joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x45a0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov byte [ebp - 0x78], 0
mov word [ebp - 0x77], ax
test edi, edi
je 0x422823
push esi
xor esi, esi
lea esp, [esp]
mov cx, word [edi]
push 0x10
lea edx, [ebp - 0x78]
push 0
push edx
mov word [ebp - 0x78], cx
call fcn.0043a687
mov byte [ebp + esi - 0xc], al
inc esi
add esp, 0xc
add edi, 3
cmp esi, 6
jl 0x422740
push ebx
push 0x66
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00439ed0
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 8]
mov dword [ebp - 0x6e], ecx
or eax, 0xffffffff
mov dword [ebp - 0x74], eax
mov word [ebp - 0x70], ax
mov word [ebp - 0x6a], dx
mov ecx, 0x16
lea esi, [ebp - 0x6e]
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push 0x8c
movsw word es:[edi], word [esi]
call fcn.0043a967
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x422821
mov eax, dword [ebp + 8]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov ecx, 2
mov word [ebx + 4], cx
mov edx, dword [0x446458]
push 9
mov dword [ebx + 8], edx
call dword [sym.imp.WS2_32.dll_htons]
lea edi, [ebx + 0x18]
mov ecx, 0x19
lea esi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push ebx
push 0
push 0x422270
mov word [ebx + 6], ax
mov dword [ebx + 0x14], 0x10
movsw word es:[edi], word [esi]
mov dword [ebx + 0x80], 0x66
mov dword [ebx + 0x84], 0x12
mov dword [ebx + 0x88], 0x64
call fcn.0043b538
add esp, 0xc
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00439e8a
mov esp, ebp
pop ebp
ret 0x14
Function at 0x422900
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x45a0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x508], 0
xor esi, esi
lea ecx, [ecx]
lea eax, [ebp - 0x510]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x42299f
mov ecx, dword [ebp - 0x510]
push ecx
push edi
call fcn.0043b13d
mov edi, eax
add esp, 8
test edi, edi
je 0x42297e
inc esi
cmp esi, 0x64
jl 0x422930
mov esi, dword [ebp - 0x508]
test edi, edi
je 0x422971
push edi
call fcn.0043a9fb
add esp, 4
test esi, esi
je 0x42297e
push esi
call fcn.0043a9fb
add esp, 4
mov eax, dword [ebp - 0x50c]
pop edi
pop esi
test eax, eax
je 0x422991
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439e8a
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x42295e
call fcn.004215a0
mov ecx, edi
test edi, edi
je 0x42297e
mov edi, edi
lea edx, [ecx + 0x1b0]
test edx, edx
je 0x4229da
cmp byte [edx], 0
je 0x4229da
lea edx, [ecx + 0x1d8]
test edx, edx
je 0x4229da
cmp byte [edx], 0
je 0x4229da
test eax, eax
je 0x4229e5
cmp dword [ecx + 0x19c], eax
je 0x4229e5
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4229b0
jmp 0x42295e
add ecx, 8
push ecx
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
push str._s_s
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.0043b5df
add esp, 0x14
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x404]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42295e
push eax
mov eax, dword [ebp - 0x50c]
lea edx, [ebp - 0x508]
push edx
push str.Domain
push eax
lea esi, [ebp - 0x514]
call fcn.00421770
mov esi, dword [ebp - 0x508]
test esi, esi
je 0x422a69
cmp byte [esi], 0
jne 0x422a8f
push esi
call fcn.0043a9fb
add esp, 4
mov dword [ebp - 0x508], 0
mov edx, dword [ebp - 0x50c]
push 0
lea ecx, [ebp - 0x508]
push ecx
push str.DhcpDomain
push edx
lea esi, [ebp - 0x514]
call fcn.00421770
mov esi, dword [ebp - 0x508]
test esi, esi
je 0x422964
cmp byte [esi], 0
je 0x422964
push esi
lea eax, [ebp - 0x504]
push eax
call fcn.00401890
test eax, eax
je 0x422964
cmp byte [ebp - 0x504], 0
je 0x422964
push 0
lea ecx, [ebp - 0x504]
push ecx
call fcn.0042cc60
jmp 0x422964
Function at 0x422e40
Capabilities:
Create thread
Enumerate network shares
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421e90
Function at 0x4232d0
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45a0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
call fcn.004215a0
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x42334f
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x1c]
push ecx
push edi
push ebx
call sub.IPHLPAPI.DLL_GetPerAdapterInfo
cmp eax, 0x6f
jne 0x423342
mov edx, dword [ebp - 0x1c]
push edx
push edi
call fcn.0043b13d
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4233f1
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x64
jl 0x423306
jmp 0x4233d9
test eax, eax
jne 0x4233d9
add edi, 0xc
jmp 0x42339a
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], 0x248
xor edi, edi
mov edi, edi
test esi, esi
je 0x42336b
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x1c]
push eax
push 0x40
call ebx
mov esi, eax
test esi, esi
je 0x4233f1
lea ecx, [ebp - 0x1c]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetNetworkParams
cmp eax, 0x6f
jne 0x423390
inc edi
cmp edi, 0x64
jl 0x423360
jmp 0x4233e6
test eax, eax
jne 0x4233e6
lea edi, [esi + 0x10c]
test edi, edi
je 0x4233d6
mov edi, edi
lea ecx, [edi + 4]
lea ebx, [ebp - 0x18]
call fcn.004230f0
test eax, eax
jne 0x4233d0
movzx edx, word [0x446398]
mov ecx, dword [0x44637c]
push eax
push 0x1e
push eax
push edx
mov edx, dword [ebp - 0x28]
mov eax, ebx
push eax
push ecx
push 0
push edx
call fcn.00428500
mov edi, dword [edi]
test edi, edi
jne 0x4233a0
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x4233e6
push edi
call fcn.0043a9fb
add esp, 4
test esi, esi
je 0x4233f1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439e8a
mov esp, ebp
pop ebp
ret 4
Function at 0x423410
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [0x446410]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [0x446414]
mov dword [eax + 4], edx
mov ecx, dword [0x446418]
mov dword [eax + 8], ecx
mov edx, dword [0x44641c]
push ebx
push esi
mov dword [eax + 0xc], edx
mov ecx, dword [0x446420]
xor esi, esi
xor ebx, ebx
push edi
mov dword [eax + 0x10], ecx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 4], esi
lea edx, [ebp - 4]
push edx
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, 0x6f
jne 0x423495
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.0043b13d
add esp, 8
mov dword [ebp + 0x10], eax
test eax, eax
je 0x423487
inc esi
mov ebx, eax
cmp esi, 0x64
jl 0x423452
jmp 0x423525
pop edi
pop esi
mov eax, 0xffffe5b8
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test edi, edi
jne 0x423525
call fcn.004215a0
mov dword [ebp - 0xc], eax
mov esi, ebx
test ebx, ebx
je 0x42353e
nop
lea ecx, [esi + 0x1b0]
test ecx, ecx
je 0x4234fa
cmp byte [ecx], 0
je 0x4234fa
lea edi, [esi + 0x1d8]
test edi, edi
je 0x4234fa
cmp byte [edi], 0
je 0x4234fa
mov ebx, dword [ebp + 0xc]
call fcn.004230f0
test eax, eax
jne 0x4234f7
mov ebx, dword [ebp + 0x14]
mov ecx, edi
call fcn.004230f0
test eax, eax
jne 0x4234f7
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x423502
cmp dword [esi + 0x19c], eax
je 0x423502
mov ebx, dword [ebp + 0x10]
mov esi, dword [esi]
test esi, esi
jne 0x4234b0
jmp 0x423525
cmp dword [esi + 0x190], 6
mov ebx, dword [ebp + 0x10]
jne 0x423525
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x194]
mov dword [eax + 0x1c], ecx
mov dx, word [esi + 0x198]
mov word [eax + 0x20], dx
test ebx, ebx
je 0x423532
push ebx
call fcn.0043a9fb
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x424fc0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, eax
push edi
push 0x4612f8
xor esi, esi
call fcn.00408c10
mov edx, 1
add dword [0x461304], edx
mov ecx, 0x40
cmp dword [0x46131c], ecx
jae 0x425016
mov dword [edi + 0x10], 0x461308
mov eax, dword [0x46131c]
mov dword [eax*4 + 0x461320], edi
mov ecx, dword [edi + 4]
mov eax, dword [0x46131c]
mov dword [eax*4 + 0x461420], ecx
add dword [0x46131c], edx
pop edi
mov eax, esi
pop esi
ret
mov eax, dword [0x461528]
test eax, eax
je 0x42502f
nop
cmp dword [eax + 0x14], ecx
jb 0x42504a
mov eax, dword [eax + 0x21c]
test eax, eax
jne 0x425020
push 0x220
call fcn.0043a967
mov esi, eax
add esp, 4
test esi, esi
jne 0x425069
pop edi
mov eax, 0xfffefffd
pop esi
ret
mov dword [edi + 0x10], eax
mov ecx, dword [eax + 0x14]
mov dword [eax + ecx*4 + 0x18], edi
mov ecx, dword [eax + 0x14]
mov edi, dword [edi + 4]
mov dword [eax + ecx*4 + 0x118], edi
add dword [eax + 0x14], edx
pop edi
mov eax, esi
pop esi
ret
push ebx
push 0x220
push 0
push esi
call fcn.00439ed0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
push 0
push 0
push 0
push 0
call ebx
mov dword [esi + 8], eax
test eax, eax
je 0x425135
push 0
push 0
push 0
push 0
call ebx
mov dword [esi + 0xc], eax
test eax, eax
je 0x425135
call fcn.00424dc0
mov ebx, eax
test ebx, ebx
jne 0x42513a
lea edx, [esi + 4]
push edx
push eax
push esi
push 0x424e20
push eax
push eax
call fcn.0043b2af
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4250e8
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
je 0x42512e
call ebx
mov ebx, eax
test ebx, ebx
jne 0x42513a
push esi
push 0x461528
call fcn.00408c10
mov eax, dword [esi + 0xc]
mov ecx, dword [0x461634]
mov dword [ecx*4 + 0x461534], eax
mov eax, 1
add dword [0x461634], eax
mov dword [edi + 0x10], esi
mov edx, dword [esi + 0x14]
mov dword [esi + edx*4 + 0x18], edi
mov ecx, dword [esi + 0x14]
mov edx, dword [edi + 4]
mov dword [esi + ecx*4 + 0x118], edx
add dword [esi + 0x14], eax
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov ebx, 0xffffe5d4
jmp 0x42513a
mov ebx, 0xfffefffd
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x425151
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x425162
push eax
call edi
mov dword [esi + 0xc], 0
push esi
call fcn.0043a9fb
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
ret
Function at 0x425290
Capabilities:
Terminate thread

Disassembly:
push edi
push esi
push 0x461528
call fcn.00408c50
mov ecx, dword [0x461634]
xor eax, eax
lea edi, [eax + 1]
test ecx, ecx
je 0x4252e1
mov edx, dword [esi + 0xc]
mov edi, edi
cmp dword [eax*4 + 0x461534], edx
je 0x4252c1
add eax, edi
cmp eax, ecx
jb 0x4252b0
jmp 0x4252e1
inc eax
sub ecx, eax
add ecx, ecx
add ecx, ecx
push ecx
lea ecx, [eax*4 + 0x461534]
push ecx
lea edx, [eax*4 + 0x461530]
push edx
call fcn.0043b870
add esp, 0xc
mov dword [esi + 0x10], edi
sub dword [0x461634], edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x425329
call edi
test eax, eax
je 0x425369
call edi
test eax, eax
je 0x425329
push eax
push str.SetEvent__
push 0x1f0
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push 0
call fcn.00420520
add esp, 0x18
mov ecx, dword [esi]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x425377
call edi
test eax, eax
je 0x425370
call edi
test eax, eax
je 0x42537e
push eax
push str.WaitForSingleObject__
push 0x1f4
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push 0
call fcn.00420520
add esp, 0x18
jmp 0x42537e
mov eax, 0xffffe5d4
jmp 0x42530a
mov eax, 0xffffe5d4
jmp 0x425348
cmp eax, 0x102
jne 0x4253b8
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x4253b8
call edi
test eax, eax
je 0x4253f6
call edi
test eax, eax
je 0x4253b8
push eax
push str.TerminateThread__
push 0x1fa
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push 0
call fcn.00420520
add esp, 0x18
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov eax, dword [esi + 8]
mov dword [esi], 0
test eax, eax
je 0x4253da
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4253eb
push eax
call edi
mov dword [esi + 0xc], 0
push esi
call fcn.0043a9fb
add esp, 4
pop edi
ret
mov eax, 0xffffe5d4
jmp 0x425399
Function at 0x4255c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x461528]
push edi
xor edi, edi
cmp esi, edi
je 0x42579a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ecx]
cmp dword [esi + 0x14], 1
mov eax, dword [esi + 0x21c]
mov dword [ebp - 4], eax
jne 0x425751
push esi
push 0x461528
call fcn.00408c50
mov ecx, dword [0x461634]
xor eax, eax
cmp ecx, edi
jbe 0x425640
mov edx, dword [esi + 0xc]
lea ecx, [ecx]
cmp dword [eax*4 + 0x461534], edx
je 0x425620
inc eax
cmp eax, ecx
jb 0x425610
jmp 0x425640
inc eax
sub ecx, eax
add ecx, ecx
add ecx, ecx
push ecx
lea ecx, [eax*4 + 0x461534]
push ecx
lea edx, [eax*4 + 0x461530]
push edx
call fcn.0043b870
add esp, 0xc
mov eax, 1
mov dword [esi + 0x10], eax
sub dword [0x461634], eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x425686
call ebx
test eax, eax
je 0x4256c5
call ebx
cmp eax, edi
je 0x425686
push eax
push str.SetEvent__
push 0x1f0
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push edi
call fcn.00420520
add esp, 0x18
mov ecx, dword [esi]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4256d3
call ebx
test eax, eax
je 0x4256cc
call ebx
cmp eax, edi
je 0x4256da
push eax
push str.WaitForSingleObject__
push 0x1f4
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push edi
call fcn.00420520
add esp, 0x18
jmp 0x4256da
mov eax, 0xffffe5d4
jmp 0x425668
mov eax, 0xffffe5d4
jmp 0x4256a5
cmp eax, 0x102
jne 0x425712
mov edx, dword [esi]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x425712
call ebx
test eax, eax
je 0x42574a
call ebx
cmp eax, edi
je 0x425712
push eax
push str.TerminateThread__
push 0x1fa
push str.PollRemoveWorker
push str._s:_d____s_failed:__d_n
push edi
call fcn.00420520
add esp, 0x18
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 8]
mov dword [esi], edi
cmp eax, edi
je 0x42572e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x42573f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
push esi
call fcn.0043a9fb
add esp, 4
jmp 0x42578e
mov eax, 0xffffe5d4
jmp 0x4256f4
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x42578e
call ebx
test eax, eax
je 0x4257a2
call ebx
cmp eax, edi
je 0x42578e
push eax
push str.SetEvent__
push 0x19e
push str.PollStartWorkers
push str._s:_d____s_failed:__d_n
push edi
call fcn.00420520
add esp, 0x18
call fcn.00425290
mov esi, dword [ebp - 4]
cmp esi, edi
jne 0x4255e0
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffe5d4
jmp 0x42576b
Function at 0x425d20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push str.SOFTWAREApple_Inc.Bonjour
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x425d93
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push esi
push 0x44f508
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x425d93
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x44f508
push eax
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x425da1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x425db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push str.SOFTWAREApple_Inc.Bonjour
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x425e3e
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x44f508
push ecx
mov dword [ebp - 8], 4
call esi
test eax, eax
jne 0x425e0f
xor edx, edx
cmp dword [ebp - 0xc], edx
setne dl
mov dword [0x45a06c], edx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push str.CacheEntryCount
push eax
mov dword [ebp - 8], 4
call esi
mov esi, eax
test esi, esi
jne 0x425e3e
mov ecx, dword [ebp - 0xc]
mov dword [0x479c78], ecx
mov eax, dword [ebp - 4]
test eax, eax
je 0x425e4c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426100
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, eax
test esi, esi
jne 0x426146
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x426146
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
je 0x426139
call ebx
test eax, eax
jne 0x42622f
jmp 0x42614c
pop esi
mov eax, 0xffffe59d
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 8], eax
test eax, eax
jne 0x42616e
call ebx
test eax, eax
je 0x426237
call ebx
test eax, eax
jne 0x42622f
mov eax, dword [ebp + 8]
push edi
push 0x12
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x426198
call ebx
test eax, eax
je 0x426244
call ebx
mov esi, eax
test esi, esi
jne 0x42621e
mov ecx, dword [ebp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea edx, [ebp - 4]
push edx
push 1
push edi
mov dword [ebp - 4], ecx
call ebx
test eax, eax
jne 0x4261c9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x42624b
call esi
mov esi, eax
test esi, esi
jne 0x426213
xor eax, eax
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, 1
push 2
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0x1f4
mov dword [ebp - 0x10], eax
call ebx
test eax, eax
jne 0x426211
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x42624b
call esi
mov esi, eax
test esi, esi
jne 0x426213
xor esi, esi
test edi, edi
je 0x42621e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop edi
test eax, eax
je 0x42622d
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, 0xffffe5bf
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, 0xffffe5b9
jmp 0x42621e
mov esi, 0xffffe5cf
jmp 0x426213

Function at 0x426260
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x45a0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x479c28], 0
jne 0x4262f2
cmp dword [0x479c70], 0
je 0x4262d9
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push ecx
lea edx, [ebp - 0x404]
push edx
call fcn.0043bd7f
mov edx, dword [ebp + 8]
add esp, 0xc
push 0
lea ecx, [ebp - 0x408]
push ecx
push 0
push 1
push 0
push 0x64
lea eax, [ebp - 0x404]
push 0
mov dword [ebp - 0x408], eax
mov eax, dword [0x479c70]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439e8a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edx
call fcn.0043ae47
add eax, 0x40
push eax
call fcn.0043bcdc
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439e8a
mov esp, ebp
pop ebp
ret
Function at 0x426300
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x45a0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplicationBonjour_Service
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x4263f5
push 0x104
lea edx, [ebp - 0x20c]
xor ecx, ecx
push edx
push ecx
mov word [ebp - 0x20c], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426364
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub eax, edx
mov edx, dword [ebp - 0x210]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 2
push 0
push str.EventMessageFile
push edx
call edi
mov esi, eax
test esi, esi
jne 0x4263f4
mov ecx, dword [ebp - 0x210]
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push esi
push str.TypesSupported
push ecx
mov dword [ebp - 0x214], 0x1f
call edi
mov esi, eax
test esi, esi
jne 0x4263f4
push 0x44f2c4
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [0x479c70], eax
test eax, eax
jne 0x4263f4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4263ef
call esi
mov esi, eax
jmp 0x4263f4
mov esi, 0xffffe5cf
pop edi
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x426406
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00439e8a
mov esp, ebp
pop ebp
ret
Function at 0x426ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45a0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x479c7c], 0
mov dword [ebp - 0x14], 0
jne 0x426ae0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439e8a
mov esp, ebp
pop ebp
ret
cmp dword [0x479c80], 0
je 0x426ad0
push ebx
lea eax, [ebp - 0x14]
push eax
push str.SOFTWAREApple_Inc.BonjourPower_Management
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x426b09
xor bl, bl
jmp 0x426be8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 0x44ec38
push eax
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x426b36
xor bl, bl
jmp 0x426be8
cmp dword [ebp - 0x18], 0
jne 0x426b43
xor bl, bl
jmp 0x426be8
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test al, al
jne 0x426b58
xor bl, bl
jmp 0x426be8
mov bl, 1
cmp byte [ebp - 0x10], bl
je 0x426b66
xor bl, bl
jmp 0x426be8
push 0x47aa60
call fcn.004231a0
test al, al
jne 0x426b78
xor bl, bl
jmp 0x426be8
push 0x47aa60
call fcn.0040f030
test al, al
jne 0x426b8a
xor bl, bl
jmp 0x426be8
push 0
call fcn.0043a919
mov edx, dword [0x47aa60]
mov edx, dword [edx + 0x10]
lea ecx, [eax + 0x1c20]
add esp, 4
cmp edx, ecx
jge 0x426ba9
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0x1c], ecx
fild dword [ebp - 0x1c]
push edi
fmul qword [0x44f700]
call fcn.0043be60
mov edi, eax
push edi
push str.enabling_sleep_proxy_client_with_next_maintenance_wake_in__d_seconds
push 4
call fcn.00426260
add esp, 0xc
mov eax, edi
push 0
neg eax
cdq
push 0x989680
push edx
push eax
call fcn.0043be20
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x426bf6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00439e8a
mov esp, ebp
pop ebp
ret