joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011cf
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
cmp ebx, 0x60
setne al
push ebx
mov dword [0x63bb18], eax
call fcn.00513912
call fcn.0041e543
mov dword [esp], fcn.0041f80c
call dword [0x63d174]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, edi
je 0x4012e6
cmp dword [ebp - 4], 4
jne 0x40129a
push str.ExcptionHandler
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40129a
push 0x10
push edi
push dword [esi + 0xc]
call fcn.00590150
push 0x10
push edi
push dword [esi + 8]
mov ebx, eax
call fcn.00590150
add esp, 0x18
push str.Except_Mutex
push edi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
push dword [ebp - 8]
mov edi, eax
call fcn.0041f92f
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x4012f8
cmp dword [ebp - 4], 2
jne 0x4012e6
mov ebx, str._Embedding
push ebx
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4012e6
call fcn.0047fe7a
mov dword [ebp - 8], eax
cmp eax, edi
je 0x4012e6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4012e6
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push edi
push ebx
push dword [ebp - 8]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401296
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004019e8
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401461
Capabilities:
Accept command line arguments

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call fcn.0042e11e
mov ebx, 0x63d1f0
test eax, eax
je 0x40149d
cmp word [eax], 0
je 0x40149d
push eax
push 0x5db9e0
push 0x1047
push ebx
call fcn.0058f42f
xor eax, eax
add esp, 0x10
mov word [0x63f27e], ax
call fcn.00516045
mov eax, ebx
mov dword [0x63d1e8], 1
pop ebx
ret
Function at 0x4018ee
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63c060
push str._s.update
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0058f42f
lea eax, [ebp - 0x20c]
push eax
call fcn.00475de5
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.0047ef19
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x40195d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40195d
xor eax, eax
inc eax
jmp 0x40195f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f3cf
leave
ret

Function at 0x40196b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63c060
push str._s.util
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0058f42f
lea eax, [ebp - 0x20c]
push eax
call fcn.00475de5
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.0047ef19
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x4019da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4019da
xor eax, eax
inc eax
jmp 0x4019dc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f3cf
leave
ret
Function at 0x40219b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x33d8
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor esi, esi
push esi
mov dword [ebp - 0x337c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
push 0x208
mov word [ebp - 0x2a0], ax
lea eax, [ebp - 0x29e]
push esi
push eax
call fcn.00596530
lea eax, [ebp - 0x2a0]
push eax
push str.__param
push edi
mov edi, 0x104
call fcn.00425518
add esp, 0x18
test eax, eax
je 0x40221b
cmp word [ebp - 0x2a0], si
je 0x40221b
push 0x100000
push esi
push esi
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeW]
mov edi, 0x5d03f8
jmp 0x402228
push 0x5f
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x2a0]
push edi
push eax
call fcn.0059017c
pop ecx
pop ecx
cmp eax, esi
jne 0x402222
cmp word [ebp - 0x2a0], si
je 0x40227a
xor eax, eax
push 0x80
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push esi
push eax
call fcn.00596530
mov ecx, dword [ebp - 0x337c]
add esp, 0xc
cmp ecx, esi
je 0x40227a
push 0x40
lea eax, [ebp - 0x90]
push eax
call fcn.00404424
xor eax, eax
push 0x1046
mov word [ebp - 0x12e8], ax
lea eax, [ebp - 0x12e6]
push esi
push eax
call fcn.00596530
lea eax, [ebp - 0x12e8]
push eax
push str.__url
push dword [ebp - 0x337c]
mov edi, 0x823
call fcn.00425518
xor eax, eax
push 0x208e
mov word [ebp - 0x3378], ax
lea eax, [ebp - 0x3376]
push esi
push eax
call fcn.00596530
add esp, 0x24
cmp word [ebp - 0x12e8], si
je 0x402317
lea ecx, [ebp - 0x12e8]
call fcn.00404391
test eax, eax
je 0x402317
call fcn.004014ab
test eax, eax
jne 0x402317
lea eax, [ebp - 0x12e8]
push eax
push 0x63c060
push str.__s____s_
lea eax, [ebp - 0x3378]
push 0x1047
push eax
call fcn.0058f42f
add esp, 0x14
jmp 0x402335
push 0x63c060
push 0x5d0434
lea eax, [ebp - 0x3378]
push 0x1047
push eax
call fcn.0058f42f
add esp, 0x10
push 0x40
lea eax, [ebp - 0x33d4]
push esi
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x338c], esi
lea edi, [ebp - 0x3388]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x338c]
push eax
lea eax, [ebp - 0x33d8]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x3378]
push eax
push esi
mov dword [ebp - 0x33d8], 0x44
mov dword [ebp - 0x33ac], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4023a9
push dword [ebp - 0x3388]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x338c]
call edi
cmp word [ebp - 0x2a0], si
je 0x4023bf
push esi
lea eax, [ebp - 0x2a0]
push eax
call fcn.004045ce
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0058f3cf
leave
ret
Function at 0x4026dd
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x13c
mov eax, 0x5b4b91
call fcn.00598f94
mov eax, dword [ebp + 8]
xor esi, esi
push esi
mov dword [ebp - 0x144], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 4
pop eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x13c]
push eax
push str.newmovietm
mov ebx, str.Softwarehao123JuziBrowser
push ebx
mov edi, 0x80000001
push edi
mov dword [ebp - 0x134], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402749
mov dword [ebp - 0x134], esi
push esi
call fcn.005901bf
pop ecx
mov dword [ebp - 0x140], eax
cmp eax, dword [ebp - 0x134]
jbe 0x40276f
sub eax, dword [ebp - 0x134]
cmp eax, 0x15180
jbe 0x402810
mov esi, dword [ebp - 0x144]
mov ecx, str.__dword
call fcn.004254af
mov dword [ebp - 0x138], eax
test eax, eax
je 0x402810
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 0x138]
push eax
push 4
push str.newmovienum
push ebx
push edi
call esi
test eax, eax
jne 0x402810
push 4
lea eax, [ebp - 0x140]
push eax
push 4
push str.newmovietm
push ebx
push edi
call esi
lea edi, [ebp - 0x130]
call fcn.0045e8cb
and dword [ebp - 4], 0
mov ecx, edi
call fcn.0045e9da
test eax, eax
je 0x402805
push dword [ebp - 0x138]
mov ecx, edi
push 1
call fcn.0045f00e
test eax, eax
je 0x402805
call fcn.0045ef6c
call fcn.0045f8eb
push 1
push 0x1a
pop ecx
mov edx, str.siteurl
call fcn.0045f9b4
lea ecx, [ebp - 0x130]
call fcn.0045e951
call fcn.00599017
ret 4
Function at 0x402818
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
sub esp, 0x11c
lea ebp, [esp - 4]
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push 0x24
mov eax, 0x5b3cae
call fcn.00598f2b
mov eax, dword [ebp + 0x128]
push 0
mov dword [ebp - 0x20], eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
and dword [ebp - 0x18], 0
push 4
pop esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.shortcuttm
push str.Softwarehao123JuziBrowser
mov ebx, 0x80000001
push ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
call edi
test eax, eax
je 0x402886
and dword [ebp - 0x18], 0
push 0
call fcn.005901bf
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x18]
jbe 0x4028a4
sub eax, dword [ebp - 0x18]
cmp eax, 0x93a80
jbe 0x4029be
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
push str.shortcutnum
push str.Softwarehao123JuziBrowser
push ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], esi
call edi
test eax, eax
je 0x4028cf
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 3
jae 0x4029be
mov esi, dword [ebp - 0x20]
inc dword [ebp - 0x10]
and dword [ebp - 0x14], 0
mov ecx, str.__dword
call fcn.004254af
lea edi, [ebp]
test eax, eax
jne 0x40291c
call fcn.0045e8cb
and dword [ebp - 4], 0
mov ecx, edi
call fcn.0045e9da
test eax, eax
je 0x40296b
mov ecx, edi
call fcn.0045ec4c
test eax, eax
je 0x40296b
mov dword [ebp - 0x14], 1
jmp 0x402966
call fcn.0045e8cb
xor esi, esi
inc esi
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.0045e9da
test eax, eax
je 0x40296b
lea ecx, [ebp]
call fcn.0045ec4c
test eax, eax
je 0x402942
mov dword [ebp - 0x14], esi
lea ecx, [ebp]
call fcn.0045edd9
test eax, eax
je 0x402951
mov dword [ebp - 0x14], esi
lea ecx, [ebp]
call fcn.0045ecf1
test eax, eax
je 0x402960
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 0
je 0x40296b
call fcn.0045ef6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0045e951
cmp dword [ebp - 0x14], 0
je 0x4029be
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.shortcutnum
mov edi, str.Softwarehao123JuziBrowser
push edi
push ebx
call esi
push 4
lea eax, [ebp - 0x28]
push eax
push 4
push str.shortcuttm
push edi
push ebx
call esi
call fcn.0045f8eb
push 1
push 0x1b
pop ecx
mov edx, str.siteurl
call fcn.0045f9b4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.0058f3cf
add ebp, 0x120
leave
ret 4
Function at 0x4029e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x83c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0042d1f3
mov dword [ebp - 0x840], eax
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push str.__param
push edi
mov edi, 0x104
call fcn.00425518
add esp, 0xc
test eax, eax
je 0x402bfd
cmp word [ebp - 0x218], bx
je 0x402bfd
xor eax, eax
push esi
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
push str.__ico
push dword [ebp - 0x83c]
call fcn.00425518
add esp, 0xc
test eax, eax
jne 0x402aa2
mov word [ebp - 0x428], ax
mov edi, dword [sym.imp.SHLWAPI.dll_UrlUnescapeW]
mov esi, 0x100000
push esi
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
call edi
cmp word [ebp - 0x428], bx
je 0x402ace
push esi
push ebx
push ebx
lea eax, [ebp - 0x428]
push eax
call edi
mov edi, 0x5d03f8
jmp 0x402adb
push 0x5f
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0059017c
pop ecx
pop ecx
cmp eax, ebx
jne 0x402ad5
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004045ce
test eax, eax
je 0x402b16
mov ecx, dword [ebp - 0x83c]
cmp ecx, ebx
je 0x402b16
push ebx
push ebx
call fcn.00404424
mov esi, dword [ebp - 0x83c]
mov ecx, str.__atb
call fcn.004254af
mov ecx, str.__defb
mov edi, eax
call fcn.004254af
mov esi, eax
cmp edi, ebx
jne 0x402b40
cmp esi, ebx
je 0x402bfd
xor eax, eax
push 0x40e
mov word [ebp - 0x838], ax
lea eax, [ebp - 0x836]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push esi
push edi
push 0x63c060
push str.__s____class3___dword1___atb_d___defb_d
lea eax, [ebp - 0x838]
push 0x207
push eax
call fcn.0058f42f
push 0x40
lea eax, [ebp - 0x894]
push ebx
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x850], ebx
lea edi, [ebp - 0x84c]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x898]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x838]
push eax
push ebx
mov dword [ebp - 0x898], 0x44
mov dword [ebp - 0x86c], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402bfd
push 0xffffffffffffffff
push dword [ebp - 0x850]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x84c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x850]
call esi
call fcn.0042d1f3
mov esi, eax
call fcn.00463f39
xor eax, eax
cmp dword [ebp - 0x840], ebx
sete al
mov edi, eax
push edi
push esi
call fcn.0046555a
call fcn.00463f39
cmp esi, ebx
je 0x402c2d
mov ecx, edi
call fcn.0046583e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret
Function at 0x403936
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x63c060
push str._s.down
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0058f42f
lea eax, [ebp - 0x20c]
push eax
call fcn.00475de5
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.0047ef19
lea eax, [ebp - 0x20c]
push eax
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x403a13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403a13
push esi
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push dword [0x6cd04c]
inc edi
call esi
test eax, eax
jne 0x4039c3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0x14
jb 0x4039a9
push dword [0x6cd04c]
call esi
pop esi
test eax, eax
je 0x403a0e
push dword [0x6cd04c]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4039e4
push 9
jmp 0x4039f6
push dword [0x6cd04c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x403a02
push 5
push dword [0x6cd04c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x6cd04c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
jmp 0x403a15
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0058f3cf
leave
ret
Function at 0x403f0f
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5fc]
sub esp, 0x67c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x5f8], eax
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x63c018], eax
cmp eax, esi
je 0x404037
xor eax, eax
push 0x206
mov word [ebp + 0x3f0], ax
lea eax, [ebp + 0x3f2]
push esi
push eax
call fcn.00596530
xor eax, eax
push 0x40e
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x1e]
push esi
push eax
call fcn.00596530
add esp, 0x18
push 0x103
lea eax, [ebp + 0x3f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.__procid
push dword [0x63c018]
lea eax, [ebp + 0x3f0]
push str.__dword
push 7
push str.__class
push eax
push str.__s___s_d__s_d__s_d
lea eax, [ebp - 0x20]
push 0x207
push eax
call fcn.0058f42f
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
add esp, 0x34
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404037
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov ecx, dword [ebp + 0x5f8]
pop edi
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x5fc
leave
ret

Function at 0x404119
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push edi
push 0x63c268
mov edi, eax
push str._sUser_Cache_
mov ecx, 0x103
call fcn.00405374
pop ecx
pop ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40414f
push ebx
mov ebx, edi
call fcn.0047601e
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebx
cmp dword [esp + 8], 0
je 0x404164
push dword [esp + 8]
push 0x103
call fcn.00405342
pop edi
ret 4

Function at 0x404220
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x404293
push edi
call esi
cmp dword [ebp - 4], 0
je 0x40428f
push ebx
push dword [ebp - 4]
and dword [0x63c010], 0
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x404273
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
mov dword [0x63c010], 1
call esi
cmp dword [ebp - 4], 0
jne 0x404243
pop ebx
pop edi
pop esi
leave
ret
Function at 0x404424
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x110
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x9c], eax
xor ebx, ebx
xor eax, eax
cmp word [esi], bx
je 0x4045bb
push edi
push 0x80
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x16]
push ebx
push eax
call fcn.00596530
lea eax, [ebp - 0x18]
push eax
push str.__procid
push esi
push 0x40
pop edi
call fcn.00425518
add esp, 0x18
test eax, eax
je 0x4045b8
cmp word [ebp - 0x18], bx
je 0x4045b8
mov edx, dword [ebp - 0x9c]
cmp edx, ebx
je 0x4044a8
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x4044a8
lea eax, [ebp - 0x18]
push eax
call fcn.004054f9
push 0x7e
pop esi
xor eax, eax
push esi
mov word [ebp - 0x98], ax
lea eax, [ebp - 0x96]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0xa0], esi
mov edi, 0x5d0918
push edi
mov esi, str.Softwarehao123JuziBrowser
push esi
mov ebx, 0x80000001
push ebx
mov dword [ebp - 0x9c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40450f
cmp word [ebp - 0x98], ax
jne 0x404535
lea eax, [ebp - 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x404515
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x80
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
push edi
push esi
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0xa0], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40458f
cmp word [ebp - 0x98], ax
jne 0x4045b5
lea eax, [ebp - 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x404595
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push edi
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ebx, ebx
inc ebx
mov eax, ebx
pop edi
mov ecx, dword [ebp + 0x6c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0x70
leave
ret 8
Function at 0x404a30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63c060
push str._s.videobox
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0058f42f
lea eax, [ebp - 0x20c]
push eax
call fcn.00475de5
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.0047ef19
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404afa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0042e42d
pop ecx
test eax, eax
jne 0x404af5
push dword [0x6cd260]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404af5
push dword [0x6cd260]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x404af5
push dword [0x6cd260]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x404ae9
push 9
push dword [0x6cd260]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x6cd260]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
jmp 0x404afc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f3cf
leave
ret

Function at 0x404cb1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63c060
push str._s.videoboxpop
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0058f42f
lea eax, [ebp - 0x20c]
push eax
call fcn.00475de5
add esp, 0x14
lea eax, [ebp - 0x20c]
call fcn.0047ef19
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404d20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404d20
xor eax, eax
inc eax
jmp 0x404d22
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058f3cf
leave
ret

Function at 0x406091
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40609f
push 0xd
pop eax
jmp 0x4060d2
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4060a6
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc