joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434875
Capabilities:
Get session user name
List groups for user account

Disassembly:
push ebp
sub esp, 0x880
lea ebp, [esp - 4]
mov eax, dword [0x48b990]
xor eax, ebp
mov dword [ebp + 0x880], eax
push 0xac
mov eax, 0x4605d1
call fcn.0045ced8
lea ecx, [ebp - 0x58]
call sub.ccL80U.dll_Ordinal_1647
xor ebx, ebx
push 0x7fe
lea eax, [ebp + 0x62]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x11], bl
mov word [ebp + 0x60], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2c], 0x400
call fcn.00446444
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004465c5
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x60]
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x43493f
cmp byte [ebp - 0x17], bl
je 0x434903
lea ecx, [ebp - 0x18]
call fcn.0044644e
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00458790
lea ecx, [ebp - 0x58]
call sub.ccL80U.dll_Ordinal_1648
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x880]
xor ecx, ebp
call fcn.0045ce96
add ebp, 0x884
leave
ret
cmp byte [ebp - 0x17], bl
je 0x43494c
lea ecx, [ebp - 0x18]
call fcn.0044644e
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
lea eax, [ebp + 0x60]
push eax
push ebx
call sub.NETAPI32.dll_NetUserGetLocalGroups
cmp eax, ebx
jne 0x4349d5
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x28]
jae 0x4349c8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
push ebx
push dword [eax + ecx*4]
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004347d6
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 3
call fcn.0042c841
pop ecx
push eax
lea eax, [ebp]
push eax
call fcn.0042b39c
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
mov byte [ebp - 0x19], al
call fcn.0042c80b
cmp byte [ebp - 0x19], bl
lea ecx, [ebp]
je 0x4349e0
mov byte [ebp - 0x11], 1
call fcn.0042c80b
cmp dword [ebp - 0x24], ebx
je 0x4349d5
push dword [ebp - 0x24]
call sub.NETAPI32.dll_NetApiBufferFree
mov al, byte [ebp - 0x11]
mov byte [ebp - 0x11], al
jmp 0x434906
call fcn.0042c80b
mov dword [ebp - 4], 1
jmp 0x434a5a
inc dword [ebp - 0x20]
jmp 0x43496e
Function at 0x4365c7
Capabilities:
Delete registry key

Disassembly:
push 0x10
mov eax, 0x4608b5
call fcn.0045cea5
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x2001f
push str.SOFTWARESymantecNSSCmdLine
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], al
call fcn.00402e79
test eax, eax
jne 0x436742
mov eax, dword [0x488018]
mov edi, 0x488018
cmp eax, edi
mov ebx, 0x46e4ec
je 0x436632
test byte [eax + 0x1c], 1
je 0x436632
cmp byte [eax + 0x19], 4
jb 0x436632
push str.NSSCmdLine
push ebx
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004070b8
add esp, 0x14
mov esi, 0x4704a0
push esi
lea ecx, [ebp - 0x1c]
call fcn.004081a9
mov ecx, dword [ebp + 8]
mov eax, 0x104
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], eax
call fcn.0040384e
lea ecx, [ebp - 0x18]
push ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00421374
test eax, eax
jne 0x436686
mov eax, dword [0x488018]
cmp eax, edi
je 0x4366ad
test byte [eax + 0x1c], 1
je 0x4366ad
cmp byte [eax + 0x19], 4
jb 0x4366ad
mov ecx, dword [ebp + 8]
push dword [ecx]
push ebx
push 0x25
jmp 0x43669f
mov eax, dword [0x488018]
cmp eax, edi
je 0x4366ad
test byte [eax + 0x1c], 1
je 0x4366ad
cmp byte [eax + 0x19], 4
jb 0x4366ad
push esi
push ebx
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004070b8
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402e14
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 0xd], 1
call fcn.00402703
push 0x2001f
push dword [0x489798]
lea ecx, [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402e79
test eax, eax
jne 0x436794
mov eax, dword [0x488018]
cmp eax, edi
je 0x436710
test byte [eax + 0x1c], 1
je 0x436710
cmp byte [eax + 0x19], 4
jb 0x436710
push dword [0x489798]
push ebx
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004070b8
add esp, 0x14
push str.NSSCmdLine
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x436768
mov eax, dword [0x488018]
cmp eax, edi
je 0x436794
test byte [eax + 0x1c], 1
je 0x436794
cmp byte [eax + 0x19], 4
jb 0x436794
push dword [0x4897a4]
push ebx
push 0x29
jmp 0x436786
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x436794
test byte [eax + 0x1c], 1
je 0x436794
cmp byte [eax + 0x19], 4
jb 0x436794
push str.NSSCmdLine
push 0x46e4ec
push 0x27
jmp 0x436786
mov eax, dword [0x488018]
cmp eax, edi
je 0x436794
test byte [eax + 0x1c], 1
je 0x436794
cmp byte [eax + 0x19], 4
jb 0x436794
push dword [0x4897a4]
push ebx
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004070b8
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00402e14
mov al, byte [ebp - 0xd]
call fcn.0045cf7d
ret 4
Function at 0x436f61
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x460a0d
call fcn.0045cea5
mov edi, ecx
push str.CScannerApp::SetProductPatchedKey
lea ecx, [ebp - 0x1c]
call fcn.00407111
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push dword [0x4897a4]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004081a9
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0043234c
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.00407e2a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402703
push 0x2001f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402e79
test eax, eax
jne 0x437069
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.ProductUpgrade
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43703c
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x437069
test byte [eax + 0x1c], 1
je 0x437069
cmp byte [eax + 0x19], 2
jb 0x437069
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x488018]
push 0x46e4ec
push 0x79
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
jmp 0x437069
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x437069
test byte [eax + 0x1c], 1
je 0x437069
cmp byte [eax + 0x19], 4
jb 0x437069
push 0x46e4ec
push 0x7a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00402e14
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402703
lea ecx, [ebp - 0x10]
call fcn.00402e14
lea ecx, [ebp - 0x1c]
call fcn.00407157
call fcn.0045cf7d
ret 4
Function at 0x437094
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x460a0d
call fcn.0045cea5
mov edi, ecx
push str.CScannerApp::SetUpdatedWelcomeScreen
lea ecx, [ebp - 0x1c]
call fcn.00407111
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push dword [0x4897a4]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004081a9
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0043234c
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.00407e2a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402703
push 0x2001f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402e79
test eax, eax
jne 0x4371a4
mov eax, dword [ebp + 8]
push 4
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.UpdatedWelcomeScreen
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43716f
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43719c
test byte [eax + 0x1c], 1
je 0x43719c
cmp byte [eax + 0x19], 2
jb 0x43719c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x488018]
push 0x46e4ec
push 0x7b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
jmp 0x43719c
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43719c
test byte [eax + 0x1c], 1
je 0x43719c
cmp byte [eax + 0x19], 4
jb 0x43719c
push 0x46e4ec
push 0x7c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00402e14
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402703
lea ecx, [ebp - 0x10]
call fcn.00402e14
lea ecx, [ebp - 0x1c]
call fcn.00407157
call fcn.0045cf7d
ret 4
Function at 0x437957
Capabilities:
Get geographical location

Disassembly:
push 0x18
mov eax, 0x460af9
call fcn.0045cea5
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43799b
test byte [eax + 0x1c], 1
je 0x43799b
cmp byte [eax + 0x19], 4
jb 0x43799b
push 0x46e4ec
push 0x9e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
cmp byte [ebp + 0x10], bl
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
mov esi, 0x400
push ebx
je 0x4379b1
push 0x20
jmp 0x4379b3
push 0x1f
push esi
call edi
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x437a44
inc eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0042aedb
cmp byte [ebp + 0x10], bl
push dword [ebp - 0x14]
push dword [ebp - 0x10]
je 0x4379da
push 0x20
jmp 0x4379dc
push 0x1f
push esi
call edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.0042a74c
push ebx
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov edi, eax
cmp edi, ebx
je 0x437a44
mov dword [ebp + 0x10], ebx
lea eax, [edi + 1]
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.0042aedb
mov eax, dword [ebp + 0x10]
push edi
push eax
push dword [ebp - 0x10]
mov word [eax + edi*2], bx
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.00404494
push dword [ebp + 0x10]
mov byte [ebp - 4], bl
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x437a76
mov ecx, dword [ebp + 8]
push 0x46c6dc
lea eax, [ebp + 0x10]
push eax
call fcn.004161f8
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00415c61
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402703
push dword [ebp - 0x10]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.0045cf7d
ret 0xc
Function at 0x437a87
Capabilities:
Get geographical location

Disassembly:
push 0x1c
mov eax, 0x460b2c
call fcn.0045cea5
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x437acb
test byte [eax + 0x1c], 1
je 0x437acb
cmp byte [eax + 0x19], 4
jb 0x437acb
push 0x46e4ec
push 0x9f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
push ebx
push 0x1003
mov esi, 0x400
push esi
call edi
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x437b5e
inc eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0042aedb
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x1003
push esi
call edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.0042a74c
mov edi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push ebx
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x437b5e
mov dword [ebp - 0x14], ebx
inc eax
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042aedb
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
push ebx
push esi
call edi
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.00404494
push dword [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x437b90
mov ecx, dword [ebp + 8]
push 0x46c6dc
lea eax, [ebp + 0xc]
push eax
call fcn.004161f8
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00415c61
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402703
push dword [ebp - 0x10]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.0045cf7d
ret 8
Function at 0x437c96
Capabilities:
Set registry value

Disassembly:
push 0x64
mov eax, 0x460b57
call fcn.0045cf44
lea ecx, [ebp - 0x64]
call sub.ccL80U.dll_Ordinal_1647
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], esi
push dword [0x4897a4]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.004081a9
push 0x2001f
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402e79
test eax, eax
jne 0x437d3a
mov eax, dword [ebp + 8]
push 4
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 4
push esi
push str.DontShow
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x437d3a
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x437d3a
test byte [eax + 0x1c], 1
je 0x437d3a
cmp byte [eax + 0x19], 4
jb 0x437d3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x488018]
push 0x46e4ec
push 0xaf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
lea ecx, [ebp - 0x38]
call fcn.00402e14
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402703
lea ecx, [ebp - 0x38]
call fcn.00402e14
lea ecx, [ebp - 0x64]
call sub.ccL80U.dll_Ordinal_2508
test al, al
je 0x437ea0
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x437d95
test byte [eax + 0x1c], 1
je 0x437d95
cmp byte [eax + 0x19], 2
jb 0x437d95
push 0x46e4ec
push 0xb0
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
xor bl, bl
lea ecx, [ebp - 0x64]
call sub.ccL80U.dll_Ordinal_1648
mov al, bl
call fcn.0045cfa0
ret 4
mov bl, 1
jmp 0x437d97

Function at 0x438109
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x460bf2
call fcn.0045cea5
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call fcn.004337e6
test al, al
jne 0x43813e
lea ecx, [ebp - 0x10]
call fcn.00402e14
mov al, bl
call fcn.0045cf7d
ret 4
mov eax, dword [ebp + 8]
dec eax
dec eax
je 0x4381a5
dec eax
jne 0x4381c4
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push str.LastLaunchMonth
push dword [ebp - 0x10]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x438198
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x4381c4
test byte [eax + 0x1c], 1
je 0x4381c4
cmp byte [eax + 0x19], 2
jb 0x4381c4
push 0x46e4ec
push 0xbd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
jmp 0x4381c4
push 4
mov ecx, esi
mov bl, 1
call fcn.00433b5b
jmp 0x4381c4
lea eax, [ebp + 8]
push eax
push str.LastLaunchMonth
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
call fcn.0041ed51
test eax, eax
jne 0x4381c4
cmp dword [ebp + 8], ebx
je 0x4381c4
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.00402e14
jmp 0x43812c
Function at 0x4381d1
Capabilities:
Set registry value

Disassembly:
push 0x18
mov eax, 0x460c1d
call fcn.0045cea5
push str.CScannerApp::IsInstallStubTracesPresent
lea ecx, [ebp - 0x20]
call fcn.00407111
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push dword [0x4897a4]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004081a9
push 0x2001f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402e79
test eax, eax
je 0x438273
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43824e
test byte [eax + 0x1c], bl
je 0x43824e
cmp byte [eax + 0x19], 4
jb 0x43824e
push 0x46e4ec
push 0xbe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
xor bl, bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402703
lea ecx, [ebp - 0x14]
call fcn.00402e14
lea ecx, [ebp - 0x20]
call fcn.00407157
mov al, bl
call fcn.0045cf7d
ret
lea eax, [ebp - 0x18]
push eax
mov esi, str.CleanInstallStub
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], 0
call fcn.0041ed51
test eax, eax
je 0x4382df
mov eax, dword [ebp - 0x18]
push 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4382e4
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x4382e7
test byte [eax + 0x1c], bl
je 0x4382e7
cmp byte [eax + 0x19], 4
jb 0x4382e7
push 0x46e4ec
push 0xbf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
jmp 0x4382e7
cmp dword [ebp - 0x18], ebx
jne 0x4382e7
mov byte [ebp - 0xd], bl
lea ecx, [ebp - 0x14]
call fcn.00402e14
mov bl, byte [ebp - 0xd]
jmp 0x438250
Function at 0x4386cc
Capabilities:
Set registry value

Disassembly:
push 0x14
mov eax, 0x460c93
call fcn.0045cea5
mov esi, ecx
push str.CScannerApp::CreateProdDetectionEntry
lea ecx, [ebp - 0x1c]
call fcn.00407111
and dword [ebp - 4], 0
mov ecx, esi
xor edi, edi
call fcn.0042b5c4
mov ecx, esi
mov byte [ebp - 0xd], al
call fcn.0042b60e
test al, al
je 0x438711
mov ecx, esi
call fcn.0042b658
test al, al
je 0x438711
mov al, 1
jmp 0x438713
xor al, al
cmp byte [ebp - 0xd], 0
je 0x438728
xor ecx, ecx
test al, al
setne cl
lea ecx, [ecx + ecx + 1]
mov edi, ecx
jmp 0x43872f
test al, al
je 0x43872f
push 2
pop edi
and dword [ebp - 0x14], 0
push dword [0x4897a4]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004081a9
push 0x2001f
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402e79
test eax, eax
je 0x438797
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x4387ee
test byte [eax + 0x1c], 1
je 0x4387ee
cmp byte [eax + 0x19], 2
jb 0x4387ee
push dword [ebp - 0x18]
push 0x46e4ec
push 0xcf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004070b8
add esp, 0x14
jmp 0x4387ee
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.ProductDetected
push dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4387e6
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x4387e6
test byte [eax + 0x1c], 1
je 0x4387e6
cmp byte [eax + 0x19], 4
jb 0x4387e6
push 0x46e4ec
push 0xd0
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.00402e14
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402703
lea ecx, [ebp - 0x14]
call fcn.00402e14
lea ecx, [ebp - 0x1c]
call fcn.00407157
call fcn.0045cf7d
ret
Function at 0x43d10e
Capabilities:
Get geographical location

Disassembly:
push 0x124
mov eax, 0x4613b3
call fcn.0045cf0e
push str.http:__security.symantec.com_pfb_pFeedback_form.asp_gopfb
lea ecx, [ebp - 0x20]
call fcn.004081a9
and dword [ebp - 4], 0
push str.products
lea ecx, [ebp - 0x20]
call fcn.0040811d
push 0x466900
lea ecx, [ebp - 0x20]
call fcn.0040811d
push str.versions
lea ecx, [ebp - 0x20]
call fcn.0040811d
push 0x46bfa4
lea ecx, [ebp - 0x130]
call fcn.0041f4f2
push dword [eax]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004081a9
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x130], eax
mov byte [ebp - 4], 3
je 0x43d192
push dword [ebp - 0x130]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [ebp - 0x24]
push dword [eax - 0xc]
lea ecx, [ebp - 0x20]
push eax
call fcn.00407e2a
push str.oslocale
lea ecx, [ebp - 0x20]
call fcn.0040811d
push 0xa
lea eax, [ebp - 0x1c]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 4
lea eax, [ebp - 0x1c]
push eax
push 3
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x43d22c
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43d20e
test byte [eax + 0x1c], 1
je 0x43d20e
cmp byte [eax + 0x19], 2
jb 0x43d20e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x488018]
push 0x46e4ec
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
lea eax, [ebp - 0x1c]
push 0x471070
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
call fcn.004081a9
mov eax, dword [ebp - 0x28]
push dword [eax - 0xc]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 4
call fcn.00407e2a
push str.partnerid
lea ecx, [ebp - 0x20]
call fcn.0040811d
mov ecx, dword [0x48be0c]
lea eax, [ebp - 0x2c]
push eax
call fcn.0043234c
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00415f96
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00402703
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0043bb85
cmp dword [0x48be0c], 0
pop ecx
pop ecx
mov edi, eax
je 0x43d2b6
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.FEEDBACK
call fcn.004081a9
mov ecx, dword [0x48be0c]
call fcn.0043693e
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00402703
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402703
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402703
mov eax, edi
call fcn.0045cf91
ret
Function at 0x43e89e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push 0x2001f
push dword [0x48a418]
mov esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
call fcn.00402e79
test eax, eax
jne 0x43e9d5
mov eax, dword [esi + 0xa4]
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.LevelMed
push dword [ebp - 4]
call edi
test eax, eax
mov ebx, 0x47122c
je 0x43e921
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43e950
test byte [eax + 0x1c], 1
je 0x43e950
cmp byte [eax + 0x19], 4
jb 0x43e950
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x488018]
push ebx
push 0x76
jmp 0x43e942
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43e950
test byte [eax + 0x1c], 1
je 0x43e950
cmp byte [eax + 0x19], 4
jb 0x43e950
push dword [esi + 0xa4]
push ebx
push 0x77
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
mov eax, dword [esi + 0xa0]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.LevelHigh
push dword [ebp - 4]
call edi
test eax, eax
je 0x43e99a
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43e9c9
test byte [eax + 0x1c], 1
je 0x43e9c9
cmp byte [eax + 0x19], 4
jb 0x43e9c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x488018]
push ebx
push 0x78
jmp 0x43e9bb
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43e9c9
test byte [eax + 0x1c], 1
je 0x43e9c9
cmp byte [eax + 0x19], 4
jb 0x43e9c9
push dword [esi + 0xa0]
push ebx
push 0x79
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
lea ecx, [ebp - 4]
call fcn.00402e14
pop edi
pop ebx
jmp 0x43ea02
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x43ea02
test byte [eax + 0x1c], 1
je 0x43ea02
cmp byte [eax + 0x19], 2
jb 0x43ea02
push 0x47122c
push 0x7a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.00402e14
pop esi
leave
ret