joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4571f8
Capabilities:
Check if file exists

Disassembly:
push 0x274
mov eax, 0x5bd71d
call fcn.00598fca
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x238], ebx
cmp dword [esi + 0xc], ebx
je 0x457277
cmp edi, ebx
je 0x457277
cmp word [edi], bx
je 0x457277
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x457277
lea eax, [ebp - 0x23c]
push edi
push eax
call fcn.0047f493
pop ecx
pop ecx
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x23c]
push 0x5deba8
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x248], eax
cmp eax, ebx
jne 0x457281
lea eax, [edi - 0x10]
call fcn.00407b6b
xor eax, eax
call fcn.00599026
ret 8
mov byte [ebp - 4], 1
mov dword [ebp - 0x234], ebx
cmp dword [ebp - 0x234], 8
jae 0x45740a
push dword [ebp - 0x234]
xor eax, eax
mov byte [ebp - 0x28], bl
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.id_d
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push 0x14
push eax
call fcn.005927ef
add esp, 0x10
lea ecx, [esi + 0x18]
mov edx, str.items
call fcn.0054b949
lea edx, [ebp - 0x28]
mov ecx, eax
call fcn.0054b949
mov edi, eax
cmp byte [edi + 8], bl
je 0x4573ed
call fcn.0054bd37
test al, al
je 0x4573ed
mov edx, 0x5defbc
mov ecx, edi
call fcn.0054b949
mov cl, byte [eax + 8]
cmp cl, bl
je 0x4573ed
cmp cl, 4
jne 0x4573ed
mov eax, dword [eax]
cmp eax, ebx
je 0x4573ed
push 0x5deba8
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
cmp eax, ebx
je 0x4573ed
push dword [ebp - 0x248]
push eax
call fcn.00593a9c
pop ecx
pop ecx
test eax, eax
jne 0x4573ed
mov edx, str.preset
mov ecx, edi
call fcn.0054b949
mov esi, eax
xor eax, eax
cmp dword [ebp + 0xc], ebx
lea edi, [ebp - 0x280]
setne al
push eax
call fcn.0054af9b
push eax
mov byte [ebp - 4], 2
call fcn.0054b224
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0054b1a0
xor eax, eax
push 0x206
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x103
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call fcn.00457587
test eax, eax
je 0x4573dd
push dword [ebp - 0x244]
lea eax, [ebp - 0x230]
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4573dd
push dword [ebp - 0x244]
lea ecx, [ebp - 0x230]
call fcn.00476205
pop ecx
mov esi, dword [ebp - 0x240]
mov dword [ebp - 0x238], 1
inc dword [ebp - 0x234]
jmp 0x45728b
cmp dword [ebp - 0x238], ebx
je 0x457415
inc dword [esi + 0x14]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x24c]
push esi
call fcn.00457b43
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x238]
jmp 0x457279
Function at 0x45749e
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x5beff0
call fcn.00598f2b
xor esi, esi
mov dword [ebp - 0x10], esi
cmp ebx, esi
je 0x45757d
cmp word [ebx], si
je 0x45757d
cmp dword [ebp + 0x10], esi
je 0x45757d
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004554f6
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 2
jne 0x457544
mov eax, dword [0x63696c]
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push str.newtabonline
call fcn.004040a8
push eax
push str._s_s_d.png
lea eax, [ebp + 8]
call fcn.00404f66
mov esi, dword [ebp + 8]
add esp, 0x10
push esi
call edi
test eax, eax
je 0x457538
mov edx, dword [ebp + 0x10]
push esi
mov ecx, 0x103
call fcn.004054f9
lea eax, [esi - 0x10]
call fcn.00407b6b
xor eax, eax
inc eax
jmp 0x45757f
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00407b6b
mov esi, 0x103
push esi
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00457710
test eax, eax
jne 0x457571
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00457587
test eax, eax
je 0x457578
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x457578
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
jmp 0x45757f
xor eax, eax
call fcn.00599003
ret 0xc
Function at 0x4575bc
Capabilities:
Check if file exists

Disassembly:
push 0x30
mov eax, 0x5bd6e2
call fcn.00598fca
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], ebx
cmp dword [esi + 0xc], ebx
je 0x457706
cmp eax, ebx
je 0x457706
cmp word [eax], bx
je 0x457706
cmp ecx, ebx
je 0x457706
push 0x5debb4
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
je 0x457706
push eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 4], ebx
call fcn.0047f493
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 8
jae 0x4576e8
push dword [ebp - 0x2c]
xor eax, eax
mov byte [ebp - 0x28], bl
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.id_d
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push 0x14
push eax
call fcn.005927ef
add esp, 0x10
lea ecx, [esi + 0x18]
mov edx, str.items
call fcn.0054b949
lea edx, [ebp - 0x28]
mov ecx, eax
call fcn.0054b949
mov ecx, eax
cmp byte [ecx + 8], bl
je 0x4576f8
call fcn.0054bd37
test al, al
je 0x4576f8
mov edx, 0x5defbc
call fcn.0054b949
mov cl, byte [eax + 8]
cmp cl, bl
je 0x4576f8
cmp cl, 4
jne 0x4576f8
mov eax, dword [eax]
cmp eax, ebx
je 0x4576f8
push 0x5deba8
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
cmp eax, ebx
je 0x4576f8
push dword [ebp - 0x34]
push eax
call fcn.00593a9c
pop ecx
pop ecx
test eax, eax
jne 0x4576f8
cmp dword [ebp - 0x30], ebx
je 0x4576ce
mov eax, 0x104
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00457587
jmp 0x4576d0
xor eax, eax
cmp eax, ebx
je 0x4576f8
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4576f8
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x38]
jmp 0x457708
inc dword [ebp - 0x2c]
jmp 0x457621
xor eax, eax
call fcn.00599026
ret 4

Function at 0x457d0d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x457d72
push esi
push 0x80
push 3
push esi
push 5
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], esi
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x457d69
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x458e24
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x110
mov eax, 0x5ba140
call fcn.00598f94
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp - 0x110], ax
xor esi, esi
lea eax, [ebp - 0x10e]
push esi
push eax
call fcn.00596530
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
call fcn.00428b69
pop ecx
xor eax, eax
push edi
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x5df64c
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x11c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [0x63696c]
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x114], eax
xor eax, eax
mov dword [ebp - 4], esi
cmp ax, word [0x63f288]
jne 0x458ede
call fcn.00404168
jmp 0x458ee3
mov eax, 0x63f288
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x110]
push ecx
push eax
push str.http:__log.123juzi.net_log_ntads_clk.php
push str._s_ver_scid_sumid_sas1_d
lea eax, [ebp - 0x114]
call fcn.00404f66
add esp, 0x18
push esi
push esi
push esi
mov esi, dword [ebp - 0x114]
push esi
call fcn.004437e7
mov edi, eax
call fcn.00443d04
lea eax, [esi - 0x10]
call fcn.00407b6b
call fcn.00599017
ret 4

Function at 0x45910e
Capabilities:
Check if file exists

Disassembly:
push 0xf4
mov eax, 0x5bee9a
call fcn.00598fca
mov edi, ecx
mov dword [ebp - 0xe4], edi
test edi, edi
je 0x459246
lea esi, [edi + 0x1048]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x459246
and dword [ebp - 4], 0
lea eax, [ebp - 0xd8]
push eax
call fcn.00548b11
lea eax, [ebp - 0x48]
push eax
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.0054af1d
mov edx, esi
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 2
call fcn.00426b05
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ebx, [ebp - 0xd8]
mov byte [ebp - 4], 3
call fcn.00548b5a
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x100]
mov byte [ebp - 0xd9], al
mov byte [ebp - 4], 2
call fcn.00407567
cmp byte [ebp - 0xd9], bl
je 0x459216
cmp byte [ebp - 0x40], bl
je 0x459216
lea eax, [ebp - 0x48]
call fcn.0054bd37
test al, al
je 0x459216
mov edx, str.logo
lea ecx, [ebp - 0x48]
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x459216
mov eax, dword [eax]
cmp eax, ebx
je 0x459216
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xe0]
cmp dword [ecx - 0xc], ebx
jne 0x4591f5
lea eax, [ecx - 0x10]
jmp 0x459211
push 1
push 2
push ebx
push ebx
push ebx
lea eax, [edi + 0x1250]
push eax
call fcn.00459a44
mov eax, dword [ebp - 0xe0]
add eax, 0xfffffff0
call fcn.00407b6b
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.0054b1a0
lea eax, [ebp - 0xd8]
call fcn.0040b0d5
jmp 0x45923b
lea ecx, [edi + 0x1048]
call fcn.0047611f
call fcn.00599026
ret
Function at 0x459a44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x28c], 0
push ebx
mov ebx, ecx
cmp word [ebx], 0
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x298], eax
jne 0x459a88
xor eax, eax
jmp 0x459c01
mov edi, 0x24b0
push edi
call fcn.0058f82d
mov esi, eax
pop ecx
test esi, esi
je 0x459bfb
push edi
push 0
push esi
call fcn.00596530
add esp, 0xc
push ebx
mov edi, 0x5db9e0
push edi
mov ebx, 0x823
push ebx
push esi
call fcn.0058f42f
mov eax, dword [ebp - 0x294]
add esp, 0x10
test eax, eax
je 0x459ae2
cmp word [eax], 0
je 0x459ae2
push eax
push edi
lea eax, [esi + 0x1250]
push ebx
push eax
call fcn.0058f42f
add esp, 0x10
mov eax, dword [ebp - 0x298]
mov ebx, 0x103
test eax, eax
je 0x459b09
cmp word [eax], 0
je 0x459b09
push eax
push edi
lea eax, [esi + 0x2298]
push ebx
push eax
call fcn.0058f42f
add esp, 0x10
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x278], ax
lea eax, [ebp - 0x276]
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x278]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and dword [ebp - 0x288], 0
xor eax, eax
lea edi, [ebp - 0x284]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x459b98
push 0x62
push eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push eax
call fcn.00596530
add esp, 0xc
push 0x32
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x278]
push eax
lea edi, [esi + 0x1048]
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x459bb8
lea edi, [esi + 0x1048]
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.jznt
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x24a0], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [esi + 0x24a4], eax
mov eax, dword [ebp + 0x18]
push 0x459c12
mov dword [esi + 0x24a8], eax
mov eax, dword [ebp + 0x1c]
push edi
push dword [ebp - 0x290]
mov dword [esi + 0x24ac], eax
call fcn.004437e7
mov edi, eax
call fcn.00443d04
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 0x18
Function at 0x45bd68
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x62f5c], edi
jne 0x45bdc9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x62f48], eax
call ebx
mov dword [esi + 0x62f50], eax
lea eax, [esi + 0x62f58]
push eax
push 4
push esi
push 0x45bf1b
push edi
push edi
call fcn.005905f0
add esp, 0x18
mov dword [esi + 0x62f54], eax
pop ebx
cmp eax, edi
je 0x45bdbf
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x62f5c], 1
xor eax, eax
pop edi
ret

Function at 0x45bdcd
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea esi, [edi + 0x62f50]
mov eax, dword [esi]
test eax, eax
je 0x45bdef
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi]
call ebx
and dword [esi], 0
mov eax, dword [edi + 0x62f54]
test eax, eax
je 0x45be32
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x45be23
push dword [edi + 0x62f54]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xffffffffffffffff
push dword [edi + 0x62f54]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x62f54]
call ebx
and dword [edi + 0x62f54], 0
pop esi
pop ebx
ret
Function at 0x45cdbf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x63c040], esi
je 0x45cfe4
call fcn.0045cd30
xor ebx, ebx
inc ebx
push ebx
call fcn.00407b83
pop ecx
mov edi, str.Options
cmp dword [esi + 0x61fbe8], 0x274c
jne 0x45cdfc
mov dword [esi + 0x61fc2c], ebx
push ebx
push dword [esi + 0x61fc2c]
lea edx, [esi + str.HeaderVisible]
mov ecx, edi
call fcn.00408416
pop ecx
pop ecx
mov ecx, dword [esi + 0x61fc30]
add esi, 0x58
mov dword [ecx], eax
cmp esi, 0x23c0
jb 0x45cdea
xor esi, esi
mov ecx, dword [esi + 0x623034]
push ebx
lea eax, [esi + str.http:__www.hao123.com__tn70000000_o2_hao_pg]
push eax
push dword [esi + 0x623038]
lea eax, [esi + str.HomePage]
push eax
mov edx, edi
call fcn.0040817f
add esi, 0x10a0
add esp, 0x10
cmp esi, 0x95a0
jb 0x45ce27
call fcn.0045debc
call fcn.0045d32d
mov ebx, 0x6bad88
push ebx
mov esi, 0x5db9e0
push esi
push 0x3f
push 0x6b4568
call fcn.0058f42f
push 0x6bae08
push esi
push 0x3f
push 0x6b45e8
call fcn.0058f42f
push 0x6bae88
push esi
push 0x3f
push 0x6b4668
call fcn.0058f42f
push 0x5e9e10
mov edi, 0x6b4950
push edi
call fcn.0058f69a
add esp, 0x38
test eax, eax
jne 0x45cec9
push ebx
push str.http:__www.hao123.com__tn_s
mov ecx, 0x1048
call fcn.00405374
pop ecx
pop ecx
call fcn.0045cfe9
push 4
xor ebx, ebx
mov ecx, 0x6c8e94
xor eax, eax
pop edx
mov esi, dword [eax + 0x6b4900]
mov dword [ecx], esi
add eax, edx
add ecx, 8
cmp eax, 0x50
jb 0x45ceda
mov dword [0x6bb4a0], ebx
cmp dword [0x63a5b4], ebx
je 0x45cf40
cmp dword [0x63a5a4], ebx
je 0x45cf40
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.sltinst
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45cf40
cmp dword [ebp - 4], ebx
je 0x45cf40
xor esi, esi
inc esi
mov dword [0x639514], esi
jmp 0x45cf43
xor esi, esi
inc esi
call fcn.0042942a
movzx edi, al
cmp edi, ebx
jne 0x45cf57
cmp dword [0x63a5b4], ebx
je 0x45cfac
call fcn.00429472
cmp eax, 2
jne 0x45cf7a
cmp dword [0x6b4460], ebx
jne 0x45cfac
cmp edi, ebx
je 0x45cfac
mov dword [0x6b4460], esi
mov edx, 0x6b4460
jmp 0x45cfa7
cmp eax, esi
jne 0x45cfac
cmp dword [0x639514], ebx
je 0x45cfb4
mov eax, dword [0x63a5a4]
mov dword [0x639510], eax
cmp dword [0x6b443c], ebx
jne 0x45cfac
cmp edi, ebx
je 0x45cfac
mov dword [0x6b443c], esi
mov edx, 0x6b443c
call fcn.0045d29a
cmp dword [0x639514], ebx
jne 0x45cfc2
cmp dword [0x6b4440], ebx
je 0x45cfc2
mov dword [0x639514], esi
mov eax, dword [0x6b443c]
mov dword [0x6bb4a4], eax
mov eax, dword [0x6b4460]
mov dword [0x63b634], eax
cmp dword [0x6b4418], ebx
jne 0x45cfe4
mov dword [0x6b4418], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45cfe9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 0x28], 0
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x14]
cmp eax, 2
jae 0x45d01c
mov dword [0x6b4530], 0x10
jmp 0x45d021
mov dword [0x6b4560], eax
mov eax, dword [0x6b4524]
mov dword [0x6394f4], eax
mov eax, dword [0x6b4520]
mov dword [0x6394f8], eax
lea eax, [ebp - 4]
push eax
push 0x6bb464
mov ecx, str.WinPos
mov dword [ebp - 4], 0x2c
call fcn.00407fcb
lea eax, [ebp - 4]
push eax
push 0x6bb110
mov ecx, str.HaoDNS
mov dword [ebp - 4], pe_nt_image_headers32
call fcn.00407fcb
lea eax, [ebp - 4]
push eax
push 0x6bb238
mov ecx, str.HaoDNSEx
mov dword [ebp - 4], 0x22c
call fcn.00407fcb
add esp, 0x18
cmp dword [0x6b4474], 0
jne 0x45d09e
push 0
xor eax, eax
call fcn.0042791e
pop ecx
mov dword [0x6b4474], eax
pop edi
leave
ret

Function at 0x45ddce
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push esi
xor esi, esi
inc esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
test eax, eax
je 0x45deaa
push ebx
push edi
push 0x7e
pop edi
xor eax, eax
push edi
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], edi
mov ebx, 0x5d0918
push ebx
mov edi, str.Softwarehao123JuziBrowser
push edi
mov dword [ebp - 0x18], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x80000001
call esi
test eax, eax
jne 0x45de46
cmp word [ebp - 0x14], ax
jne 0x45de8c
push 0x80
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push 0x80000002
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], 0x7e
call esi
test eax, eax
jne 0x45de86
cmp word [ebp - 0x14], ax
jne 0x45de8c
and dword [ebp - 0x20], 0
jmp 0x45dea3
lea eax, [ebp - 0x14]
push eax
push 0x5db9e0
push dword [ebp + 0x7c]
push dword [ebp - 0x24]
call fcn.0058f42f
add esp, 0x10
mov eax, dword [ebp - 0x20]
pop edi
pop ebx
jmp 0x45deac
mov eax, esi
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x70
leave
ret
Function at 0x45df3d
Capabilities:
Check if file exists

Disassembly:
push 0x308
mov eax, 0x5bed37
call fcn.00598fca
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2f8], eax
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push edi
push eax
mov dword [ebp - 0x2e8], edi
call fcn.00596530
add esp, 0xc
push str.setting.dat
mov dword [ebp - 0x2e4], edi
mov dword [ebp - 0x2f4], edi
call fcn.004040a8
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e1e8
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x220]
push 0x9c
push eax
call fcn.00418c22
add esp, 0x10
cmp dword [ebp - 0x2e4], edi
je 0x45e1e8
cmp dword [ebp - 0x2f4], edi
je 0x45e1b3
lea eax, [ebp - 0x2e0]
push eax
mov dword [ebp - 4], edi
call fcn.00548b11
lea eax, [ebp - 0x250]
push eax
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.0054af1d
mov byte [ebp - 4], 2
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x314]
call fcn.004050c6
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x314]
push eax
lea ebx, [ebp - 0x2e0]
mov byte [ebp - 4], 3
call fcn.00548b5a
push edi
push 1
lea ecx, [ebp - 0x314]
mov bl, al
mov byte [ebp - 4], 2
call fcn.00407567
test bl, bl
je 0x45e197
cmp byte [ebp - 0x248], 0
je 0x45e197
lea eax, [ebp - 0x250]
call fcn.0054bd37
test al, al
je 0x45e197
mov edx, str.items
lea ecx, [ebp - 0x250]
call fcn.0054b949
mov esi, eax
cmp byte [esi + 8], 0
je 0x45e197
call fcn.0054bd25
test al, al
je 0x45e197
xor ebx, ebx
mov eax, esi
call fcn.0054b6cc
cmp ebx, eax
jae 0x45e197
push ebx
mov ecx, esi
call fcn.0054b71c
mov edi, eax
cmp byte [edi + 8], 0
je 0x45e191
call fcn.0054bd37
test al, al
je 0x45e191
mov edx, str.name
mov ecx, edi
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x45e191
mov eax, dword [eax]
test eax, eax
je 0x45e191
push eax
lea eax, [ebp - 0x2ec]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2ec]
cmp dword [eax - 0xc], 0
jne 0x45e11d
mov byte [ebp - 4], 2
jmp 0x45e189
mov edx, str.value
mov ecx, edi
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x45e17f
mov eax, dword [eax]
test eax, eax
je 0x45e17f
push eax
lea eax, [ebp - 0x2f0]
push eax
call fcn.0047f54f
pop ecx
pop ecx
lea eax, [ebp - 0x2ec]
push eax
push dword [ebp - 0x2f8]
mov byte [ebp - 4], 5
call fcn.004514ba
mov edi, eax
lea eax, [ebp - 0x2f0]
call fcn.0040a3cc
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
mov dword [ebp - 0x2e8], 1
call fcn.00407b6b
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2ec]
add eax, 0xfffffff0
call fcn.00407b6b
inc ebx
jmp 0x45e0a8
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 1
call fcn.0054b1a0
lea eax, [ebp - 0x2e0]
call fcn.0040b0d5
xor edi, edi
cmp dword [ebp - 0x2e4], edi
je 0x45e1c7
push dword [ebp - 0x2e4]
call fcn.0058f807
pop ecx
cmp dword [ebp - 0x2e8], edi
je 0x45e1e8
lea ecx, [ebp - 0x220]
call fcn.0047611f
mov dword [ebp - 0x2e8], eax
jmp 0x45e1f3
lea ecx, [ebp - 0x220]
call fcn.0047611f
mov eax, dword [ebp - 0x2e8]
call fcn.00599026
ret