joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576260
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x576480
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
lea eax, [0x5ef79e]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x3e
call fcn.004736a0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x5763a6
movzx ebx, byte [ecx + eax - 1]
cmp bl, 0x2e
ja 0x576335
cmp bl, 0x2a
ja 0x5762f6
cmp bl, 0x26
ja 0x5762e6
cmp bl, 0x21
je 0x576394
cmp bl, 0x25
jb 0x576390
jmp 0x576374
cmp bl, 0x28
je 0x57635c
cmp bl, 0x2a
jne 0x576390
jmp 0x576374
cmp bl, 0x2c
ja 0x576302
cmp bl, 0x2b
je 0x576307
jmp 0x576374
cmp bl, 0x2d
jne 0x57630f
lea edx, [ecx - 1]
jmp 0x576449
cmp ecx, 1
je 0x57632c
movzx eax, byte [ecx + eax - 2]
cmp al, 0x30
jb 0x57632c
cmp al, 0x39
ja 0x57632c
mov byte [esp + 0x34], 1
add esp, 0x20
ret
mov byte [esp + 0x34], 0
add esp, 0x20
ret
cmp bl, 0x5e
ja 0x576365
cmp bl, 0x3f
ja 0x576350
lea ebp, [ebx - 0x3a]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jbe 0x57637d
cmp bl, 0x3c
jb 0x576390
jmp 0x576374
cmp bl, 0x5b
je 0x57635c
cmp bl, 0x5e
jne 0x576390
jmp 0x576374
mov byte [esp + 0x34], 0
add esp, 0x20
ret
cmp bl, 0x7c
ja 0x576386
cmp bl, 0x7b
je 0x57637d
cmp bl, 0x7c
jne 0x576390
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 0
add esp, 0x20
ret
cmp bl, 0x7d
je 0x57639d
cmp bl, 0x7e
je 0x576394
mov ebx, ecx
jmp 0x5763b5
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 0
add esp, 0x20
ret
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x34], al
add esp, 0x20
ret
mov ecx, ebp
test ecx, ecx
jle 0x5763e7
lea ebp, [ecx - 1]
cmp ebx, ebp
jbe 0x57643e
movzx esi, byte [ecx + eax - 1]
cmp esi, 0x24
je 0x5763b3
lea edi, [esi - 0x30]
cmp edi, 9
jbe 0x5763b3
lea edi, [esi - 0x41]
cmp edi, 0x19
jbe 0x5763b3
cmp esi, 0x5f
je 0x5763b3
add esi, 0xffffff9f
cmp esi, 0x19
jbe 0x5763b3
cmp ecx, ebx
ja 0x576435
mov ebp, dword [0x7873e4]
lea esi, [0x5a85e0]
mov dword [esp], esi
mov dword [esp + 4], ebp
sub edx, ecx
neg edx
sar edx, 0x1f
and edx, ecx
add eax, edx
mov dword [esp + 8], eax
sub ebx, ecx
mov dword [esp + 0xc], ebx
call fcn.0040f660
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
test al, al
je 0x57642c
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 1
add esp, 0x20
ret
mov eax, ecx
mov ecx, ebx
call fcn.004624e0
mov eax, ebp
mov ecx, ebx
call fcn.00462480
mov edx, ebp
test edx, edx
jle 0x57645c
lea ebp, [edx - 1]
cmp ecx, ebp
jbe 0x576478
lea esi, [edx + eax - 1]
cmp byte [esi], bl
je 0x576447
sub ecx, edx
test ecx, 1
je 0x57646f
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 1
add esp, 0x20
ret
mov eax, ebp
call fcn.00462480
nop
call fcn.00460ff0
jmp fcn.00576260
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and eax, 0x8b569ec1
jne 0x401e56
push esi
lea eax, [ebp - 0x78]
push 0x78
push eax
push esi
call 0xa44086c8
movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov esp, esi
enter 0xffffffffffffecc0, 3
push eax
push ecx
add edx, 0x25
push 0x40d453
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x74102ac]
add esp, 0xffffffb0
test eax, eax
dec esp
push eax
push 0x40e92e
dec dword [ebx + sym.imp.MSVCRT.dll_printf]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
ljmp 0x9090
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10002145
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x100021af
cmp word [ebx], di
je 0x100021af
cmp dword [ebp + 8], edi
je 0x100021af
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100021af
lea ecx, [esi + 0x10]
mov eax, ebx
call fcn.10001bed
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x2c]
call fcn.10001bed
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x100021b6
push edi
push edi
mov dword [ebp - 8], edi
call fcn.1000ecf3
add esp, 0x18
cmp eax, edi
je 0x100021aa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
jmp 0x100021b1
xor eax, eax
pop edi
leave
ret 4

Function at 0x10002c03
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
lea eax, [ebx + 2]
xor esi, esi
mov dword [ebp - 8], edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
push eax
call fcn.1000e3b8
pop ecx
mov ecx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jle 0x10002caa
cdq
push 3
pop ebx
idiv ebx
mov eax, dword [ebp - 4]
test edx, edx
jne 0x10002c4f
movzx edx, byte [eax + edi]
shr edx, 2
jmp 0x10002c95
cmp edx, 1
jne 0x10002c6f
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 3
shl edx, 4
shr ebx, 4
mov dl, byte [edx + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x10002c9b
cmp edx, 2
jne 0x10002c9f
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
movzx edx, byte [eax + edi]
inc esi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
inc esi
mov ebx, dword [ebp + 8]
inc eax
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x10002c39
cmp dword [ebp - 8], 1
jne 0x10002ccb
movzx eax, byte [edi + ebx - 1]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
jmp 0x10002ce3
cmp dword [ebp - 8], 2
jne 0x10002ce9
movzx eax, byte [edi + ebx - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x10002cf3
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b0]
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x3b4]
mov edi, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x70], ebx
cmp edi, ebx
je 0x10002dec
cmp word [edi], bx
je 0x10002dec
cmp eax, ebx
je 0x10002dec
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push ebx
push eax
call fcn.10012df0
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push str._s_s
lea eax, [ebp - 0x6c]
push 0x103
push eax
call fcn.1000efc3
xor eax, eax
push esi
mov word [ebp + 0x19c], ax
lea eax, [ebp + 0x19e]
push ebx
push eax
call fcn.10012df0
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
xor edi, edi
inc edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop esi
test eax, eax
jne 0x10002de7
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002de7
lea eax, [ebp + 0x19c]
push eax
push 0x1002548c
push 0x102
push dword [ebp - 0x7c]
call fcn.1000efc3
add esp, 0x10
mov dword [ebp - 0x70], edi
mov eax, dword [ebp - 0x70]
jmp 0x10002dee
xor eax, eax
mov ecx, dword [ebp + 0x3a4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x3a8
leave
ret

Function at 0x100030e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
mov eax, dword [ebp + 0x3b0]
xor ecx, ecx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], ecx
cmp eax, ecx
je 0x10003195
push ebx
push edi
mov ebx, str.Softwarehao123JuziBrowser
cmp dword [ebp + 0x3ac], ecx
jne 0x10003129
mov ebx, str.SoftwareJuziBrowser
xor eax, eax
push 0x40e
mov word [ebp - 0x70], ax
push ecx
lea eax, [ebp - 0x6e]
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10025578
xor edi, edi
push ebx
inc edi
push SysReAllocStringLen
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], 0x40e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000318e
cmp word [ebp - 0x70], ax
je 0x1000318e
lea eax, [ebp - 0x70]
push eax
push 0x1002548c
push 0x3e
push dword [ebp - 0x7c]
call fcn.1000efc3
add esp, 0x10
mov dword [ebp - 0x74], edi
mov eax, dword [ebp - 0x74]
pop edi
pop ebx
jmp 0x10003197
xor eax, eax
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
call fcn.1000e51f
add ebp, 0x3a4
leave
ret
Function at 0x10003404
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x3f90]
mov eax, 0x4010
call fcn.1001dd10
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x3f8c], eax
push ebx
xor ebx, ebx
test esi, esi
je 0x100034c8
test edi, edi
je 0x100034c8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100034c8
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100034c8
cmp eax, 0x2000
ja 0x100034c8
lea ecx, [ebp - 0x74]
push ecx
push eax
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100034c4
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10025620
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100034c4
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x10025624
push 0x3e
push edi
call fcn.1000efc3
add esp, 0x1c
inc ebx
mov eax, ebx
jmp 0x100034ca
xor eax, eax
mov ecx, dword [ebp + 0x3f8c]
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x3f90
leave
ret
Function at 0x1000363f
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5f4]
sub esp, 0x674
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x5f0], eax
push esi
push edi
xor esi, esi
push ebx
mov edi, ecx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000376b
xor eax, eax
push 0x40e
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x26]
push esi
push eax
call fcn.10012df0
add esp, 0xc
cmp edi, esi
je 0x100036ad
cmp word [edi], si
je 0x100036ad
push edi
push ebx
push str.__s___s
lea eax, [ebp - 0x28]
push 0x207
push eax
call fcn.1000efc3
add esp, 0x14
jmp 0x100036c4
push ebx
push str.__s_
lea eax, [ebp - 0x28]
push 0x207
push eax
call fcn.1000efc3
add esp, 0x10
xor eax, eax
push 0x206
mov word [ebp + 0x3e8], ax
lea eax, [ebp + 0x3ea]
push esi
push eax
call fcn.10012df0
push ebx
push 0x1002548c
lea eax, [ebp + 0x3e8]
push 0x103
push eax
call fcn.1000efc3
add esp, 0x1c
lea eax, [ebp + 0x3e8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.10012df0
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x3e8]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
push ebx
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10003768
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 1
call esi
push dword [ebp - 0x3c]
call esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 0x5f0]
pop edi
xor ecx, ebp
pop esi
call fcn.1000e51f
add ebp, 0x5f4
leave
ret
Function at 0x10003805
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5b0]
sub esp, 0x630
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x5ac], eax
mov eax, dword [ebp + 0x5b8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], ebx
cmp eax, ebx
je 0x100038ec
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp + 0x3a4], ax
lea eax, [ebp + 0x3a6]
push ebx
push eax
call fcn.10012df0
lea eax, [ebp + 0x3a4]
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], ebx
call fcn.10002e05
add esp, 0x10
test eax, eax
je 0x100038e6
cmp dword [ebp - 0x70], ebx
mov dword [ebp - 0x70], str.SoftwareJuziBrowser
jne 0x10003880
mov dword [ebp - 0x70], str.Softwarehao123JuziBrowser
xor eax, eax
push 0x40e
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push ebx
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
push str.accelsites
push dword [ebp - 0x70]
xor ebx, ebx
inc ebx
push SysReAllocStringLen
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], 0x40e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100038e6
cmp word [ebp - 0x6c], ax
je 0x100038e6
lea eax, [ebp - 0x6c]
push eax
push 0x1002548c
push edi
push dword [ebp - 0x80]
call fcn.1000efc3
add esp, 0x10
mov dword [ebp - 0x74], ebx
mov eax, dword [ebp - 0x74]
pop edi
jmp 0x100038ee
xor eax, eax
mov ecx, dword [ebp + 0x5ac]
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x5b0
leave
ret

Function at 0x10003980
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20106
push ebx
push 0
mov edi, str.SoftwareClassesCLSIDF552F265_6686_4422_84E5_C695E35D863AInprocServer32
push edi
mov esi, SysReAllocStringLen
push esi
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x100039bc
cmp dword [ebp - 4], ecx
jne 0x100039d9
push ecx
lea eax, [ebp - 4]
push eax
push ecx
push ebx
push ecx
push ecx
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100039fa
cmp dword [ebp - 4], eax
je 0x100039fa
xor ecx, ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push ecx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003a02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 2
pop edi
lea eax, [ebp - 4]
push eax
push 0x20119
xor esi, esi
push esi
push str.SoftwareClassesCLSIDF552F265_6686_4422_84E5_C695E35D863AInprocServer32
push SysReAllocStringLen
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003a52
cmp dword [ebp - 4], esi
je 0x10003a52
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100041bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
push edi
call fcn.1000ef72
pop ecx
push 4
mov ebx, eax
pop esi
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.insttm
push dword [edi + 0x1002d2a8]
mov dword [ebp - 0xc], esi
push SysReAllocStringLen
mov dword [ebp - 8], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 0
je 0x1000420b
cmp ebx, dword [ebp - 4]
jae 0x10004219
add edi, esi
cmp edi, 8
jb 0x100041d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
sub eax, dword [ebp - 4]
mov ecx, 0xe10
cmp eax, ecx
jae 0x1000422c
xor eax, eax
inc eax
jmp 0x10004214
xor edx, edx
div ecx
jmp 0x10004214

Function at 0x10004232
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x94
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1000431d
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
push 0x7e
pop ebx
mov edi, 0x10025578
xor eax, eax
push ebx
push eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xe]
push eax
call fcn.10012df0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1002d2a8]
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
push SysReAllocStringLen
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], ebx
call esi
test eax, eax
jne 0x100042b0
cmp word [ebp - 0x10], ax
jne 0x10004301
push 0x80
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push edi
push dword [eax + 0x1002d2a8]
mov dword [ebp - 0x18], 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ebx
call esi
cmp word [ebp - 0x10], 0
jne 0x10004301
add dword [ebp - 0x14], 4
cmp dword [ebp - 0x14], 8
jb 0x1000426a
jmp 0x10004312
push 0x3f
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call fcn.1000f120
add esp, 0xc
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
pop edi
pop esi
pop ebx
jmp 0x10004320
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.1000e51f
add ebp, 0x74
leave
ret
Function at 0x100045d1
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x1002c294]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
xor edi, edi
push esi
mov word [ebp + 0x194], ax
lea eax, [ebp + 0x196]
push edi
push eax
mov dword [ebp - 0x80], edi
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.SoftwareClassesJuziAgent.AgentCLSID
mov ebx, SysReAllocStringLen
push ebx
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x7c], esi
call edi
test eax, eax
jne 0x100047bd
lea eax, [ebp + 0x194]
push str.F552F265_6686_4422_84E5_C695E35D863A
push eax
call fcn.1000ea21
pop ecx
pop ecx
test eax, eax
jne 0x100047bd
push 0x208
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.10012df0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push str.SoftwareClassesCLSIDF552F265_6686_4422_84E5_C695E35D863AInprocServer32
push ebx
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x7c], esi
call edi
test eax, eax
jne 0x100047bd
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100047bd
xor eax, eax
push esi
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.10012df0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
mov ebx, 0x103
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [0x1002e828]
call edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.1000ea21
pop ecx
pop ecx
test eax, eax
jne 0x100047bd
mov dword [ebp - 0x80], 1
call fcn.10003904
test eax, eax
je 0x100047bd
xor eax, eax
push esi
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.10012df0
add esp, 0xc
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [0x1002e828]
call edi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.npJuziPlugin_x64.dll
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x74]
push eax
call edi
test eax, eax
je 0x100047bd
and dword [ebp - 0x80], 0
push 0x208
lea eax, [ebp + 0x194]
push 0
push eax
call fcn.10012df0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
xor ebx, ebx
lea eax, [ebp - 0x78]
inc ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], esi
call fcn.10003a02
add esp, 0x18
test eax, eax
jne 0x100047bd
lea eax, [ebp + 0x194]
push eax
call edi
test eax, eax
je 0x100047bd
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.1000ea21
pop ecx
pop ecx
test eax, eax
jne 0x100047bd
mov dword [ebp - 0x80], ebx
mov ecx, dword [ebp + 0x39c]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e51f
add ebp, 0x3a0
leave
ret