joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e6b0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4730e6
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov eax, dword [0x493014]
mov esi, ecx
push 0x2712
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.0041c740
mov ebx, dword [esp + 0x18]
push ebx
mov dword [esp + 0x234], 0
call fcn.0045cad1
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41e81e
mov ecx, dword [esi + 8]
call fcn.00425cf0
mov ecx, eax
call fcn.00425d40
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x41e75e
mov esi, eax
lea ecx, [esi - 0xc]
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41e776
mov edx, dword [0x493014]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.0041c290
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], 0
mov byte [esp + 0x230], 1
jne 0x41e7f3
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.0045bc00
push 0
push 0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push str.userid
push str.http:__my.360safe.com
mov dword [esp + 0x40], 0x100
call fcn.0041da30
lea eax, [esp + 0x48]
add esp, 0x24
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e7d0
sub eax, edx
sar eax, 1
je 0x41e7f3
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041c290
mov esi, dword [esp + 0x10]
push esi
call fcn.0045cad1
lea edx, [esi - 0xc]
add esp, 4
mov dword [esp + 0x14], eax
cmp edx, dword [0x493010]
je 0x41e81e
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x41e81e
push esi
call fcn.0045c814
add esp, 4
cmp dword [esp + 0x14], 0
jbe 0x41e86c
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.UserID
push str.Software360safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x41e86c
lea ecx, [ebx - 0xc]
cmp ecx, dword [0x493010]
je 0x41e865
lea esi, [ebx - 0xc]
push esi
call ebp
test eax, eax
jg 0x41e865
push esi
call fcn.0045c814
add esp, 4
mov eax, 1
jmp 0x41e88c
lea edx, [ebx - 0xc]
cmp edx, dword [0x493010]
je 0x41e88a
lea esi, [ebx - 0xc]
push esi
call ebp
test eax, eax
jg 0x41e88a
push esi
call fcn.0045c814
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0045bbec
add esp, 0x224
ret
Function at 0x41e8c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x473136
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x328]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x41ea64
mov ecx, esi
call fcn.0043e4a0
test eax, eax
je 0x41ea64
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041e0e0
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
mov dword [esp + 0x334], 0
call ebx
test eax, eax
je 0x41ea5b
mov eax, dword [0x493014]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov byte [esp + 0x334], 1
call fcn.0043f650
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x126]
push eax
mov word [esp + 0x128], dx
call fcn.0045bc00
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0x4841ac
push ecx
lea edx, [esp + 0x124]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x11c]
push eax
call ebx
test eax, eax
je 0x41ea68
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41ea68
call fcn.0043e7e0
mov esi, eax
test esi, esi
je 0x41ea68
xor ecx, ecx
push 0x7e
push ecx
lea edx, [esp + 0x26]
push edx
mov word [esp + 0x28], cx
call fcn.0045bc00
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0xb2]
push ecx
mov word [esp + 0xb4], ax
call fcn.0045bc00
mov edx, dword [esi]
mov edx, dword [edx + 0x60]
add esp, 0x18
push 0x40
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x124]
push ecx
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
push 0x40
lea ecx, [esp + 0xa0]
push ecx
push edi
push esi
call edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xa0]
push ecx
call fcn.0042d840
lea edx, [esp + 0x124]
push edx
mov esi, eax
call fcn.00401f60
add esp, 0xc
test esi, esi
jge 0x41ea68
cmp eax, 1
jne 0x41ea68
lea ecx, [esp + 0x14]
call fcn.0041a500
lea ecx, [esp + 0x18]
call fcn.0041a500
xor eax, eax
jmp 0x41ea92
push 0
lea eax, [esp + 0x120]
push eax
push edi
call fcn.0042dcb0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0041a500
lea ecx, [esp + 0x18]
call fcn.0041a500
mov eax, 1
mov ecx, dword [esp + 0x328]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0045bbec
add esp, 0x320
ret

Function at 0x41eac0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0045bc00
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 1
push 2
lea ecx, [esp + 0x10]
push ecx
push 0
call edi
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0041dc20
push 1
push 0x17
lea eax, [esp + 0x10]
push eax
push 0
call edi
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0041dc20
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.0045bbec
add esp, 0x804
ret
Function at 0x41edf0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4731db
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov eax, dword [esp + 0x158]
mov ebx, ecx
mov ecx, 6
mov esi, 0x47b71c
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], 0x104
lea esi, [esp + 0x24]
mov ecx, 0xd3a
mov edi, 0xd
mov dl, byte [esi]
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
imul ecx, ecx, 0x343fd
shr eax, 0x10
and eax, 0x7fff
movzx ebp, dl
sub dl, al
add ecx, 0x269ec3
mov byte [esi], dl
mov dl, byte [esi + 1]
mov eax, ecx
shr eax, 0x10
and eax, 0x7fff
movzx ebp, dl
sub dl, al
mov byte [esi + 1], dl
add esi, 2
sub edi, 1
jne 0x41ee70
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x20]
push eax
push str.ExeString
lea ecx, [esp + 0x34]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41eef4
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, 1
test eax, eax
jne 0x41eef8
mov edi, dword [esp + 0x14]
mov ecx, dword [ebx + 8]
call fcn.0043e5a0
mov esi, dword [eax]
cmp dword [esi - 0xc], 0
jl 0x41ef18
lea eax, [esi - 0xc]
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41ef30
mov ecx, dword [0x493014]
mov dword [esp + 0x14], ecx
push esi
lea ecx, [esp + 0x18]
call fcn.0041c290
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x15c]
push edx
mov edx, dword [esp + 0x20]
push eax
push edi
push ecx
push esi
push str.extVER:_sEC:_dPEG:_dTF:_dER:_d
push edx
mov dword [esp + 0x16c], 0
call fcn.0041e1e0
lea eax, [esi - 0xc]
add esp, 0x1c
cmp eax, dword [0x493010]
je 0x41ef89
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41ef89
push esi
call fcn.0045c814
add esp, 4
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.0045bbec
add esp, 0x140
ret 0x10
Function at 0x41f2a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x473268
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x41f2e0
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
mov eax, dword [0x493014]
mov dword [esp + 0xc], eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x20], 0
call fcn.0043f650
push str.Utils360Feedback.exe
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0041e280
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edi, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x493010]
je 0x41f34b
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x41f34b
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0045c814
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x493010]
je 0x41f374
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x41f374
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0045c814
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x41fad0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x473391
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x828]
mov dword fs:[0], eax
mov eax, dword [esp + 0x838]
mov edi, dword [esp + 0x83c]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [esp + 0x24], edi
mov dword [edi], ebx
call fcn.0041e550
sub eax, 0x8ca1
je 0x41fc3d
sub eax, 1
je 0x41fd16
sub eax, 2
je 0x41fd10
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x41fd16
call fcn.0043e7e0
mov edi, eax
cmp edi, ebx
je 0x41fd16
mov ecx, dword [0x493014]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x834], ebx
call fcn.0043f650
test eax, eax
je 0x41fc84
push 0x800
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.0045bc00
mov ecx, dword [esp + 0x24]
add esp, 0xc
push str.safemon360tray.exe
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, eax
mov dword [esp + 0x1c], ebx
test ebp, ebp
je 0x41fcb4
mov ecx, dword [0x493014]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x838]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x838], 1
call fcn.0041e4f0
mov ecx, 0x496cf8
call fcn.00441ee0
mov eax, dword [esp + 0x14]
mov ecx, dword [edi]
lea edx, [esp + 0x1c]
push edx
push 1
push 1
push 5
push eax
mov eax, dword [ecx + 0x24]
lea edx, [esp + 0x38]
push edx
push edi
call eax
test eax, eax
je 0x41fc91
mov eax, dword [esp + 0x1c]
cmp eax, 1
jne 0x41fc6c
mov ecx, 0x496cf8
call fcn.00441f30
lea ecx, [esp + 0x14]
call fcn.0041a500
lea ecx, [esp + 0x18]
call fcn.0041a500
mov eax, 1
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0045bbec
add esp, 0x820
ret 8
cmp eax, 0xffffffff
jne 0x41fc99
mov ecx, 0x496cf8
call fcn.00441f30
lea ecx, [esp + 0x14]
call fcn.0041a500
lea ecx, [esp + 0x18]
call fcn.0041a500
xor eax, eax
jmp 0x41fc42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, 0x496cf8
call fcn.00441f30
lea ecx, [esp + 0x14]
mov byte [esp + 0x830], 0
call fcn.0041a500
mov ecx, dword [esi + 8]
call fcn.0043e6e0
test eax, eax
je 0x41fc34
mov ecx, dword [0x493014]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x840], 2
call fcn.0041edf0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41fd01
mov edx, dword [esp + 0x14]
push edx
push 0
push 0x32d
call fcn.0043f8b0
mov eax, dword [esp + 0x20]
mov dword [eax], 1
jmp 0x41fc7b
mov dword [edi], 1
xor eax, eax
jmp 0x41fc42

Function at 0x41fd20
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0041cdb0
mov ecx, esi
call fcn.0041d060
mov ecx, esi
call fcn.0041d320
mov ecx, esi
pop esi
jmp fcn.0041eac0
Function at 0x41fd40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4733d6
mov eax, dword fs:[0]
push eax
sub esp, 0xa18
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0xa14], eax
push ebx
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0xa28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x41fee2
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x826]
push ecx
mov word [esp + 0x828], ax
call fcn.0045bc00
add esp, 0xc
mov ecx, esi
call fcn.004374f0
test eax, eax
je 0x41fee2
mov edx, dword [eax]
mov edx, dword [edx + 0x80]
push 0x104
lea ecx, [esp + 0x820]
push ecx
push eax
call edx
test eax, eax
je 0x41fee2
lea eax, [esp + 0x81c]
push eax
lea ecx, [esp + 0x14]
call fcn.0041e0e0
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0xa34], 0
call fcn.0041eb40
test eax, eax
lea ecx, [esp + 0x10]
sete bl
mov dword [esp + 0xa30], 0xffffffff
call fcn.0041a500
test bl, bl
jne 0x41fee2
push 0x800
lea edx, [esp + 0x20]
push 0
push edx
call fcn.0045bc00
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.DefaultSkin
push str.Software360safe
mov esi, 1
push SysReAllocString
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41fe92
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0041bee0
test eax, eax
je 0x41fe92
lea ecx, [esp + 0x1c]
push str.configdefaultskin
push ecx
call fcn.0045ca28
add esp, 8
test eax, eax
jne 0x41fee2
push str.config_
lea ecx, [esp + 0x14]
call fcn.0041e0e0
lea edx, [esp + 0x81c]
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0xa34], esi
call fcn.0041a7e0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
push esi
push str.DefaultSkin
push str.Software360safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [esp + 0x10]
call fcn.0041a500
mov ecx, dword [esp + 0xa28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa14]
xor ecx, esp
call fcn.0045bbec
add esp, 0xa24
ret
Function at 0x4203c0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x473470
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041fd40
mov ecx, esi
call fcn.0041f8b0
mov ecx, esi
call fcn.0041d510
mov ecx, dword [esi + 8]
call fcn.0043e5f0
mov edi, eax
test edi, edi
je 0x4204ce
mov eax, dword [edi]
mov ecx, dword [eax + 0x1c]
push edi
call ecx
test eax, eax
jne 0x420428
mov edx, dword [edi]
mov eax, dword [edx + 0x38]
push edi
call eax
test eax, eax
je 0x4204ce
mov eax, dword [0x493014]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0xbb
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.0041c830
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.0041c290
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x493010]
je 0x42048d
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42048d
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.0045c814
add esp, 4
mov eax, dword [esi + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
push 0x3443
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
push 0x419a20
push 0
push 0
call fcn.0045cc9c
add esp, 0x18
lea ecx, [esp + 0x10]
mov dword [esi + 4], eax
mov dword [esp + 0x24], 0xffffffff
call fcn.0041a530
mov ecx, dword [esi + 8]
call fcn.0043e4e0
cmp eax, 1
je 0x4204e0
cmp eax, 2
jne 0x4204e7
mov ecx, esi
call fcn.0041bb00
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x421aa0
Capabilities:
Delete file

Disassembly:
mov eax, 0x2024
call fcn.0045cb30
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x2020], eax
push esi
mov esi, dword [esp + 0x202c]
xor eax, eax
test esi, esi
je 0x421b34
push 0x2000
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x14], 3
call fcn.0045bc00
push 0x1000
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.0045cd4c
add esp, 0x18
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x2024]
pop esi
xor ecx, esp
call fcn.0045bbec
add esp, 0x2024
ret

Function at 0x421b60
Capabilities:
Delete file
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x20c
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x47ba74
push 0x47ba10
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0045bc00
add esp, 0xc
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x421bd0
push 0x47b9f0
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0045bbec
add esp, 0x20c
ret
Function at 0x421bf0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov eax, edx
push edi
lea esi, [eax + 2]
jmp 0x421c00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421c00
sub eax, esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sar eax, 1
add eax, eax
push eax
push edx
push 1
push str.adcount
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x10]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421c35
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push ecx
push 1
push str.plugcount
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x14]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421c65
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push str.stylecount
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x18]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421c94
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push ecx
push 1
push str.new0
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x1c]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421cc4
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push str.new1
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x20]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421cf3
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push ecx
push 1
push str.new2
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x24]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421d23
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ecx
push 1
push str.ctext
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x28]
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x421d52
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push ecx
push 1
push str.curl
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edx, dword [esp + 0x2c]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421d82
sub eax, edi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push str.urlver
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
pop edi
mov eax, 1
pop esi
ret 0x24
Function at 0x421dc0
Capabilities:
Check if file exists
Copy file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
push esi
test eax, eax
je 0x421f62
mov esi, dword [esp + 0x30]
test esi, esi
je 0x421f62
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421de0
sub eax, edx
push ebx
sar eax, 1
mov ebx, eax
push ebp
mov eax, esi
push edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421e00
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
xor ecx, ecx
lea eax, [ebx + ebx + 2]
mov edx, 2
xor esi, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044b4e0
mov ebp, eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
lea eax, [eax + eax + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044b4e0
add esp, 8
mov edi, eax
test ebp, ebp
je 0x421f49
test edi, edi
je 0x421f40
mov eax, dword [esp + 0x38]
mov edx, ebp
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x421e70
xor eax, eax
mov word [ebp + ebx*2], ax
mov eax, dword [esp + 0x3c]
xor ecx, ecx
mov edx, edi
mov word [ebp + ebx*2 + 2], cx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x421e95
mov eax, dword [esp + 0x10]
xor edx, edx
xor ecx, ecx
mov word [edi + eax*2], dx
mov word [edi + eax*2 + 2], cx
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421ec0
sub eax, edx
sar eax, 1
je 0x421ee5
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421ee5
push edi
call fcn.00442390
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x30], ax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x2e], eax
lea eax, [esp + 0x14]
mov edx, 0x614
push eax
mov word [esp + 0x28], dx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebp
call fcn.0045c814
add esp, 4
test edi, edi
je 0x421f56
push edi
call fcn.0045c814
add esp, 4
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x24
ret 8
xor eax, eax
pop esi
add esp, 0x24
ret 8