 0xffffffff
call fcn.0040255d
lea eax, [ebp - 0x210]
push eax
call ebx
xor eax, eax
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push esi
push eax
call fcn.004dbcc0
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
call fcn.0040239a
lea eax, [ebp - 0x418]
push eax
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
leave
ret 8
Function at 0x402820
Capabilities:
Check if file exists
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x398], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Pathshao123JuziBrowser.exe
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x402897
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402930
xor eax, eax
push ebx
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
call fcn.004dbcc0
add esp, 0xc
push 0x103
lea eax, [ebp + 0x190]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x190]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4028ce
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp + 0x190]
push eax
push 1
push 0x507b1c
push edi
push esi
call ebx
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp + 0x190]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40290d
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp + 0x190]
push eax
push 1
push str.Path
push edi
push esi
call ebx
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
add ebp, 0x39c
leave
ret

Function at 0x40369e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x4036ac
push 0xd
pop eax
jmp 0x4036df
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4036b3
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403b49
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
mov dword [ebp - 0x21c], eax
xor esi, esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.00403b16
mov ebx, eax
cmp ebx, esi
je 0x403bb1
cmp dword [ebp - 0x214], esi
je 0x403baa
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x403c4c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403bd9
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403b49
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x403c5d
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x403bb9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], esi
je 0x403c24
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], esi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x214], esi
je 0x403c4a
push dword [ebp - 0x214]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
leave
ret 4
cmp dword [ebp - 0x214], esi
je 0x403c71
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x403c4c
Function at 0x4067a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4067bb
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4067f0
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4067ec
cmp edi, eax
jae 0x4067f0
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4067de
cmp edi, eax
jb 0x4067f4
xor eax, eax
jmp 0x4067fd
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x406d38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x78], eax
mov esi, 0x50d844
inc ebx
cmp esi, 0x50e344
jge 0x406e25
test byte [esi + 4], bl
je 0x406e19
mov eax, dword [esi]
cmp eax, ebx
jne 0x406d8e
cmp dword [0x548460], 0
je 0x406e19
test eax, eax
jne 0x406d9a
cmp dword [0x548460], eax
jne 0x406e19
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x80], ebx
push dword [esi + 0xc]
mov dword [ebp - 0x7c], 0x208
push dword [esi + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x406e21
mov eax, dword [esi + 0x14]
dec eax
dec eax
je 0x406e03
dec eax
je 0x406dfb
dec eax
je 0x406df4
sub eax, 5
jne 0x406e19
mov eax, str.open
jmp 0x406e09
mov eax, str.hao123chprogid
jmp 0x406e09
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 8]
jmp 0x406e09
mov eax, dword [ebp - 0x78]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x406e21
add esi, 0x20
jmp 0x406d66
xor eax, eax
jmp 0x406e27
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
add ebp, 0x19c
leave
ret 4
Function at 0x40848f
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x4f82f6
call fcn.004de80b
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00407db9
mov edi, eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40857f
push ebx
mov eax, edi
call fcn.004314f7
test eax, eax
je 0x40857f
mov eax, dword [0x545cc4]
mov esi, 0x545cc4
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push str.select__from_bookmark_main_where_bm_type__0_limit__u_
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00405e6e
pop ecx
pop ecx
push dword [ebp - 0x10]
push edi
call fcn.004315c1
mov ebx, eax
test ebx, ebx
je 0x408574
mov eax, dword [0x545cc4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov ecx, esi
lea esi, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.00406ab3
mov byte [ebp - 4], 1
jmp 0x40854e
push 5
lea edi, [ebp - 0x1c]
call fcn.00431666
test eax, eax
je 0x40854e
push ebx
push 6
lea edi, [ebp - 0x18]
call fcn.00431666
test eax, eax
je 0x40854e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a0f2
mov dword [ebp - 0x14], 1
push ebx
call fcn.00431612
push ebx
test eax, eax
jne 0x40851e
call fcn.0043162f
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x14]
call fcn.004de8e3
ret 4

Function at 0x40859f
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x4f82cb
call fcn.004de80b
mov eax, dword [ebp + 8]
add eax, 0x20
mov dword [ebp - 0x10], eax
call fcn.00409e82
call fcn.00407db9
mov esi, eax
test esi, esi
je 0x40867d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40867d
push 0
mov eax, esi
call fcn.004314f7
test eax, eax
je 0x40867d
push str.select__from_bookmark_main_where_bm_type__1_order_by_bm_parent_asc_
lea eax, [ebp + 8]
push eax
call fcn.00407c9b
and dword [ebp - 4], 0
push dword [ebp + 8]
push esi
call fcn.004315c1
mov ebx, eax
test ebx, ebx
je 0x408672
mov ecx, 0x545cc4
lea esi, [ebp - 0x14]
call fcn.00406ab3
mov byte [ebp - 4], 1
jmp 0x408657
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call fcn.00431643
test eax, eax
je 0x408657
lea eax, [ebp - 0x18]
push eax
push 3
push ebx
call fcn.00431643
test eax, eax
je 0x408657
push ebx
push 5
lea edi, [ebp - 0x14]
call fcn.00431666
test eax, eax
je 0x408657
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00409e1b
push ebx
call fcn.00431612
test eax, eax
jne 0x40861c
push ebx
call fcn.0043162f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00406ace
call fcn.004de8e3
ret 4
Function at 0x40878b
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4f82a0
call fcn.004de80b
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp word [esi], bx
je 0x4088a1
call fcn.00407db9
mov edi, eax
cmp edi, ebx
je 0x4088a1
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4088a1
push ebx
mov eax, edi
call fcn.004314f7
test eax, eax
je 0x4088a1
mov eax, dword [0x545cc4]
mov ecx, 0x545cc4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp + 0x14]
push eax
cmp dword [ebp + 0x14], ebx
je 0x408817
call fcn.00417a38
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
push dword [ecx]
push dword [eax]
lea eax, [ebp - 0x10]
push str.select__from_bookmark_main_where_bm_url___s_and_bm_type__0_and_bm_parent___d_
call fcn.00405e6e
add esp, 0x14
jmp 0x408832
call fcn.00417a38
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x10]
push str.select__from_bookmark_main_where_bm_url___s_and_bm_type__0_
call fcn.00405e6e
add esp, 0x10
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00406ace
push dword [ebp - 0x10]
push edi
call fcn.004315c1
mov esi, eax
cmp esi, ebx
je 0x408896
jmp 0x40887d
push dword [ebp + 0xc]
push ebx
push esi
call fcn.00431643
test eax, eax
je 0x40887d
push dword [ebp + 8]
push 3
push esi
call fcn.00431643
test eax, eax
je 0x40887d
mov edi, dword [ebp + 0x10]
push esi
push 5
call fcn.00431666
cmp eax, ebx
jne 0x408889
push esi
call fcn.00431612
test eax, eax
jne 0x408851
jmp 0x408890
mov dword [ebp - 0x14], 1
push esi
call fcn.0043162f
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x14]
call fcn.004de8e3
ret 0x10

Function at 0x4088ac
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4f8663
call fcn.004de80b
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
cmp word [esi], di
je 0x40895e
call fcn.00407db9
mov ebx, eax
cmp ebx, edi
je 0x40895e
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40895e
push edi
mov eax, ebx
call fcn.004314f7
test eax, eax
je 0x40895e
mov eax, dword [0x545cc4]
mov ecx, 0x545cc4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push str.select__from_bookmark_main_where_bm_parent___d_and_bm_title___s_and_bm_type___d_
call fcn.00405e6e
add esp, 0x10
push dword [ebp - 0x10]
push ebx
call fcn.004315c1
mov esi, eax
cmp esi, edi
je 0x408953
jmp 0x40893a
push dword [ebp + 0x10]
push edi
push esi
call fcn.00431643
test eax, eax
jne 0x408946
push esi
call fcn.00431612
test eax, eax
jne 0x40892c
jmp 0x40894d
mov dword [ebp - 0x14], 1
push esi
call fcn.0043162f
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x14]
call fcn.004de8e3
ret 0xc
Function at 0x40d33d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov dword [ebx + 0x70], eax
mov eax, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
mov dword [ebx + 0x24], eax
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push dword [0x5d3858]
xor esi, esi
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx + 0x88], eax
mov eax, dword [0x549b90]
cmp eax, 0xffffffff
je 0x40d38a
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebx + 0x68], esi
je 0x40d398
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 0x14]
cmp dword [0x543e30], esi
jne 0x40d3a9
mov dword [0x543e30], esi
lea eax, [ebx + 0x20]
push eax
push 0x543e00
call fcn.0040f461
movzx eax, ax
cmp edi, esi
jne 0x40d3c0
xor edi, edi
push eax
xor eax, eax
push eax
push 0x80
push 0x80000000
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040f1f3
push esi
push 0x1f4
push 0xfeee
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebx + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x40d3f8
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov esi, ecx
push 0xfeeb
push dword [esi + 4]
call edi
push 0xfeee
push dword [esi + 4]
call edi
push 0xfeed
push dword [esi + 4]
call edi
push 0xfeec
push dword [esi + 4]
call edi
push dword [esi + 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d457
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
ret

Function at 0x40d4fc
Capabilities:
Find taskbar

Disassembly:
push dword [0x54cc54]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40d549
push 0x507b1c
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40d549
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.ReBarWindow32
push 0
push eax
call esi
test eax, eax
je 0x40d548
push 0
push str.MSTaskSwWClass
push 0
push eax
call esi
mov dword [0x54cc54], eax
pop esi
mov eax, dword [0x54cc54]
ret