joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069f0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x14e4
call fcn.00442640
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x14e0], eax
push esi
push 0x208
lea eax, [esp + 0x210]
push 0
push eax
call fcn.0042f120
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x214]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360SafeTrashAutoScan.ini
lea edx, [esp + 0x210]
push edx
call esi
push 0x10ce
lea eax, [esp + 0x418]
push str.ie_chachesysid3210sysid3075sysid3205sysid3106sysid3103sysid3204sysid3102sysid6004sysid3201sysid6003sysid3008sysid3002sysid6009sysid5999sysid3208sysid6002sysid3005sysid3209sysid6000sysid3009sysid6008sysid4011sysid3207sysid3203sysid3107sysid3206sysid3202sysid6001sysid4067sysid3000sysid4070sysid2004sysid3403sys_quick_timesysid7003sysid7000sysid3402sysid4069sysid4083sysid3129sysid4022sys_360_loudongsysid3046sysid7004sysid7005sys_adobe_airsys_adobe_photoshopsys_apple_updatesys_avastsys_avgsys_antivir_desktopsys_daemon_toolssysid4012sysid4013sysid4057sysid4020sysid2040sys_flash_cachesysid3404sysid4064sysid4004sys_office_filessysid3406sys_office_recentsysid3020sysid4062sys_ms_silverlightsysid4065sysid4009sysid4099sysid4005sysid3052sysid6007sysid3105sysid6006sysid4006sysid4082sysid4014sysid4063sysid2009sysid3023sys_ms_windefendersys_ms_livesysid3022sysid3014sysid4002sysid4003sysid3024sysid3007sysid3004sysid3003sysid4084sysid4097sysid3051sysid7001sysid7009sysid3025sysid3405sysid3048sysid4016sysid2018sysid4061sysid3401sys_ks_loudongsysid3011sysid4010sysid3016sysid3018sysid3050sysid3130sysid4101sys_lu_loudongsysid3600sysid3012sysid3070sysid3128sys_nortonsysid3019sysid4095sysid7002sysid3104sys_qq_loudongsysid3079sysid4001sysid3043sysid3067sysid3044sysid3021sysid3045sysid3015sysid3013sys_tmpsys_thumbsys_mem_zhuanchusys_win_err_reportsys_update_filessys_iis_logssysid3131sysid3073sys_win_pre_readsysid3078sysid3072sys_logssys_invalid_lnksys_update_uninstall_filessysid3101sysid4030sysid4031sysid4032sysid4033sysid4034sysid4035sysid4024sysid4025sysid4026sysid4027sysid4028sysid4029sysid4023sysid3074sysid3076sysid3211sysid4036sysid4037sysid4038sysid4053sysid4054sysid4055sysid4056sysid4039sysid4059sysid4040sysid4041sysid4042sysid4043sysid4045sysid4046sysid4047sysid4048sysid4049sysid4050sysid4051sysid4052
push eax
call fcn.0042f8c0
add esp, 0xc
lea ecx, [esp + 0x20c]
push ecx
lea edx, [esp + 0x418]
push edx
push str.checked
push str.autoscan
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x208
lea eax, [esp + 8]
push 0
push eax
call fcn.0042f120
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....360Safe.exe
lea edx, [esp + 8]
push edx
call esi
lea eax, [esp + 4]
call fcn.00406ae0
mov ecx, dword [esp + 0x14e4]
pop esi
xor ecx, esp
call fcn.0042d98b
add esp, 0x14e4
ret
Function at 0x406ae0
Capabilities:
Create process on windows

Disassembly:
push ecx
push ebx
mov ebx, eax
call fcn.00406dc0
test eax, eax
je 0x406b23
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00407be0
add esp, 4
test eax, eax
jne 0x406b28
push esi
push 0x45f5a8
lea esi, [esp + 0xc]
call fcn.00407d00
pop esi
test eax, eax
je 0x406b23
cmp dword [esp + 4], 3
jne 0x406b28
xor eax, eax
pop ebx
pop ecx
ret
push 5
push 0
push str._funnameqinglilaji
push ebx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
pop ecx
ret

Function at 0x406ed0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x808], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0042f120
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x406f50
mov eax, 1
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0042d98b
add esp, 0x80c
ret
push str.360ver.dll
lea edx, [esp + 0xc]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406f36
push esi
lea eax, [esp + 0xc]
call fcn.00406e70
mov esi, eax
test esi, esi
jne 0x406f9b
lea eax, [esi + 1]
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0042d98b
add esp, 0x80c
ret
push edi
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x810]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0042d98b
add esp, 0x80c
ret

Function at 0x406fe0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1004
call fcn.00442640
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x1000], eax
push edi
push 0x1000
lea eax, [esp + 8]
push 0
push eax
call fcn.0042f120
add esp, 0xc
push 0x452b60
lea edi, [esp + 8]
call fcn.00406c80
push esi
call fcn.00406c80
push 0x452b68
call fcn.00406c80
push esi
call fcn.00406c80
push str.vL
call fcn.00406c80
push ebx
call fcn.00406c80
push 0x452bb8
call fcn.00406c80
push 0x14
push esi
mov ecx, edi
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
cmp eax, 6
jne 0x4070ad
push 0xc8
push 0x452a68
push str.http:__down.360safe.com_setup.exe
call fcn.0043060a
add esp, 0xc
test eax, eax
jne 0x407095
call fcn.00406ed0
test eax, eax
je 0x407095
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x4070a0
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call fcn.0042e910
int3
Function at 0x4070c0
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push esi
mov ebx, eax
call fcn.00406dc0
test eax, eax
je 0x40710b
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00407be0
add esp, 4
test eax, eax
jne 0x407102
push 0x45f5a8
lea esi, [esp + 0xc]
call fcn.00407d00
test eax, eax
je 0x40710b
cmp dword [esp + 8], 3
je 0x40710b
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40711a
pop esi
pop ebx
pop ecx
ret
mov esi, 0x45c558
call fcn.00406fe0
int3

Function at 0x40a440
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x40a4f8
cmp eax, 1
jne 0x40a46c
call fcn.0040a680
mov dword [edi], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x610
jne 0x40a486
call fcn.0040a6f0
mov dword [edi], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x611
jne 0x40a4a0
call fcn.0040a740
mov dword [edi], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x113
jne 0x40a4f3
cmp dword [ebp + 8], 0x258
jne 0x40a4e1
mov eax, dword [esi + 4]
push 0x258
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 4]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0xa4]
push 0
push 0
push 0x4fa
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [edi], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 0x10
je 0x40a4e1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40a6f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x2c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xa4]
mov dword [esi + 0xa8], 1
test eax, eax
je 0x40a736
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x4fa
push eax
call edi
mov ecx, dword [esi + 0xa4]
push 0
push 0
push 0x568
push ecx
call edi
pop edi
xor eax, eax
ret

Function at 0x412630
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [esi + 0x1d8], 0
je 0x412681
lea ecx, [esp + 4]
push ecx
push 0
push 0x27110000
push 0x412970
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.0042eeb8
add esp, 0x18
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x414090
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00417ea0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00417f40
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0042d98b
add esp, 0x68
ret
Function at 0x414220
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x453788
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4143b1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4142b3
cmp dword [esp + 0x14], 1
jne 0x414398
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x414398
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4142f8
cmp dword [esp + 0x14], 1
jne 0x414398
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x414398
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x41432f
cmp dword [esp + 0x14], 1
jne 0x414398
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x414398
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x414398
cmp dword [esp + 0x14], 3
jne 0x414398
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x414398
lea eax, [esi + 0xc]
call fcn.00414100
test eax, eax
je 0x414398
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4147e0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.004169d0
add esp, 8
test eax, eax
jne 0x41484b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0042d98b
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x414860
push esi
lea ecx, [esp + 0x14]
call fcn.00417ea0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00417f40
test edi, edi
je 0x41487e
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0042d98b
add esp, 0x6c
ret

Function at 0x4148c0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00416bd0
add esp, 4
test eax, eax
jne 0x41491e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0042d98b
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00417f40
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0042d98b
add esp, 0x64
ret

Function at 0x414940
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00416cc0
add esp, 8
test eax, eax
jne 0x4149bf
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0042d98b
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00417a80
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0042d98b
add esp, 0x74
ret

Function at 0x415310
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415342
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.00418d80
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x415367
push 0x45391c
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.00418eb0
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x416840
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x41688d
push str.GetFileSizeEx__
push 0x11e
push str..QHImageHlp.c
call fcn.00418d80
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x416924
jg 0x4168b3
cmp ebx, ecx
jb 0x416924
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4168e9
push str.SetFilePointerEx__
push 0xf9
push str..QHImageHlp.c
xor edx, edx
call fcn.00418d80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00415310
test eax, eax
je 0x4168df
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41690a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x416931
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x416931
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4171e0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x45a0f0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x417320
cmp dword [esp + 0x28], ebp
je 0x417320
push ebx
push 0x2800
call fcn.0042ddaf
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x417243
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0042d98b
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x417250
push edi
push str..PhysicalDrive_d
mov ecx, 0x2800
call fcn.004151a0
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4172f6
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.0042f120
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4172e9
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x4172e9
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push str.DISKID:
call fcn.00416f90
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x417300
inc edi
cmp edi, 0x10
jl 0x417250
push ebx
call fcn.0042de79
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0042d98b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0042d98b
add esp, 0x1c
ret
Function at 0x4173d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x41740a
cmp dword [esp + 0x34], esi
je 0x41740a
push 0x200
call fcn.0042ddaf
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x417415
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417574
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
jne 0x41750a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41746d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4174e3
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4174d8
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.00417340
cmp edx, edi
jb 0x4174d8
ja 0x4174d2
cmp eax, dword [esp + 0x24]
jbe 0x4174d8
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], 0x100
call ebp
test eax, eax
je 0x417460
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x417520
cmp dword [esp + 0x24], 0
jbe 0x417574
mov ecx, dword [esp + 0x24]
push edi
push ecx
push str._012I64X
mov ecx, 0x200
call fcn.004151a0
add esp, 0xc
test eax, eax
jne 0x417559
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.0042de79
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push str.MAC:
call fcn.00416f90
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.0042de79
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x41a320
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x444dbb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x45a0f0]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x45f9d8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.00431162
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x41a50d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41a3be
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.0042f120
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.0041a010
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x41a425
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x453e30
push eax
call fcn.0042e30a
add esp, 0xc
cmp eax, 1
jne 0x41a425
mov eax, dword [ebp - 0x14]
mov dword [0x45f9d8], eax
jmp 0x41a4f5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x41a43f
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x41a453
push ebx
push esi
call fcn.0041a770
jmp 0x41a455
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x45f9d8], eax
test eax, eax
jne 0x41a477
push 0x456c18
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.0042f41b
push eax
lea edx, [ebp + 0x84]
push 0x453e30
push edx
mov edi, 1
call fcn.0042dfe4
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.0041a150
test eax, eax
jne 0x41a4ee
push 0x456c18
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.0042f41b
call fcn.0041a1f0
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x45f9d8]
test esi, esi
je 0x41a4df
call fcn.0041a850
mov dword [0x45f9d8], 0
jmp 0x41a4e6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x41a4ec
ret
mov eax, dword [0x45f9d8]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x41a50d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x45f9d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.0042d98b
add ebp, 0xc8
mov esp, ebp
pop ebp
ret