joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419a10
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x80
mov eax, dword [0x4be8a0]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0041ab80
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x94]
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
mov dword [esp + 0x2c], 0xc3d2e1f0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x78], ebx
call fcn.0041b8f0
add esp, 4
lea eax, [esp + 0x18]
lea ecx, [esp + 0x78]
call fcn.0041b9d0
mov dword [esp + 0x10], ebx
jmp 0x419ab0
movzx ebx, byte [esp + ebx + 0x78]
mov eax, ebx
shr eax, 4
movzx ecx, word [eax*2 + str.0123456789abcdef]
mov eax, dword [esi]
mov ebp, dword [eax - 0xc]
mov edx, 1
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebp + 1]
sub eax, edi
or edx, eax
mov dword [esp + 0x14], ecx
jge 0x419ae8
mov ecx, edi
mov eax, esi
call fcn.0041b410
mov ecx, dword [esi]
mov dx, word [esp + 0x14]
mov word [ecx + ebp*2], dx
test edi, edi
jl 0x419b81
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x419b81
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + edi*2], cx
mov eax, dword [esi]
and ebx, 0xf
movzx ebp, word [ebx*2 + str.0123456789abcdef]
mov ebx, dword [eax - 0xc]
mov edx, 1
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebx + 1]
sub eax, edi
or edx, eax
jge 0x419b3a
mov ecx, edi
mov eax, esi
call fcn.0041b410
mov ecx, dword [esi]
mov word [ecx + ebx*2], bp
test edi, edi
jl 0x419b81
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x419b81
mov ebx, dword [esp + 0x10]
mov dword [eax - 0xc], edi
mov edx, dword [esi]
inc ebx
xor eax, eax
mov word [edx + edi*2], ax
mov dword [esp + 0x10], ebx
cmp ebx, 0x14
jb 0x419ab0
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046711a
add esp, 0x80
ret
push 0x80070057
call fcn.0040253a
int3
Function at 0x419e90
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x48c808
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4be8a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x14]
push eax
push 0x202
push ebx
push str.SOFTWARE360SafeLiveup
mov dword [esp + 0x38], ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x419f9c
mov eax, dword [esi]
mov edi, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x200
je 0x419f4e
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x419f25
push 0x80004005
call fcn.0040253a
push ecx
push eax
call fcn.00467c8a
add esp, 8
test eax, eax
je 0x419f4e
mov esi, dword [esi]
test esi, esi
je 0x419f4e
push esi
call ebp
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push str.m2_old
push edi
call ebx
mov eax, dword [esp + 0x30]
mov esi, dword [eax]
test esi, esi
jne 0x419f5d
lea eax, [esi + 0xd]
jmp 0x419f72
push esi
call ebp
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push 0x4a36b0
push edi
call ebx
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test edi, edi
je 0x419f86
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x41b790
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b7fe
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x41b7cf
cmp eax, 2
jne 0x41b7ea
mov eax, dword [esp]
test esi, esi
je 0x41b7f8
test eax, eax
je 0x41b7f3
test al, 1
jne 0x41b7ea
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x41b7f8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x41d250
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x454
mov eax, dword [0x4be8a0]
xor eax, esp
mov dword [esp + 0x44c], eax
mov eax, dword [esp + 0x458]
push ebx
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x468]
push edi
mov dword [eax], ebp
mov dword [esp + 0x30], ecx
mov dword [ecx], ebp
lea ecx, [esp + 0x28]
push ecx
push 8
push ebp
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x41d2b8
mov edi, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x24], eax
jmp 0x41d2c4
xor eax, eax
jmp 0x41d3e6
mov edi, dword [esp + 0x38]
lea edx, [esp + 0x40]
push edx
push ebp
push ebp
push ebp
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x264]
push edx
push eax
mov esi, 0x104
push edi
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41d3d2
lea eax, [esp + 0x20]
push eax
push 1
push ebp
lea ecx, [esp + 0x25c]
push ecx
push edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x1c], ebp
cmp eax, ebp
jne 0x41d365
mov ebx, dword [esp + 0x20]
push str.NetCfgInstanceId
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esi
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x50]
mov dword [esp + 0x20], ebx
call fcn.0041b790
test eax, eax
jne 0x41d352
mov eax, dword [esp + 0x34]
push eax
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x41d37b
cmp ebx, ebp
je 0x41d361
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x100
mov dword [esp + 0x24], eax
jl 0x41d2c0
jmp 0x41d3d2
push str.BusType
lea edx, [esp + 0x1c]
push edx
lea edi, [esp + 0x1c]
lea esi, [esp + 0x50]
mov dword [esp + 0x1c], 0x104
call fcn.0041b790
test eax, eax
jne 0x41d3c7
mov eax, esi
push eax
call fcn.004689e7
add esp, 4
cmp eax, 5
jne 0x41d3c7
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [ecx], 1
push edx
mov ecx, ebx
call fcn.0041d120
add esp, 4
cmp ebx, ebp
je 0x41d3d2
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x41d3e1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046711a
add esp, 0x454
ret
Function at 0x41f5eb
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1fa4]
mov eax, 0x2024
call fcn.00467130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1fa0], eax
push esi
mov esi, dword [ebp + 0x1fac]
test esi, esi
jne 0x41f619
xor eax, eax
jmp 0x41f672
push 0x1e
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004670a0
xor eax, eax
push 0x1ffe
push eax
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push eax
call fcn.004670a0
push 0xfff
lea eax, [ebp - 0x60]
push esi
push eax
mov dword [ebp - 0x7c], 3
call fcn.00467050
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
mov eax, 0x614
mov word [ebp - 0x70], ax
add esp, 0x24
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x1fa0]
xor ecx, ebp
pop esi
call fcn.0046711a
add ebp, 0x1fa4
leave
ret

Function at 0x41f76a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x41f7e2
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x41f7cf
lea eax, [ebp - 0x20c]
push 0x49090c
push eax
call fcn.00467c8a
pop ecx
pop ecx
test eax, eax
je 0x41f7d5
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41f7ab
jmp 0x41f7db
mov dword [esi], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046711a
leave
ret

Function at 0x41f895
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 4
pop esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push str.NetCheck
push str.SOFTWARE360Safe360Scan
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push str.IsNotiryShowed
push str.SOFTWARE360Safe360Scan
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call edi
cmp dword [ebp - 0xc], 0
pop edi
pop esi
pop ebx
je 0x41f906
cmp dword [ebp - 0x10], 0
je 0x41f906
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x41f9b2
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x788], eax
push 0x800
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41fa14
xor eax, eax
jmp 0x41fa25
cmp word [ebp - 0x78], 0
je 0x41fa10
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 0x788]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x78c
leave
ret

Function at 0x41fa3a
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0xac], eax
push esi
push edi
push 6
pop ecx
mov esi, 0x490aa0
lea edi, [ebp + 0x90]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x104
lea ecx, [ebp + 0x90]
mov esi, 0xd3a
mov dword [ebp - 0x78], 0x1a
mov al, byte [ecx]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov edx, esi
shr edx, 0x10
and edx, 0x7fff
movzx edi, al
sub al, dl
mov byte [ecx], al
inc ecx
dec dword [ebp - 0x78]
jne 0x41fa89
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.ExeString
lea eax, [ebp + 0x90]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop edi
pop esi
test eax, eax
jne 0x41faeb
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41faeb
xor eax, eax
inc eax
jmp 0x41faed
xor eax, eax
mov ecx, dword [ebp + 0xac]
xor ecx, ebp
call fcn.0046711a
add ebp, 0xb0
leave
ret
Function at 0x41fe9d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x998
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x998], eax
test eax, eax
je 0x41ff98
test ebx, ebx
je 0x41ff98
push eax
call fcn.004673c7
pop ecx
cmp eax, 0x64
ja 0x41ff98
push ebx
call fcn.004673c7
pop ecx
cmp eax, 0x40
ja 0x41ff98
cmp word [0x4c2140], 0
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, 0x4c2140
jne 0x41ff19
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Drivers
push esi
push esi
call edi
push 0x800
lea eax, [ebp - 0x994]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push dword [ebp - 0x998]
lea eax, [ebp - 0x994]
push esi
push eax
call edi
push 0x11
pop ecx
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp - 0x194]
rep movsd dword es:[edi], dword [esi]
push 0x14a
lea eax, [ebp - 0x14e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004670a0
push ebx
lea eax, [ebp - 0x194]
push 0xc8
push eax
call fcn.00467a3e
push dword [ebp + 0x10]
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x994]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.00452f11
add esp, 0x28
pop edi
pop esi
jmp 0x41ff9a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0046711a
leave
ret 0xc
Function at 0x41ffa9
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x239c]
mov eax, 0x241c
call fcn.00467130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x2398], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp + 0x2190], ax
xor ebx, ebx
lea eax, [ebp + 0x2192]
push ebx
push eax
mov dword [ebp - 0x7c], ecx
call fcn.004670a0
mov esi, 0x800
push esi
lea eax, [ebp + 0x788]
push ebx
push eax
call fcn.004670a0
push esi
lea eax, [ebp + 0x1788]
push ebx
push eax
call fcn.004670a0
push esi
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.004670a0
push esi
lea eax, [ebp + 0xf88]
push ebx
push eax
call fcn.004670a0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x3c
push 1
push 0x1a
lea eax, [ebp + 0x2190]
push eax
push ebx
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360Safe
lea eax, [ebp + 0x2190]
push eax
lea eax, [ebp + 0x1788]
push eax
call esi
lea eax, [ebp + 0x1788]
push eax
call fcn.00453537
pop ecx
push 1
push 0x1a
lea eax, [ebp + 0x2190]
push eax
push ebx
call edi
push str.360SoftMgr
lea eax, [ebp + 0x2190]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
lea eax, [ebp - 0x78]
push eax
call fcn.00453537
pop ecx
push 1
push 0x23
lea eax, [ebp + 0x788]
push eax
push ebx
call edi
push str.360safe_scancache
lea eax, [ebp + 0x788]
push eax
lea eax, [ebp + 0x1788]
push eax
call esi
lea eax, [ebp + 0x1788]
push eax
call fcn.00453537
mov eax, dword [ebp - 0x7c]
pop ecx
mov ecx, dword [eax + 8]
call fcn.0044c743
mov edi, eax
cmp edi, ebx
je 0x4201e0
mov eax, dword [edi]
push edi
call dword [eax + 0x1c]
test eax, eax
jne 0x420107
mov eax, dword [edi]
push edi
call dword [eax + 0x38]
test eax, eax
jne 0x420107
push str.360WD
lea eax, [ebp + 0x2190]
push eax
lea eax, [ebp + 0xf88]
push eax
call esi
lea eax, [ebp + 0xf88]
jmp 0x4201d9
lea eax, [ebp + 0x2190]
push eax
call fcn.004673c7
cmp word [ebp + eax*2 + 0x218e], 0x5c
pop ecx
jne 0x420136
lea eax, [ebp + 0x2190]
push eax
call fcn.004673c7
pop ecx
xor ecx, ecx
mov word [ebp + eax*2 + 0x218e], cx
lea eax, [ebp + 0x2190]
push 0x5c
push eax
call fcn.0046715b
pop ecx
pop ecx
cmp eax, ebx
je 0x420171
xor ecx, ecx
mov word [eax], cx
push str.LocalLow360WD
lea eax, [ebp + 0x2190]
push eax
lea eax, [ebp + 0xf88]
push eax
call esi
lea eax, [ebp + 0xf88]
push eax
call fcn.00453537
pop ecx
xor eax, eax
push 0x206
mov word [ebp + 0x1f88], ax
lea eax, [ebp + 0x1f8a]
push ebx
push eax
mov dword [ebp - 0x80], 1
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1f88]
push eax
lea eax, [ebp - 0x80]
push eax
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4201e0
push str.360safe
lea eax, [ebp + 0x1f88]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1f88]
push eax
call fcn.00453537
pop ecx
mov ecx, dword [ebp + 0x2398]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x239c
leave
ret
Function at 0x42034c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x190], eax
cmp dword [0x4c2554], 0
push edi
je 0x42037b
mov eax, dword [0x4c2550]
jmp 0x420419
push ebx
push 0x208
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4970c4
xor ebx, ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
inc ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x420413
push str.Utils360MedalWall.dll
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call fcn.00420307
mov edi, eax
test edi, edi
je 0x420418
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsMedalAllLightEx
push edi
call esi
test eax, eax
jne 0x4203fe
push str.IsMedalAllLight
push edi
call esi
test eax, eax
je 0x420405
call eax
mov dword [0x4c2550], eax
push edi
mov dword [0x4c2554], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, dword [0x4c2550]
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop edi
call fcn.0046711a
add ebp, 0x194
leave
ret
Function at 0x42062b
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x10
mov eax, 0x48791e
call fcn.004677c7
mov eax, dword [ebp + 0x814]
mov ebx, dword [ebp + 0x810]
mov edi, ecx
mov ecx, dword [ebp + 0x80c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x818]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x420755
test eax, eax
je 0x420755
test ecx, ecx
je 0x420755
cmp dword [edi + 8], 0
je 0x420755
mov ecx, edi
call fcn.0041f7f0
mov esi, eax
test esi, esi
je 0x420755
cmp dword [ebp + 0x820], 0
je 0x4206c8
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420755
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x420739
push 0x4c4f30
lea ecx, [ebp - 0x14]
call fcn.00401ce4
mov ecx, dword [edi + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.0044d477
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push ebx
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [ebp + 0x81c]
mov eax, dword [esi]
push dword [ebp - 0x10]
lea ecx, [ebp]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 0x1c]
push esi
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004023e9
jmp 0x420751
push dword [ebp + 0x81c]
mov eax, dword [esi]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x1c]
push esi
call dword [eax + 0x28]
mov esi, eax
mov eax, esi
jmp 0x420757
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret 0x18

Function at 0x42084d
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 4
mov eax, 0x48794e
call fcn.004677c7
mov esi, ecx
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [esi + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044d477
test eax, eax
jne 0x4208c6
xor esi, esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push str.safemon360SPTool.exe
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
jmp 0x420896
Function at 0x420f75
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x1a0c]
mov eax, 0x1a0c
call fcn.00467130
push 0xffffffffffffffff
push 0x4879ae
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1a08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0044d477
mov esi, 0x800
push esi
lea eax, [ebp + 0x1000]
push edi
push eax
call fcn.004670a0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x491204
push dword [ebp - 0x10]
lea eax, [ebp + 0x1000]
push eax
call ebx
lea eax, [ebp + 0x1000]
push eax
call fcn.00453537
xor eax, eax
mov word [ebp + 0x1800], ax
mov dword [esp], 0x206
lea eax, [ebp + 0x1802]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push 1
push 0x26
lea eax, [ebp + 0x1800]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
lea eax, [ebp + 0x1800]
push str.SoftwareMgrAppsWeb
push eax
call fcn.004263a0
push edi
lea eax, [ebp + 0x1800]
push str.SoftwareMgrAppsGreen
push eax
call fcn.004263a0
push edi
lea eax, [ebp + 0x1800]
push str.SoftwareMgrApps
push eax
call fcn.004263a0
push esi
lea eax, [ebp + 0x800]
push edi
push eax
call fcn.004670a0
push esi
lea eax, [ebp]
push edi
push eax
call fcn.004670a0
add esp, 0x3c
push 0x208
lea eax, [ebp + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.360SoftMgr.cpl
lea eax, [ebp + 0x800]
push eax
lea eax, [ebp]
push eax
call ebx
lea eax, [ebp]
push eax
call fcn.00452ebd
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1a08]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x1a0c
leave
ret
Function at 0x4210e9
Capabilities:
Delete directory

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.00467130
push 0xffffffffffffffff
push 0x487a0e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [esi + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044d477
mov esi, 0x800
push esi
lea eax, [ebp + 0x800]
push 0
push eax
call fcn.004670a0
push esi
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0x18
push str.leakrepair.dll
push dword [ebp - 0x10]
lea eax, [ebp + 0x800]
push eax
call esi
lea eax, [ebp + 0x800]
push eax
call fcn.00452ebd
mov dword [esp], str.hotfix
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x1004
leave
ret