joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495dda
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e65d1
mov eax, dword fs:[0]
push eax
mov eax, 0x122c
call fcn.004b4d90
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1238], ecx
mov dword [ebp - 0x122c], eax
call fcn.00492d63
mov dword [ebp - 0x1228], eax
xor eax, eax
push 0x40e
mov word [ebp - 0x624], ax
xor ebx, ebx
lea eax, [ebp - 0x622]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
cmp dword [ebp - 0x1228], ebx
jne 0x495f53
xor eax, eax
push 0x3fe
mov word [ebp - 0xa24], ax
lea eax, [ebp - 0xa22]
push ebx
push eax
mov dword [ebp - 0x1228], ebx
call fcn.004b4620
lea eax, [ebp - 0x1228]
push eax
push 0x200
lea eax, [ebp - 0xa24]
push eax
push edi
call fcn.004955bc
add esp, 0x1c
test eax, eax
je 0x495f22
lea eax, [ebp - 0xa24]
push eax
lea ecx, [ebp - 0x1234]
call fcn.0044bc85
mov dword [ebp - 4], ebx
mov edi, 0x4f8b70
push edi
lea ecx, [ebp - 0x1234]
call fcn.0046a81e
push esi
lea ecx, [ebp - 0x1230]
call fcn.0044bc85
mov byte [ebp - 4], 1
push edi
lea ecx, [ebp - 0x1230]
call fcn.0046a70c
push dword [ebp - 0x1230]
lea eax, [ebp - 0x624]
push dword [ebp - 0x1234]
push 0x4f9538
push 0x208
push eax
call fcn.0043e544
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1230]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1234]
call fcn.0040d610
cmp dword [ebp - 0x1228], ebx
je 0x496045
push dword [ebp - 0x1228]
mov ecx, dword [ebp - 0x1238]
call fcn.00492d63
mov dword [ebp - 0x1228], eax
lea esi, [ebp - 0x624]
cmp eax, ebx
je 0x496045
xor eax, eax
push 0x7fe
mov word [ebp - 0x1224], ax
lea eax, [ebp - 0x1222]
push ebx
push eax
call fcn.004b4620
xor eax, eax
push 0x200
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.004b4620
push 0x202
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.004b4620
push 0x800
lea eax, [ebp - 0x1224]
push ebx
push eax
call fcn.004b4620
add esp, 0x30
cmp dword [ebp - 0x122c], ebx
je 0x495fe1
push dword [ebp - 0x122c]
call fcn.004b5d07
pop ecx
test eax, eax
je 0x495fe1
push dword [ebp - 0x122c]
lea eax, [ebp - 0x214]
push 0x101
push eax
call fcn.0040b640
jmp 0x496003
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x122c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x496045
push esi
push dword [ebp - 0x1228]
lea eax, [ebp - 0x1224]
push 0x4f9538
push 0x400
push eax
call fcn.0043e544
mov ecx, dword [ebp - 0x1238]
add esp, 0x14
push dword [ebp + 0x14]
lea eax, [ebp - 0x214]
push eax
push 2
push 4
lea eax, [ebp - 0x1224]
push eax
call fcn.004935a1
jmp 0x496047
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b46ff
leave
ret 0x10
Function at 0x49621b
Capabilities:
Persist via run registry key

Disassembly:
push 0x1c
mov eax, 0x4e66d9
call fcn.004b51ee
call fcn.004952e8
test al, al
je 0x4962d2
lea ecx, [ebp - 0x10]
call fcn.0040c7d0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.0046b1c7
mov byte [ebp - 4], 1
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x10]
push str.__s_safemon_s___start
push eax
call fcn.0040e3f0
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040d610
push ebx
push dword [ebp - 0x10]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.QHSafeTray
call fcn.0044bc85
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.0044bc85
mov byte [ebp - 4], 3
push 0x80000002
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.00443769
mov byte [ebp - 4], 4
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
call fcn.004b52c6
ret

Function at 0x4962d8
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
push 0x10
mov eax, 0x4e670c
call fcn.004b51ee
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4963c9
cmp dword [ebp + 0xc], ebx
je 0x4963c9
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x10]
call fcn.0044bc85
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x10]
call fcn.00444b0f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp + 8], ebx
push 0x80000002
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x4963bd
push 0x4f8b70
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00445250
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00445250
add esp, 0x18
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.0040d610
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp + 8]
call esi
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push ebx
push str.Path
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
call fcn.004b52c6
ret
Function at 0x4963cf
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x484
mov eax, 0x4e6748
call fcn.004b5257
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x490]
push ebx
push eax
call fcn.004b4620
push 0x10
lea eax, [ebp - 0x44c]
push ebx
push eax
mov dword [ebp - 0x490], esi
call fcn.004b4620
add esp, 0x18
lea ecx, [ebp - 0x428]
call fcn.0040c7d0
mov dword [ebp - 4], ebx
mov esi, 0x400
push esi
lea ecx, [ebp - 0x428]
call fcn.00444b2e
push 0x50ea0c
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x434], eax
call fcn.0044bc85
mov byte [ebp - 4], 1
lea eax, [ebp - 0x42c]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x496582
mov edi, 0x208
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004b4620
push edi
lea eax, [ebp - 0x21c]
push ebx
push eax
mov dword [ebp - 0x438], edi
call fcn.004b4620
add esp, 0x18
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x430]
push eax
push ebx
push str.Path
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x496576
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x430]
dec eax
jne 0x496502
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0044bc85
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x424]
call fcn.004453ce
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x43c]
call fcn.0040d610
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x434]
push str.safemonQHWatchdog.exe
push dword [ebp - 0x424]
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x496582
push edi
call fcn.0043b8a5
pop ecx
test eax, eax
je 0x496582
push edi
lea eax, [ebp - 0x420]
push str.__s___install
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x490]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x496582
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x424]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.0040d610
call fcn.004b52da
ret
Function at 0x497039
Capabilities:
Delete file

Disassembly:
push 0x20
mov eax, 0x4e69ba
call fcn.004b51ee
xor ebx, ebx
cmp byte [0x53fe3c], bl
je 0x497100
push 0x505480
lea ecx, [ebp - 0x14]
call fcn.0044bc85
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00496ec6
pop ecx
cmp eax, 0xffffffff
pop ecx
sete byte [ebp - 0xd]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
cmp byte [ebp - 0xd], bl
je 0x497100
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004625ff
pop ecx
pop ecx
mov dword [ebp - 4], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x50ea0c
call fcn.0044bc85
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWARE360TotalSecurityTheme
call fcn.0044bc85
mov byte [ebp - 4], 3
push 0x80000001
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00443769
mov byte [ebp - 4], 4
push eax
call fcn.0046f194
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
call fcn.00447055
mov ecx, eax
call fcn.00492bf1
call fcn.004b52c6
ret
Function at 0x49752f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x28
mov eax, 0x4e6b22
call fcn.004b51ee
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov ebx, str.OperaShown
push ebx
call fcn.0044bc85
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov edi, str.SOFTWARE360TotalSecurityIntro
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
mov esi, 0x80000002
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00443769
mov dword [ebp - 4], 2
push eax
call fcn.00493a03
pop ecx
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00443c39
cmp dword [ebp - 0x18], 0
jne 0x497603
and dword [ebp - 0x14], 0
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push str.InstallOpera
push str.SOFTWARE360TotalSecurityUserProfile
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x10], 1
call fcn.0045df99
test al, al
jne 0x4975ee
cmp dword [0x53fe64], 0
je 0x4975ee
cmp dword [ebp - 0x14], 0
jne 0x4975ee
mov dword [ebp - 0x10], 1
jmp 0x4975f2
and dword [ebp - 0x10], 0
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.004b52c6
ret
Function at 0x497609
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x4e6b7d
call fcn.004b51ee
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.ShowV1
mov dword [ebp - 0x10], esi
call fcn.00446796
mov dword [ebp - 4], esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov edi, str.SOFTWARE360TotalSecurityDailyNews
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
mov esi, 0x80000002
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443769
mov dword [ebp - 4], 2
push eax
call fcn.0043e957
mov ebx, eax
neg ebx
sbb bl, bl
pop ecx
pop ecx
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443c39
test bl, bl
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
je 0x4976e8
push str.ShowV1
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 1
call fcn.00446796
mov dword [ebp - 4], 3
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push eax
push edi
push esi
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
push str.Show
lea ecx, [ebp - 0x14]
call fcn.00446796
push 4
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
push ecx
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push edi
push esi
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.NewsShown
call fcn.0044bc85
mov dword [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, str.SOFTWARE360TotalSecurityIntro
push edi
call fcn.0044bc85
mov byte [ebp - 4], 6
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443769
mov dword [ebp - 4], 7
push eax
call fcn.00493a03
pop ecx
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443c39
cmp dword [ebp - 0x14], 0
jne 0x497762
xor eax, eax
cmp dword [ebp - 0x10], eax
push 4
sete al
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push str.NewsShown
push edi
push esi
call ebx
call fcn.004b52c6
ret
Function at 0x497768
Capabilities:
Set registry value

Disassembly:
push 0x20
mov eax, 0x4e6bd0
call fcn.004b51ee
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, str.DesktopPlusShown
push ebx
call fcn.0044bc85
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov edi, str.SOFTWARE360TotalSecurityIntro
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
mov esi, 0x80000002
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00443769
mov dword [ebp - 4], 2
push eax
call fcn.00493a03
pop ecx
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00443c39
cmp dword [ebp - 0x14], 0
jne 0x4978a9
cmp byte [0x53fe3c], 0
jne 0x497813
push 0x53fe7c
call fcn.0049474a
pop ecx
test eax, eax
jne 0x497813
call fcn.0043a034
test eax, eax
jne 0x497813
and dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x4978a9
push 0x50ea0c
lea ecx, [ebp - 0x10]
call fcn.0044bc85
mov dword [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.first_show_desktoplite
call fcn.0044bc85
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SOFTWARE360desktoplite
call fcn.0044bc85
mov byte [ebp - 4], 5
push 0x80000001
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00443769
mov byte [ebp - 4], 6
push eax
call fcn.0044b15c
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00443c39
xor eax, eax
cmp dword [ebp - 0x14], eax
push 4
sete al
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
call fcn.004b52c6
ret
Function at 0x497e65
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push 0x214
mov eax, 0x4e6d30
call fcn.004b5257
mov esi, ecx
call fcn.0049310b
test al, al
je 0x497f63
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004b4620
push str.temp_files
lea eax, [esi + 0x7c]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00445250
add esp, 0x18
and dword [ebp - 4], 0
mov eax, dword [eax]
push str.safemonWscReg.exe
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040d610
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x497f63
lea ecx, [ebp - 0x21c]
call fcn.0040c7d0
mov dword [ebp - 4], 1
mov edi, 0x104
push edi
lea ecx, [ebp - 0x21c]
call fcn.0040dc70
push edi
push eax
push str.CommonProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x497f54
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040c8c0
push str.AV360_Total_SecurityUpgrade.exe
lea ecx, [ebp - 0x21c]
call fcn.00444b0f
push dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00496c40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d610
call fcn.004b52da
ret

Function at 0x498245
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x418
mov eax, 0x4e6dfa
call fcn.004b5257
mov esi, dword [ebp + 8]
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
push 1
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x498291
xor al, al
jmp 0x498305
xor eax, eax
push edi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4982b6
mov esi, dword [esi + 4]
jmp 0x4982b9
add esi, 4
push esi
lea eax, [ebp - 0x424]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
mov dword [ebp - 4], ebx
push dword [eax]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.0040d610
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
call fcn.004b52da
ret
Function at 0x499430
Capabilities:
Set registry value

Disassembly:
push 0x210
mov eax, 0x4e7264
call fcn.004b5257
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004b4620
add esp, 0xc
push str.lnkpath
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x53fda0
call fcn.0047d67a
and dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call fcn.0049354c
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d610
lea eax, [ebp - 0x218]
push eax
call fcn.004b5d07
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push str.StartMenu
push str.SOFTWARE360TotalSecurityShortcut
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.004b52da
ret
Function at 0x49acbf
Capabilities:
Enumerate processes

Disassembly:
push 0x24c
mov eax, 0x4e76c3
call fcn.004b5257
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
test byte [0x540314], 1
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x254], edi
mov dword [ebp - 0x248], ebx
mov esi, 0x5402f4
jne 0x49ad16
or dword [0x540314], 1
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.00471ab8
push 0x4ef5c7
call fcn.004b7700
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [0x540310], ebx
je 0x49ad3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x5402f0]
sub ecx, eax
cmp ecx, 0x1388
ja 0x49ad3e
cmp byte [ebp + 0x10], 1
jne 0x49ae20
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x49ae20
mov ecx, esi
call fcn.00470c48
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
mov edi, 0x22c
push ebx
mov dword [ebp - 0x23c], edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x49ae0b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.0044bc85
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.0044644e
mov ecx, eax
call fcn.00444d1f
lea ecx, [ebp - 0x244]
call fcn.00445121
lea eax, [ebp - 0x244]
push eax
mov ecx, esi
call fcn.0047158d
mov ecx, dword [ebp - 0x234]
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.004b4620
add esp, 0xc
mov dword [ebp - 0x23c], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.0040d610
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x49ad8b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x254]
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x240]
call fcn.0044bc85
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x240]
call fcn.00445121
push esi
push dword [0x54030c]
lea ecx, [ebp - 0x250]
call fcn.004424c1
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x258]
push eax
mov ecx, esi
call fcn.0046fdc4
mov ecx, eax
call fcn.004833f7
test al, al
je 0x49ae9c
test edi, edi
je 0x49ae92
lea eax, [ebp - 0x240]
push eax
mov ecx, esi
call fcn.0047158d
mov eax, dword [eax]
mov dword [edi], eax
mov dword [ebp - 0x248], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.0040d610
mov eax, dword [ebp - 0x248]
call fcn.004b52da
ret
Function at 0x49b303
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
xor ebx, ebx
push ebx
push ebx
push ecx
push 0x49b2f2
push ebx
push ebx
mov dword [ebp - 8], ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc350
push eax
mov dword [ebp - 0x10], eax
call edi
push ebx
push ebx
push dword [ebp - 8]
push 0x493773
push ebx
push ebx
call esi
push 0x2710
push eax
mov dword [ebp - 0x14], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x3e8
test eax, eax
jne 0x49b37f
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
call fcn.0049373b
mov byte [ebp - 1], al
cmp al, 1
je 0x49b37a
push esi
call edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 5
jl 0x49b35f
cmp byte [ebp - 1], bl
jne 0x49b3a5
mov ecx, dword [ebp - 8]
call fcn.004963cf
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 8]
call fcn.0049373b
mov byte [ebp - 1], al
cmp al, 1
je 0x49b3a5
push esi
call edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xa
jl 0x49b38a
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x49b3bb
cmp dword [ebp - 0x10], 0xffffffff
je 0x49b3bb
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x14], ebx
je 0x49b3cb
cmp dword [ebp - 0x14], 0xffffffff
je 0x49b3cb
push dword [ebp - 0x14]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49be27
Capabilities:
Delete file

Disassembly:
push 0x248
mov eax, 0x4e791d
call fcn.004b5257
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x23c], eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x49be55
xor al, al
call fcn.004b52da
ret
lea ecx, [ebp - 0x254]
call fcn.0048d48e
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x254]
mov esi, 0x53fda0
push eax
mov ecx, esi
call fcn.00480666
test al, al
jne 0x49be8f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.004679ad
mov al, bl
jmp 0x49be4f
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov byte [ebp - 0x219], 1
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x248]
lea ecx, [ebp - 0x228]
call fcn.00442295
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x230], eax
jmp 0x49bfb0
push 0x50ea0c
lea ecx, [ebp - 0x22c]
call fcn.0044bc85
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.0048212d
cmp dword [eax + 0x18], 8
jb 0x49bf13
mov eax, dword [eax + 4]
jmp 0x49bf16
add eax, 4
push eax
lea ecx, [ebp - 0x238]
call fcn.0044bc85
mov byte [ebp - 4], 2
lea eax, [ebp - 0x22c]
push eax
push edi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x220]
push eax
mov ecx, esi
call fcn.0049bde4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x238]
call fcn.0040d610
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x22c]
call fcn.0040d610
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], ebx
je 0x49bf97
push eax
push dword [ebp - 0x23c]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x49bf97
mov byte [ebp - 0x219], bl
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x220]
call fcn.0040d610
lea ecx, [ebp - 0x234]
call fcn.004a64f8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x244]
lea ecx, [ebp - 0x228]
call fcn.00442295
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x234]
call fcn.0043cc0e
test al, al
je 0x49bee9
mov bl, byte [ebp - 0x219]
jmp 0x49be7c