joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42279f
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push eax
mov esi, ecx
call fcn.004dbcc0
add esp, 0xc
add esi, 0x438
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4227e0
sub eax, ecx
sar eax, 1
lea ecx, [eax - 1]
mov eax, 0x103
cmp ecx, eax
ja 0x42280e
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4227ff
sub eax, edx
sar eax, 1
dec eax
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004d6323
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
je 0x422857
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422857
test al, 0x10
jne 0x422857
push 0x80
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.004d5a7d
add ebp, 0x18c
leave
ret

Function at 0x42288f
Capabilities:
Copy file
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x104c]
mov eax, 0x104c
call fcn.004e84e0
push 0xffffffffffffffff
push 0x4f5bab
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x1048], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1054]
mov dword [ebp - 0x18], eax
xor eax, eax
mov edi, 0x54d4a8
cmp ax, word [0x54d4a8]
jne 0x422904
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp word [0x54d4a8], 0
je 0x4229bc
mov eax, dword [0x545cc4]
mov esi, 0x545cc4
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
and dword [ebp - 4], 0
push edi
push str.cookie:_s__s_
lea eax, [ebp - 0x14]
call fcn.00405e6e
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.00423016
push 0x1047
lea eax, [ebp + 1]
push 0
push eax
call fcn.004dbcc0
mov edi, dword [ebp - 0x14]
mov eax, 0x1048
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.WININET.dll_GetUrlCacheEntryInfoW]
test eax, eax
je 0x4229b4
mov eax, dword [0x545cc4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0x1058]
mov byte [ebp - 4], 1
call fcn.00402345
push eax
push str._suser_d.dat
lea eax, [ebp - 0x10]
call fcn.00405e6e
mov esi, dword [ebp - 0x10]
add esp, 0xc
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esi - 0x10]
call fcn.00406ace
lea eax, [edi - 0x10]
call fcn.00406ace
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x1048]
xor ecx, ebp
call fcn.004d5a7d
add ebp, 0x104c
leave
ret 8
Function at 0x4229e0
Capabilities:
Check if file exists
Copy file
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5b73
mov eax, dword fs:[0]
push eax
mov eax, 0x126c
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x126c], eax
xor eax, eax
xor esi, esi
mov ebx, 0x54d6b0
cmp ax, word [0x54d6b0]
jne 0x422a52
lea eax, [ebp - 0x1264]
push eax
push ebx
mov dword [ebp - 0x1264], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp word [0x54d6b0], si
je 0x422bbf
mov eax, dword [0x545cc4]
mov edi, 0x545cc4
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1268], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
call fcn.00402345
push eax
push str._suser_d.dat
lea eax, [ebp - 0x1268]
call fcn.00405e6e
add esp, 0xc
push dword [ebp - 0x1268]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422bb1
mov eax, dword [0x545cc4]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1264], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x126c]
lea eax, [ebp - 0x1264]
push ebx
push str.cookie:_s__s_
call fcn.00405e6e
add esp, 0xc
lea eax, [ebp - 0x1264]
call fcn.00423016
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.004dbcc0
push 0x1047
lea eax, [ebp - 0x125f]
push esi
push eax
call fcn.004dbcc0
mov ebx, dword [ebp - 0x1264]
mov eax, 0x1048
add esp, 0x18
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x1260], eax
lea eax, [ebp - 0x1274]
push eax
lea eax, [ebp - 0x1260]
push eax
push ebx
call dword [sym.imp.WININET.dll_GetUrlCacheEntryInfoW]
test eax, eax
jne 0x422b4e
push esi
lea eax, [ebp - 0x218]
push eax
push 0x5158ec
push esi
push ebx
call dword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
cmp word [ebp - 0x218], si
je 0x422ba9
push esi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x1268]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push esi
push esi
push esi
push 0x100000
xor eax, eax
mov dword [ebp - 0x1270], esi
lea edi, [ebp - 0x126c]
stosd dword es:[edi], eax
push dword [ebp - 0x126c]
lea eax, [ebp - 0x218]
push dword [ebp - 0x1270]
push dword [ebp - 0x126c]
push dword [ebp - 0x1270]
push eax
push ebx
call dword [sym.imp.WININET.dll_CommitUrlCacheEntryW]
lea eax, [ebx - 0x10]
call fcn.00406ace
mov eax, dword [ebp - 0x1268]
add eax, 0xfffffff0
call fcn.00406ace
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5a7d
leave
ret 8
Function at 0x42330d
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
shr eax, 0x10
test ax, ax
je 0x4233a4
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
mov dword [esi + 0x2c], eax
mov eax, dword [0x548460]
mov dword [esi + 0x34], eax
lea eax, [esi + 0x60]
push 1
xor edi, edi
push eax
push ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x30], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [0x5c5cbc], 1
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [esi + 0x24]
mov ecx, dword [eax]
cmp ecx, edi
jne 0x423395
push eax
push edi
push esi
push 0x4232a9
push edi
push edi
call fcn.004d67c7
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4233a3
push edi
push edi
push 0x500
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop edi
ret 0xc
Function at 0x423d07
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
mov esi, eax
xor ecx, ecx
push edi
cmp esi, ecx
je 0x423e7f
mov eax, dword [ebp + 0xc]
sub eax, 0x200
mov dword [ebx + 0x68], esi
je 0x423de5
sub eax, 4
je 0x423d82
dec eax
jne 0x423e7f
mov dword [ebx + 0x70], ecx
cmp dword [ebx + 0x74], ecx
jne 0x423e30
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
cmp dword [eax + 4], 2
jne 0x423e7f
call fcn.00423e8a
test eax, eax
je 0x423e7f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x204
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x423e7f
mov edi, dword [ebp + 8]
push edi
push dword [esi + 4]
call fcn.0041c9e5
pop ecx
pop ecx
test eax, eax
jne 0x423dac
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
cmp eax, edi
je 0x423dac
and dword [ebx + 0x6c], 0
and dword [ebx + 0x74], 0
jmp 0x423e7f
and dword [ebx + 0x74], 0
xor esi, esi
lea eax, [ebx + 0x78]
inc esi
push eax
mov dword [ebx + 0x6c], edi
mov dword [ebx + 0x70], esi
call dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.00423e8a
test eax, eax
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
je 0x423ddc
mov dword [eax + 4], esi
jmp 0x423e7f
and dword [eax + 4], 0
jmp 0x423e7f
cmp dword [ebx + 0x70], ecx
je 0x423e7c
test byte [ebp + 0x10], 2
je 0x423e7c
xor eax, eax
mov dword [esp + 0x10], ecx
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
sub eax, dword [ebx + 0x78]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jge 0x423e35
mov eax, dword [esp + 0x14]
sub eax, dword [ebx + 0x7c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jge 0x423e35
xor eax, eax
inc eax
jmp 0x423e81
and dword [ebx + 0x70], 0
mov dword [ebx + 0x74], 1
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp + 8]
jne 0x423e51
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x78]
push 0x10
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x7c]
push 0
push 0x67
lea ebx, [esp + 0x24]
mov ecx, esi
mov dword [esp + 0x30], eax
call fcn.0040ec90
jmp 0x423e7f
mov dword [ebx + 0x70], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4260d5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x30], edi
jne 0x42611f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1c], eax
call ebx
mov dword [esi + 0x24], eax
lea eax, [esi + 0x2c]
push eax
push edi
push esi
push 0x42622d
push edi
push edi
call fcn.004d67c7
add esp, 0x18
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 1
pop ebx
cmp dword [esi + 0x20], edi
jne 0x426153
cmp dword [esi + 0x28], edi
je 0x42614e
push 0x3e8
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42614e
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
cmp dword [esi + 0x20], edi
je 0x42618f
cmp dword [esi + 0x2c], edi
je 0x42618f
push 8
call fcn.004d6661
pop ecx
cmp eax, edi
je 0x42616f
mov dword [eax], 3
mov dword [eax + 4], edi
jmp 0x426171
xor eax, eax
mov ecx, dword [ebp + 8]
push edi
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push eax
push 0x401
mov dword [eax + 4], ecx
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 8
Function at 0x4263ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20c0
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x20b4], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x20bc], eax
xor eax, eax
mov ebx, 0x1046
push ebx
xor esi, esi
mov word [ebp - 0x20ac], ax
lea eax, [ebp - 0x20aa]
push esi
push eax
call fcn.004dbcc0
add esp, 0xc
xor eax, eax
push ebx
mov word [ebp - 0x1064], ax
lea eax, [ebp - 0x1062]
push esi
push eax
call fcn.004dbcc0
mov eax, dword [0x515a6c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x515a70]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
lea eax, [ebp - 0x20b0]
push eax
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x426490
xor eax, eax
jmp 0x426523
push 0xa
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp + 8]
inc eax
push eax
mov dword [ebp - 0x20b8], ebx
call fcn.004d720d
add esp, 0xc
lea eax, [ebp - 0x20b8]
push eax
lea eax, [ebp - 0x20ac]
push eax
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x426515
mov edi, dword [ebp - 0x20bc]
lea eax, [ebp - 0x20ac]
push eax
push edi
call fcn.00406723
call fcn.0044dc25
mov ebx, eax
cmp ebx, esi
je 0x426512
mov edx, dword [edi]
lea eax, [ebp - 0x1064]
push eax
call fcn.00417a7d
pop ecx
lea eax, [ebp - 0x1064]
push eax
push dword [ebp - 0x20b4]
call fcn.00406723
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
xor esi, esi
inc esi
push dword [ebp - 0x20b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
leave
ret 0xc
Function at 0x42673b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f70f9
mov eax, dword fs:[0]
push eax
mov eax, 0x108c
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x1046
mov word [ebp - 0x1070], ax
xor ebx, ebx
lea eax, [ebp - 0x106e]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x1084], esi
call fcn.004dbcc0
mov eax, dword [0x515a6c]
mov dword [ebp - 0x24], eax
mov eax, dword [0x515a70]
mov dword [ebp - 0x20], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
inc edi
add esp, 0xc
mov eax, esi
mov dword [ebp - 0x1080], edi
call fcn.00426b5f
lea eax, [ebp - 0x1078]
push eax
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x426919
push 0xa
lea eax, [ebp - 0x1e]
push eax
push edi
mov dword [ebp - 0x107c], 0x1046
call fcn.004d720d
jmp 0x4268e2
cmp word [ebp - 0x1070], bx
je 0x4268b8
mov eax, dword [0x545cc4]
mov ecx, 0x545cc4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1074], eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1074]
push eax
mov dword [ebp - 4], ebx
call fcn.00406723
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
jne 0x42683c
xor eax, eax
jmp 0x426844
mov eax, dword [esi + 0x14]
sub eax, ecx
sar eax, 2
mov ebx, dword [esi + 0x10]
mov edx, ebx
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x42686c
lea eax, [ebp - 0x1074]
xor esi, esi
push eax
inc esi
call fcn.00421dc1
mov ecx, dword [ebp - 0x1084]
mov dword [ecx + 0x10], eax
jmp 0x42689e
mov edi, esi
lea esi, [ebp - 0x108c]
call fcn.0044f41b
push dword [ebp - 0x1088]
lea eax, [ebp - 0x1074]
push dword [ebp - 0x108c]
push eax
lea eax, [ebp - 0x1094]
push eax
mov eax, dword [ebp - 0x1084]
call fcn.00426ab2
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1074]
add eax, 0xfffffff0
call fcn.00406ace
mov esi, dword [ebp - 0x1084]
xor ebx, ebx
inc dword [ebp - 0x1080]
push 0xa
lea eax, [ebp - 0x1e]
push eax
push dword [ebp - 0x1080]
call fcn.004d720d
xor eax, eax
mov dword [ebp - 0x107c], 0x1046
mov word [ebp - 0x1070], ax
add esp, 0xc
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x1070]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1078]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4267f8
push dword [ebp - 0x1078]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5a7d
leave
ret
Function at 0x426933
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x194], eax
and dword [ebp - 0x80], 0
push ebx
push esi
push edi
mov ebx, str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push ebx
mov edi, 0x80000001
push edi
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x80]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x426a11
mov ebx, dword [esi + 0x10]
sub ebx, dword [esi + 0xc]
sar ebx, 2
cmp ebx, 0x18
jle 0x42698e
push 0x18
pop ebx
mov eax, dword [0x515a6c]
mov dword [ebp - 0x74], eax
mov eax, dword [0x515a70]
push 0x200
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.004dbcc0
and dword [ebp - 0x78], 0
add esp, 0xc
test ebx, ebx
jle 0x426a08
mov dword [ebp - 0x7c], 1
mov edi, dword [ebp - 0x78]
call fcn.0044a99d
mov edi, eax
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jle 0x426a00
push 0xa
lea eax, [ebp - 0x6e]
push eax
push dword [ebp - 0x7c]
call fcn.004d720d
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
add esp, 0xc
add ecx, ecx
push ecx
push eax
push 1
push 0
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc dword [ebp - 0x7c]
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], ebx
jl 0x4269c0
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
add ebp, 0x198
leave
ret
Function at 0x4298d4
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x62d54], edi
jne 0x429935
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x62d40], eax
call ebx
mov dword [esi + 0x62d48], eax
lea eax, [esi + 0x62d50]
push eax
push 4
push esi
push 0x429a87
push edi
push edi
call fcn.004d67c7
add esp, 0x18
mov dword [esi + 0x62d4c], eax
pop ebx
cmp eax, edi
je 0x42992b
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x62d54], 1
xor eax, eax
pop edi
ret

Function at 0x429939
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea esi, [edi + 0x62d48]
mov eax, dword [esi]
test eax, eax
je 0x42995b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi]
call ebx
and dword [esi], 0
mov eax, dword [edi + 0x62d4c]
test eax, eax
je 0x42999e
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42998f
push dword [edi + 0x62d4c]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xffffffffffffffff
push dword [edi + 0x62d4c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x62d4c]
call ebx
and dword [edi + 0x62d4c], 0
pop esi
pop ebx
ret

Function at 0x42aa9c
Capabilities:
Get system information on windows

Disassembly:
or dword [0x5bf6d0], 0xffffffff
push ebx
push esi
push edi
xor eax, eax
push 0x2c
push eax
push 0x5c5c90
mov dword [0x5bf6c8], eax
mov dword [0x5bf6cc], eax
mov dword [0x5bf6d4], 1
call fcn.004dbcc0
push 1
call fcn.004049b5
add esp, 0x10
push 0x2b
mov esi, str.HeaderVisible
pop ebx
mov edi, str.Options
push 1
push dword [esi + 0x40]
mov edx, esi
mov ecx, edi
call fcn.004052a1
pop ecx
pop ecx
mov ecx, dword [esi + 0x44]
add esi, 0x58
dec ebx
mov dword [ecx], eax
jne 0x42aae0
xor esi, esi
mov ecx, dword [esi + 0x532934]
lea eax, [esi + str.http:__www.hao123.com__tn70000000_o2_hao_pg]
push eax
push dword [esi + 0x532938]
lea eax, [esi + str.HomePage]
push eax
mov edx, edi
call fcn.00405018
add esi, 0x10a0
add esp, 0xc
cmp esi, 0x8500
jb 0x42aafd
call fcn.0042ae22
push 0x515c50
mov esi, 0x5bf6d8
push esi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x42ab62
push 0x5c5b10
push str.http:__www.hao123.com__tn_s
push 0x1048
push esi
call fcn.004d5add
add esp, 0x10
pop edi
pop esi
pop ebx
jmp fcn.0042ab6a
Function at 0x42b24f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x94
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push esi
xor esi, esi
inc esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x42b32a
push ebx
push edi
push 0x7e
pop edi
xor eax, eax
push edi
push eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xe]
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], edi
mov ebx, 0x515d20
push ebx
mov edi, str.Softwarehao123JuziBrowser
push edi
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x80000001
call esi
test eax, eax
jne 0x42b2c7
cmp word [ebp - 0x10], ax
jne 0x42b30d
push 0x80
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push 0x80000002
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 0x7e
call esi
test eax, eax
jne 0x42b307
cmp word [ebp - 0x10], ax
jne 0x42b30d
and dword [ebp - 0x1c], 0
jmp 0x42b323
lea eax, [ebp - 0x10]
push eax
push 0x50e498
push 0x40
push dword [ebp - 0x20]
call fcn.004d5add
add esp, 0x10
mov eax, dword [ebp - 0x1c]
pop edi
pop ebx
jmp 0x42b32c
mov eax, esi
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
pop esi
call fcn.004d5a7d
add ebp, 0x74
leave
ret

Function at 0x42b71e
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0xa000
push edi
mov dword [ebp - 4], edi
call fcn.004d4f20
mov esi, eax
pop ecx
test esi, esi
je 0x42b7e8
push edi
push 0
push esi
call fcn.004dbcc0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push str.visited:
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 8], eax
test eax, eax
je 0x42b7e1
mov ecx, dword [ebp + 8]
call fcn.0042b68f
mov ebx, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov dword [ebp - 0xc], eax
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0xc]
call fcn.0042b6b9
add esp, 0xc
test eax, eax
je 0x42b7b2
push dword [esi + 4]
call ebx
test eax, eax
jne 0x42b7b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42b7b2
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileA]
push dword [esi + 4]
call ebx
push edi
push 0
push esi
mov dword [ebp - 4], edi
call fcn.004dbcc0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x42b779
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.004d5a72
pop ecx
pop edi
pop esi
pop ebx
leave
ret