joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3da0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4a3e0d
xor ecx, ecx
cmp ecx, str.Experience
je 0x4a3e0d
xor edx, edx
cmp edx, str.MedalWallNextEffect
je 0x4a3e0d
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.Experience
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
mov ecx, dword [ebp - 4]
add esp, 0x10
push str.MedalWallNextEffect
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret

Function at 0x4a4490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test byte [0x598088], 1
mov ebx, 7
jne 0x4a44e1
or dword [0x598088], 1
xor eax, eax
push 0x555ac0
mov dword [0x598084], ebx
mov dword [0x598080], edi
mov word [0x598070], ax
call fcn.00520fed
add esp, 4
cmp byte [0x59806a], 1
jne 0x4a44fb
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
jmp 0x4a45bd
push 0x206
lea eax, [ebp - 0x20a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x20c], dx
call fcn.0051d250
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4a45aa
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x22c]
push eax
xor edx, edx
push ecx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], edi
mov word [ebp - 0x224], dx
call fcn.00454960
add esp, 8
test al, al
je 0x4a4592
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
push edx
push eax
call fcn.004764b0
add esp, 8
test al, al
je 0x4a4592
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x228]
push ecx
mov ecx, 0x59806c
call fcn.0044f8b0
cmp dword [ebp - 0x210], 8
jb 0x4a45aa
mov edx, dword [ebp - 0x224]
push edx
call fcn.0051d230
add esp, 4
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov byte [0x59806a], 1
mov word [esi + 4], ax
push 0xffffffffffffffff
push edi
push 0x59806c
mov ecx, esi
call fcn.0044f8b0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
Function at 0x4a45e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test byte [0x5980ac], 1
mov ebx, 7
jne 0x4a4631
or dword [0x5980ac], 1
xor eax, eax
push 0x555b00
mov dword [0x5980a8], ebx
mov dword [0x5980a4], edi
mov word [0x598094], ax
call fcn.00520fed
add esp, 4
cmp byte [0x59808c], 1
jne 0x4a464b
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
jmp 0x4a470d
push 0x206
lea eax, [ebp - 0x20a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x20c], dx
call fcn.0051d250
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4a46fa
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x22c]
push eax
xor edx, edx
push ecx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], edi
mov word [ebp - 0x224], dx
call fcn.00454960
add esp, 8
test al, al
je 0x4a46e2
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
push edx
push eax
call fcn.004762c0
add esp, 8
test al, al
je 0x4a46e2
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x228]
push ecx
mov ecx, 0x598090
call fcn.0044f8b0
cmp dword [ebp - 0x210], 8
jb 0x4a46fa
mov edx, dword [ebp - 0x224]
push edx
call fcn.0051d230
add esp, 4
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov byte [0x59808c], 1
mov word [esi + 4], ax
push 0xffffffffffffffff
push edi
push 0x598090
mov ecx, esi
call fcn.0044f8b0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4a4e30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push str.biz_poicy_allow_show_daily_news
push edi
mov esi, ecx
call fcn.004b0d70
push str.biz_poicy_daily_news_country_code
mov dword [esi], eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004b1050
add esp, 0x18
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 8]
call fcn.0044f7c0
cmp dword [ebp - 4], 0x10
jb 0x4a4e7d
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0051d230
add esp, 4
push 0
push str.biz_poicy_daily_news_hour
push edi
call fcn.004b0d70
push 0
push str.biz_poicy_daily_news_minute
push edi
mov dword [esi + 0x40], eax
call fcn.004b0d70
push str.biz_poicy_daily_news_language_code
lea edx, [ebp - 0x1c]
push edi
push edx
mov dword [esi + 0x44], eax
call fcn.004b1050
add esp, 0x24
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x24]
call fcn.0044f7c0
cmp dword [ebp - 4], 0x10
jb 0x4a4ece
mov eax, dword [ebp - 0x18]
push eax
call fcn.0051d230
add esp, 4
push 0
push str.biz_poicy_daily_region_type
push edi
call fcn.004b0d70
push 0
push str.biz_poicy_daily_news_show_alert
push edi
mov dword [esi + 4], eax
call fcn.004b0d70
add esp, 0x18
pop edi
mov dword [esi + 0x48], eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4acf10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5980b4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
jne 0x4acf4f
test eax, eax
je 0x4acf3c
movzx ecx, byte [0x5832d0]
mov dword [eax], ecx
mov eax, dword [0x5980b0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea edx, [ebp - 0x28]
push edi
push edx
call fcn.004a5970
mov eax, dword [eax]
push eax
call fcn.004603c0
mov bl, al
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4acf87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.004ab410
add esp, 4
cmp al, 1
jne 0x4acfbd
cmp dword [ebp - 0xc], 0
je 0x4acfbd
xor edx, edx
test bl, bl
setne dl
add edx, 2
mov esi, edx
jmp 0x4acfc6
xor eax, eax
test bl, bl
setne al
mov esi, eax
lea ecx, [ebp - 0x28]
push ecx
mov byte [ebp - 0x21], 0
call fcn.004a5a10
mov edi, dword [ebp - 0x28]
add esp, 4
cmp dword [edi - 0xc], 0
je 0x4ad08e
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ad08e
lea edx, [ebp - 0x28]
push edx
call fcn.00473c90
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
push eax
call fcn.0041eae0
add esp, 8
add eax, 0x10
push 0x564cd8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
call fcn.004502c0
lea eax, [ebp - 0x2c]
push eax
call fcn.00458610
lea ecx, [ebp - 0x28]
push ecx
call fcn.00458640
add esp, 8
call fcn.004488b0
cmp al, 1
jne 0x4ad050
push 0
push edi
mov ecx, 0x5939b8
call fcn.004f58f0
cmp eax, 1
jne 0x4ad050
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4ad06f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ad08e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
cmp esi, 3
je 0x4ad0af
cmp esi, 2
je 0x4ad0af
cmp byte [ebp - 0x21], al
jne 0x4ad0b7
xor ecx, ecx
xor al, al
test bl, bl
setne cl
add ecx, 2
mov esi, ecx
jmp 0x4ad0b7
cmp byte [ebp - 0x21], 0
jne 0x4ad0b7
xor al, al
mov ecx, dword [ebp - 0x30]
mov byte [0x5980b4], 1
mov dword [0x5980b0], esi
mov byte [0x5832d0], al
test ecx, ecx
je 0x4ad0d5
movzx edx, al
mov dword [ecx], edx
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ad0f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 8], 0x10
jb 0x4ad103
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0051d230
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
Function at 0x4b1b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x4b1bee
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
lea edx, [ebp + 0x10]
push edx
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x4b1b60
push 0
push 0
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x4b1be6
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_FindWindowW]
mov esp, ebp
pop ebp
ret
Function at 0x4b3620
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jne 0x4b3660
mov dword [ebx + 0x14], esi
xor eax, eax
mov dword [ebx + 0x18], 7
mov word [ebx + 4], ax
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
xor ecx, ecx
push eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x34], edi
cmp edi, 0xffffffff
je 0x4b373e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x4b3735
push 0x5995a6
push esi
call fcn.0051f00a
mov edi, eax
add esp, 8
test edi, edi
je 0x4b3732
push esi
push 0
push edi
call fcn.0051d250
mov eax, dword [ebp - 0x34]
add esp, 0xc
push 0
lea edx, [ebp - 0x38]
push edx
push esi
push edi
push eax
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b3729
cmp dword [ebp - 0x38], esi
jne 0x4b3729
lea ecx, [ebp - 0x14]
push ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call fcn.004b8f00
add esp, 0xc
test eax, eax
je 0x4b3729
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x14]
call fcn.004a4400
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x30]
call fcn.00459860
lea ecx, [ebp - 0x3c]
call fcn.00442750
push edi
call fcn.0051d538
add esp, 4
mov edi, dword [ebp - 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0xffffffffffffffff
xor ecx, ecx
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], esi
push esi
lea edx, [ebp - 0x30]
mov word [ebx + 4], cx
push edx
mov ecx, ebx
call fcn.0044f8b0
cmp dword [ebp - 0x18], 8
pop edi
jb 0x4b376f
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0051d230
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
Function at 0x4b42b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x583328]
test eax, eax
jl 0x4b42e3
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [ebp - 0x120]
push edx
mov dword [0x583328], 0
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
call fcn.0051d250
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x4b436f
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x4b43be
push str.GetNativeSystemInfo
push 0x55ff94
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b43be
lea edx, [ebp - 0x144]
push edx
call eax
mov eax, dword [ebp - 0x144]
cmp ax, 9
je 0x4b43a5
cmp ax, 6
jne 0x4b43be
mov eax, 1
mov dword [0x583328], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4b4d70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5979d8]
test eax, eax
jne 0x4b4d86
call fcn.0044ef40
mov dword [0x5979d8], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x4b4da6
mov eax, dword [0x5979d8]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x4b4da6
mov eax, dword [eax + 0x50]
jmp 0x4b4da8
xor eax, eax
test eax, eax
je 0x4b4daf
pop ebp
jmp eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DeleteFileW]

Function at 0x4b4dc0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4b4dee
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x4b4e6c
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0051d250
push esi
push str._s.bak
lea ecx, [ebp - 0x20c]
push 0x208
push ecx
call fcn.00436fa0
add esp, 0x1c
lea edx, [ebp - 0x20c]
push edx
call edi
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4b4e66
push 4
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.004b4d70
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret 4
Function at 0x4b4f20
Capabilities:
Check if file exists
Check os version
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x59810c]
sub esp, 8
test eax, eax
jne 0x4b4f49
push 0x598108
mov dword [0x598108], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x59810c]
push esi
push edi
cmp eax, 6
ja 0x4b4f63
jne 0x4b5011
cmp dword [0x598110], 2
jb 0x4b5011
lea eax, [ebp - 4]
push eax
call fcn.004b4e80
mov esi, dword [ebp - 4]
add esp, 4
cmp dword [esi - 0xc], 0
jne 0x4b4fab
mov edi, dword [ebp + 8]
push 0x576bd0
mov ecx, edi
call fcn.00464b60
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b4fa3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.temp_
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.0044f400
mov eax, dword [eax]
add esp, 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b4fea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp + 8]
push str.temp_
lea ecx, [ebp - 4]
push ecx
push edi
call fcn.0044f400
lea eax, [esi - 0x10]
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4b4f97
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
add eax, 0x10
push 0x400
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0044b200
push 1
push 0x23
mov esi, eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4b5053
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x566d70
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [ebp - 4]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0051f6df
add esp, 8
test eax, eax
jl 0x4b50df
cmp eax, dword [esi - 8]
jg 0x4b50df
xor ecx, ecx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b5094
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x560120
lea ecx, [ebp - 4]
call fcn.0044a1a0
mov esi, dword [ebp - 4]
add esi, 0xfffffff0
push esi
call fcn.0041eae0
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
add esp, 4
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4b4fa3
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00414840
int3
Function at 0x4b8040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov edx, dword [esi + 4]
test edx, edx
je 0x4b8144
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4b8144
mov eax, dword [esi + 0x1008]
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, eax
ja 0x4b80a2
push edi
lea ebx, [esi + 8]
push ebx
push ecx
call fcn.0051f280
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
sub dword [esi + 0x1008], edi
mov eax, dword [esi + 0x1008]
push eax
lea ecx, [edi + esi + 8]
push ecx
push ebx
call fcn.005260b0
add esp, 0x18
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret 0xc
mov ebx, dword [esi + 0x100c]
cmp ebx, dword [esi + 0x1010]
jb 0x4b80e3
test eax, eax
jbe 0x4b80c2
push eax
lea edx, [esi + 8]
push edx
push ecx
call fcn.0051f280
add esp, 0xc
mov eax, dword [esi + 0x1008]
mov ecx, dword [ebp + 0x10]
pop edi
mov dword [ecx], eax
pop ebx
mov dword [esi + 0x1008], 0
mov eax, 1
pop esi
pop ebp
ret 0xc
push 0
lea ecx, [ebp + 0xc]
push ecx
mov ecx, 0x1000
sub ecx, eax
push ecx
lea eax, [eax + esi + 8]
push eax
push edx
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b8132
mov eax, dword [ebp + 0xc]
test eax, eax
jbe 0x4b8132
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
add dword [esi + 0x1008], eax
add dword [esi + 0x100c], eax
push ecx
push edi
push edx
mov ecx, esi
call fcn.004b8040
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
pop edi
pop ebx
mov dword [eax], 0
xor eax, eax
pop esi
pop ebp
ret 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x4b8150
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x4b818b
mov eax, dword [esi]
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4b8192
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x1010], eax
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4b81a0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x4b81db
mov eax, dword [esi]
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4b81e2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x1010], eax
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4b8cc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp + 0xc]
push ecx
push eax
lea edx, [ebp - 0x6c]
push edx
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.004b8a00
lea eax, [ebp - 0x6c]
push eax
call fcn.004b8b10
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [esi], ecx
mov ecx, dword [ebp - 8]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret

Function at 0x4be3f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push ecx
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [ebp - 4]
je 0x4be41e
cmp eax, esi
je 0x4be443
mov edx, dword [ebp + 0x10]
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4be439
lea esi, [eax + 1]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4be450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push ecx
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [ebp - 4]
je 0x4be47c
cmp eax, esi
je 0x4be4c1
mov ecx, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
push ecx
push esi
push edx
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4be4b7
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x4be4b2
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov esi, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4be4d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea ecx, [ebp + 8]
push ecx
push 0
xor eax, eax
cmp dword [ebp + 8], eax
push 2
push 0
push 0
setne al
push 0
push str.software360TotalSecurityActiveProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [ebp + 8]
je 0x4be511
test eax, eax
je 0x4be531
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x566e64
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret