joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42476f
Capabilities:
Get disk information

Disassembly:
push 0x58
mov eax, 0x5b5a45
call fcn.00598f94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x58], eax
movzx eax, word [ebp + 0xc]
push eax
xor ebx, ebx
push str.._c:
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.00404f66
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop ecx
pop ecx
push 0x20
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push dword [ebp - 0x58]
call edi
cmp eax, 1
jne 0x42481c
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
push str._08X
call fcn.00404f66
mov edi, dword [ebp - 0x60]
pop ecx
pop ecx
lea eax, [ebp - 0x54]
call fcn.0040a3cc
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
call fcn.00407b6b
xor eax, eax
inc eax
jmp 0x424897
movzx eax, word [ebp + 0xc]
push eax
push str._c:_
lea eax, [ebp - 0x58]
call fcn.00404f66
pop ecx
pop ecx
push 0x20
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push dword [ebp - 0x58]
call edi
cmp eax, 1
jne 0x42488a
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
push str._08X
call fcn.00404f66
mov edi, dword [ebp - 0x60]
pop ecx
pop ecx
lea eax, [ebp - 0x54]
call fcn.0040a3cc
mov eax, dword [ebp - 0x54]
add eax, 0xfffffff0
call fcn.00407b6b
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, ebx
call fcn.00599017
ret 8
Function at 0x42574a
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x141c]
mov eax, 0x149c
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x1418], eax
mov eax, dword [ebp + 0x1424]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x44], eax
cmp ebx, edi
je 0x4258a5
xor ecx, ecx
cmp cx, word [ebx]
je 0x4258a5
cmp eax, edi
je 0x4258a5
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x1008], ax
lea eax, [ebp + 0x100a]
push edi
push eax
call fcn.00596530
xor eax, eax
push esi
mov word [ebp + 0x1210], ax
lea eax, [ebp + 0x1212]
push edi
push eax
call fcn.00596530
push 0x38
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.00596530
lea eax, [ebp + 0x1008]
mov dword [ebp - 0x7c], eax
mov eax, 0x104
lea ecx, [ebp + 0x1210]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], eax
mov eax, ebx
mov dword [ebp - 0x70], ecx
add esp, 0x24
mov dword [ebp - 0x80], 0x3c
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x4257fc
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
sub eax, ecx
lea ecx, [ebp - 0x80]
push ecx
push edi
sar eax, 1
push eax
push ebx
call esi
cmp eax, edi
jne 0x42586d
xor eax, eax
push 0x1046
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push edi
push eax
call fcn.00596530
push ebx
push str.http:___s_
lea eax, [ebp - 0x40]
push 0x823
push eax
call fcn.0058f42f
lea eax, [ebp - 0x40]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x42584f
lea ecx, [ebp - 0x80]
push ecx
sub eax, edx
sar eax, 1
push edi
push eax
lea eax, [ebp - 0x40]
push eax
call esi
cmp eax, edi
je 0x4258a5
mov esi, dword [ebp + 0x1428]
lea eax, [esi + esi]
push eax
push edi
push dword [ebp - 0x44]
call fcn.00596530
lea eax, [ebp + 0x1210]
push eax
lea eax, [ebp + 0x1008]
push eax
push str._s:___s_favicon.ico
dec esi
push esi
push dword [ebp - 0x44]
call fcn.0058f42f
xor eax, eax
add esp, 0x20
inc eax
jmp 0x4258a7
xor eax, eax
mov ecx, dword [ebp + 0x1418]
pop edi
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x141c
leave
ret
Function at 0x425fc1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0xe52f
mov word [ebp - 0x30], ax
mov eax, 0x467c
mov word [ebp - 0x2e], ax
mov eax, 0x9614
mov word [ebp - 0x10], ax
mov eax, 0x4f35
mov word [ebp - 0xe], ax
mov eax, 0x4d5e
mov word [ebp - 0x20], ax
push esi
mov eax, 0x40bb
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0xbcde0395
mov byte [ebp - 0x2c], 0x8e
mov byte [ebp - 0x2b], 0x3d
mov byte [ebp - 0x2a], 0xc4
mov byte [ebp - 0x29], 0x57
mov byte [ebp - 0x28], 0x92
mov byte [ebp - 0x27], 0x91
mov byte [ebp - 0x26], 0x69
mov byte [ebp - 0x25], 0x2e
mov dword [ebp - 0x14], 0xa95664d2
mov byte [ebp - 0xc], 0xa7
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 0xa], 0xde
mov byte [ebp - 9], 0x8d
mov byte [ebp - 8], 0xb6
mov byte [ebp - 7], 0x36
mov byte [ebp - 6], 0x17
mov byte [ebp - 5], 0xe6
mov dword [ebp - 0x24], 0xbfa971f1
mov byte [ebp - 0x1c], 0x93
mov byte [ebp - 0x1b], 0x5e
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x39
mov byte [ebp - 0x17], 0xbf
mov byte [ebp - 0x16], 0xbe
mov byte [ebp - 0x15], 0xe4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x426137
mov eax, dword [ebp - 0x38]
cmp eax, esi
je 0x426137
lea edx, [ebp - 0x3c]
push edx
push 1
push esi
mov dword [ebp - 0x3c], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42612e
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x42612e
lea edx, [ebp - 0x40]
push edx
push esi
push 1
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x40], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x426125
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x426125
lea edx, [ebp - 0x44]
push edx
push esi
push 0x5e4e3c
mov dword [ebp - 0x44], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42611c
mov eax, dword [ebp - 0x44]
cmp eax, esi
je 0x42611c
mov ecx, dword [eax]
push esi
push dword [ebp + 8]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
neg esi
sbb esi, esi
push eax
inc esi
call dword [ecx + 8]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0058f3cf
leave
ret
Function at 0x426146
Capabilities:
Get hostname

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 2
mov dword [ebp - 0x80], 0x103
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x42619e
cmp word [ebp - 0x7c], si
je 0x42619e
inc esi
mov ecx, dword [ebp + 0x18c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x190
leave
ret

Function at 0x42626f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xfdc]
mov eax, 0x105c
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0xfd8], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push str.ProxyEnable
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push esi
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
mov dword [ebp - 0x7c], eax
xor eax, eax
push 0x1046
mov word [ebp - 0x70], ax
xor ebx, ebx
lea eax, [ebp - 0x6e]
push edi
inc ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.00596530
add esp, 0xc
push edi
push 0x5d0be4
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push str.AutoConfigURL
push esi
mov dword [ebp - 0x80], 0x823
mov dword [ebp - 0x74], edi
call sub.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jne 0x4262fc
cmp word [ebp - 0x70], di
je 0x4262fc
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x7c], edi
jne 0x42630a
cmp dword [ebp - 0x74], edi
jne 0x42630a
xor eax, eax
jmp 0x42630c
mov eax, ebx
mov ecx, dword [ebp + 0xfd8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0xfdc
leave
ret
Function at 0x42678e
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1ac]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1b0]
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x70]
push eax
push 0x5cd4d0
push 1
xor esi, esi
push esi
push 0x5cd620
mov dword [ebp - 0x70], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, esi
jl 0x4268b1
mov eax, dword [ebp - 0x70]
cmp eax, esi
je 0x4268b1
push ebx
mov dword [ebp - 0x74], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp - 0x78], esi
je 0x426813
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
push esi
push dword [ebp - 0x78]
push eax
call dword [ecx + 0x44]
xor eax, eax
push 0x206
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push esi
push eax
call fcn.00596530
mov eax, ebx
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x426830
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0058fee1
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0x6c]
push edx
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x7c], esi
je 0x426874
mov eax, dword [ebp - 0x70]
push dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0x74]
push edx
push 0x5cd7e0
push eax
call dword [ecx]
mov edi, eax
cmp edi, esi
jl 0x4268a8
mov eax, dword [ebp - 0x74]
cmp eax, esi
je 0x4268a8
mov ecx, dword [eax]
push 1
push dword [ebp - 0x80]
push eax
call dword [ecx + 0x18]
mov edi, eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x19c]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x1a0
leave
ret
Function at 0x426a69
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push 0x20
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x426aff
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x426af5
lea eax, [edi + 2]
push ebx
push eax
call fcn.0058e040
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x426af4
lea eax, [edi + 2]
push eax
push esi
push ebx
call fcn.00596530
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426aed
cmp edi, dword [ebp - 4]
jne 0x426aed
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 1
call fcn.0040c10d
push ebx
call fcn.0058f807
pop ecx
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x426b05
Capabilities:
Read file on windows

Disassembly:
push 0x28
mov eax, 0x5b593c
call fcn.00598f94
mov edi, ecx
xor esi, esi
push 0x5ddd69
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov ebx, edx
mov dword [ebp - 0x30], esi
call fcn.004050c6
push 0x5e23b8
lea eax, [ebp - 0x30]
push ebx
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x30], esi
call fcn.0059308d
add esp, 0xc
test eax, eax
je 0x426b63
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.004076da
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407567
mov eax, edi
jmp 0x426bea
push 2
push esi
push dword [ebp - 0x30]
call fcn.0059316a
push dword [ebp - 0x30]
call fcn.0059338c
push esi
push esi
push dword [ebp - 0x30]
mov ebx, eax
call fcn.0059316a
lea eax, [ebx + 1]
push eax
call fcn.0058e040
mov edi, eax
add esp, 0x20
cmp edi, esi
jne 0x426b9e
push dword [ebp - 0x30]
call fcn.00593912
jmp 0x426bcf
lea eax, [ebx + 1]
push eax
push esi
push edi
call fcn.00596530
push dword [ebp - 0x30]
push ebx
push 1
push edi
call fcn.0059369a
push dword [ebp - 0x30]
call fcn.00593912
add esp, 0x20
push edi
lea ecx, [ebp - 0x2c]
call fcn.004050a3
push edi
call fcn.0058f807
pop ecx
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
call fcn.004076da
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407567
mov eax, dword [ebp - 0x34]
call fcn.00599017
ret

Function at 0x4272ad
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4272f3
push esi
push 0x5dec60
push dword [ebp + 8]
call fcn.00593076
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 4], 0xfeff
test esi, esi
je 0x4272f2
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call fcn.00593819
push esi
call fcn.00593912
add esp, 0x14
pop esi
leave
ret
Function at 0x427465
Capabilities:
Create thread
Resume thread

Disassembly:
test ebx, ebx
je 0x427506
xor eax, eax
cmp ax, word [ebx]
je 0x427506
push esi
push 0x2214
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x427505
push ebx
mov ecx, 0x104
mov edx, esi
call fcn.004054f9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4274c0
xor ecx, ecx
cmp cx, word [eax]
je 0x4274c0
push eax
lea edx, [esi + 0x208]
mov ecx, 0x1000
call fcn.004054f9
mov eax, dword [esp + 8]
and dword [esi + 0x2210], 0
push 0
push 4
push esi
push 0x4272f5
mov dword [esi + 0x2208], eax
mov eax, dword [esp + 0x20]
push 0
push 0
mov dword [esi + 0x220c], eax
call fcn.005905f0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x427505
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x42769c
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
jne 0x4276ba
xor eax, eax
jmp 0x427735
cmp word [0x63f568], 0
push esi
mov esi, 0x63f568
jne 0x4276d6
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00596530
push edi
push esi
push 0x5dfc14
mov ecx, 0x105
lea edi, [ebp - 0x210]
call fcn.00405374
add esp, 0x18
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x427732
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427732
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0058f3cf
leave
ret
Function at 0x42791e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x63a5c8], 0
push ebx
mov ebx, eax
je 0x427938
test ebx, ebx
jne 0x4279e7
push esi
push edi
push 4
pop eax
push 0x64
pop edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5e2428
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
jne 0x4279b6
mov eax, dword [ebp - 4]
sub eax, 0x60
je 0x4279b3
sub eax, 0x18
je 0x4279aa
sub eax, 0x18
je 0x4279a1
sub eax, 0x30
je 0x427998
push 0x60
push edi
push dword [ebp - 4]
call esi
mov dword [ebp - 4], eax
jmp 0x4279b6
mov dword [ebp - 4], 0xc8
jmp 0x4279b6
mov dword [ebp - 4], 0x96
jmp 0x4279b6
mov dword [ebp - 4], 0x7d
jmp 0x4279b6
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
test ebx, ebx
jne 0x4279c9
test eax, eax
je 0x4279c5
cmp eax, edi
jne 0x4279e5
mov eax, edi
jmp 0x4279e5
test eax, eax
jbe 0x4279e3
cmp eax, edi
je 0x4279e3
cmp byte [ebp + 8], 0
je 0x4279dc
push eax
push ebx
push edi
jmp 0x4279df
push edi
push ebx
push eax
call esi
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4279ea
Capabilities:
Get mac address on windows
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0x1c
mov eax, 0x5b39c2
call fcn.00598f2b
mov ebx, ecx
mov esi, 0x288
push esi
mov dword [ebp - 0x1c], ebx
call fcn.0058e040
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x427a62
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, 0xfffe
ja 0x427bc7
push dword [ebp - 0x18]
call fcn.0058f807
push dword [ebp - 0x14]
call fcn.0058e040
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x427bc7
mov esi, dword [ebp - 0x18]
jmp 0x427bbf
lea edi, [esi + 8]
test edi, edi
je 0x427bbd
cmp byte [edi], 0
je 0x427bbd
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
lea eax, [ebp - 0x10]
push eax
call fcn.0040bdea
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.0041891d
push str.Connection
lea eax, [ebp - 0x10]
push eax
call fcn.0041891d
mov eax, 0x104
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp + 1]
push 0
push eax
mov dword [ebp - 0x24], 1
mov byte [ebp], 0
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x24]
push eax
push str.PnPInstanceId
push dword [ebp - 0x10]
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
push 3
push 0x5e24f8
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x427b1d
push 3
push 0x5e24fc
lea eax, [ebp]
push eax
call edi
test eax, eax
jne 0x427bae
mov eax, dword [ebx]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x427b31
push 0x5e2500
push ebx
call fcn.0041891d
cmp dword [esi + 0x190], edi
jbe 0x427ba4
mov eax, dword [0x63696c]
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
movzx eax, byte [esi + edi + 0x194]
push eax
push str._.2X
lea eax, [ebp - 0x20]
call fcn.0040c5ed
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
push dword [ebx - 0xc]
push ebx
call fcn.0040c427
cmp edi, dword [esi + 0x190]
jae 0x427b8c
push 0x5decb8
push dword [ebp - 0x1c]
call fcn.0041891d
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
call fcn.00407b6b
inc edi
cmp edi, dword [esi + 0x190]
jb 0x427b39
mov ebx, dword [ebp - 0x1c]
lea eax, [esi + 8]
push eax
push ebx
call fcn.0041891d
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov esi, dword [esi]
test esi, esi
jne 0x427a72
push dword [ebp - 0x18]
call fcn.0058f807
mov eax, dword [ebx]
pop ecx
xor ecx, ecx
cmp dword [eax - 0xc], ecx
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.0058f3cf
add ebp, 0x10c
leave
ret
Function at 0x428891
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x80
lea ebp, [esp - 4]
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x80], eax
push 8
mov eax, 0x5b4a34
call fcn.00598f2b
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00427bff
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ecx
mov edi, 0x80000001
je 0x428953
xor eax, eax
push 0x7e
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00596530
mov eax, dword [ebx - 0xc]
mov ecx, dword [ebp - 0x14]
push 0x3f
push eax
lea ebx, [ebp]
call fcn.0046fd60
add esp, 0x14
test eax, eax
je 0x428953
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x42892f
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push 0x5df64c
push str.Softwarehao123JuziBrowser
push edi
call esi
lea ecx, [ebp - 0x10]
call fcn.0042842a
mov ebx, dword [ebp - 0x10]
cmp dword [ebx - 0xc], 0
je 0x4289b7
xor eax, eax
push 0x7e
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00596530
mov eax, dword [ebx - 0xc]
mov ecx, dword [ebp - 0x10]
push 0x3f
push eax
lea ebx, [ebp]
call fcn.0046fd60
add esp, 0x14
test eax, eax
je 0x4289b7
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x428993
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push 0x5d0be4
push str.Softwarehao123JuziBrowser
push edi
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.0058f3cf
add ebp, 0x84
leave
ret
Function at 0x428a33
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x9c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x74]
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ebx
cmp eax, ebx
je 0x428b57
push esi
push edi
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x16]
push ebx
push eax
call fcn.00596530
xor esi, esi
inc esi
add esp, 0xc
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
cmp dword [ebp + 0x7c], ebx
jne 0x428ab2
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x5d0be4
push str.Softwarehao123JuziBrowser
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x428ab2
cmp word [ebp - 0x18], bx
jne 0x428b36
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x30]
push ecx
push ebx
push eax
push 0x4289f0
push ebx
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x493e0
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x428b27
push 0x80
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x5d0be4
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x18], bx
je 0x428b50
lea eax, [ebp - 0x18]
push eax
push 0x5db9e0
push dword [ebp + 0x78]
push dword [ebp - 0x2c]
call fcn.0058f42f
add esp, 0x10
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
pop edi
pop esi
jmp 0x428b59
xor eax, eax
mov ecx, dword [ebp + 0x68]
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0x6c
leave
ret