joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425790
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x4ce4d6
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x2a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ffeb0]
xor eax, esp
push eax
lea eax, [esp + 0x2c0]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2d0]
cmp dword [edi + 0x14], 0
mov ebp, dword [esp + 0x2d4]
jne 0x4257e6
xor al, al
jmp 0x425927
push edi
mov ecx, ebp
call fcn.00425590
add esp, 4
mov ebx, str..
mov ecx, edi
lea esi, [esp + 0x34]
call fcn.00409bc0
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x425810
mov eax, dword [eax + 4]
jmp 0x425813
add eax, 4
lea ecx, [esp + 0x6c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x4c], esi
jb 0x425838
mov edx, dword [esp + 0x38]
push edx
call fcn.0049c830
add esp, 4
xor eax, eax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], 0
mov word [esp + 0x38], ax
cmp ebx, 0xffffffff
je 0x4257df
jmp 0x425860
cmp word [esp + 0x98], 0x2e
je 0x425906
test byte [esp + 0x6c], 0x10
je 0x425906
mov ebx, 0x4e0c60
mov ecx, edi
lea esi, [esp + 0x50]
call fcn.00409bc0
lea ebx, [esp + 0x98]
mov ecx, eax
lea esi, [esp + 0x18]
mov dword [esp + 0x2c8], 0
call fcn.00409bc0
push ebp
push eax
mov byte [esp + 0x2d0], 1
call fcn.00425790
mov esi, 8
add esp, 8
cmp dword [esp + 0x30], esi
jb 0x4258d1
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0049c830
add esp, 4
xor edx, edx
mov dword [esp + 0x2c8], 0xffffffff
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], dx
cmp dword [esp + 0x68], esi
jb 0x425906
mov eax, dword [esp + 0x54]
push eax
call fcn.0049c830
add esp, 4
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x6c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x425860
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x2c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.004a0e91
add esp, 0x2b8
ret
Function at 0x425950
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, dword [esp + 0xc]
push esi
call ebp
test eax, eax
je 0x42596b
pop esi
mov eax, 1
pop ebp
ret
push ebx
push edi
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 0xffffffff
je 0x425998
test al, 0x10
je 0x425998
push esi
mov edi, 1
call ebx
test eax, eax
je 0x42599f
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
push esi
call ebp
test eax, eax
jne 0x4259ba
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4259ca
push esi
test edi, edi
jne 0x4259c4
call ebp
test eax, eax
je 0x4259ca
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
call ebx
test eax, eax
jne 0x4259ba
cmp byte [esp + 0x18], 0
je 0x4259ee
cmp byte [esp + 0x1c], 1
jne 0x4259e3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4259ba
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret

Function at 0x425a00
Capabilities:
Get file version info

Disassembly:
mov eax, 0x2010
call fcn.004a1b30
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x201c]
cmp esi, ebx
je 0x425abc
push 0x1fff
lea eax, [esp + 0x19]
push ebx
push eax
mov byte [esp + 0x20], bl
call fcn.004a0bd0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
je 0x425abc
cmp eax, 0x1fff
ja 0x425abc
lea edx, [esp + 0x14]
push edx
push eax
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x425aa3
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x4e0c60
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x425aa3
mov eax, dword [esp + 8]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp], edx
mov bl, 1
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.004a0e91
add esp, 0x2010
ret
mov ecx, dword [esp + 0x2014]
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.004a0e91
add esp, 0x2010
ret
Function at 0x426680
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push ebx
mov edi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x42672e
mov eax, dword [edi + 0x20c]
test eax, eax
je 0x4266b4
push eax
call fcn.004a0db7
add esp, 4
push esi
call fcn.004a1870
add esp, 4
mov dword [edi + 0x20c], eax
test eax, eax
je 0x42672e
push eax
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42672e
mov eax, dword [edi + 0x20c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push str.VarFileInfoTranslation
push eax
mov dword [esp + 0x28], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42672e
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04x
push 0x208
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x4299b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SOFTWARE360TotalSecurityDeepScan
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [esp + 4]
je 0x4299e2
cmp eax, esi
je 0x429a17
push 4
xor ecx, ecx
cmp dword [esp + 0x14], esi
lea edx, [esp + 0xc]
push edx
push 4
setne cl
push esi
push str.DisableHRM
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x429a0c
lea esi, [eax + 1]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x429b30
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [0x50249c]
test eax, eax
jl 0x429b6b
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004a0e91
add esp, 0x144
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [esp + 0x30]
push edx
mov dword [0x50249c], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.004a0bd0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x429bdb
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x114
call esi
test eax, eax
je 0x429c2d
push str.GetNativeSystemInfo
push 0x4e0d00
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x429c2d
lea edx, [esp + 4]
push edx
call eax
mov eax, dword [esp + 4]
cmp ax, 9
je 0x429c0d
cmp ax, 6
jne 0x429c2d
mov eax, 1
mov dword [0x50249c], eax
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.004a0e91
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
xor al, al
call fcn.004a0e91
add esp, 0x144
ret

Function at 0x42a8e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
lea eax, [esp + 0x10]
push eax
push ebp
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x42a904
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push esi
call fcn.004a1870
mov edi, eax
add esp, 4
test edi, edi
jne 0x42a91c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42a957
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4e0c60
push edi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
push edi
call fcn.004a0db7
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret

Function at 0x42a970
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x42a9be
cmp dword [esp + 8], 0
jne 0x42a9be
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a0e91
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.004a0e91
add esp, 0x118
ret
Function at 0x42a9e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x224
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x220], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x42aaaa
cmp dword [esp + 0x10], 1
jb 0x42aaaa
push 0x103
lea ecx, [esp + 0x121]
push 0
push ecx
mov byte [esp + 0x128], 0
call fcn.004a0bd0
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 8]
push ecx
push str.CSDVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x42aaaa
lea edx, [esp + 0x11c]
push str.Service_Pack_2
push edx
call fcn.004a690c
add esp, 8
test eax, eax
jl 0x42aaaa
mov eax, 1
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004a0e91
add esp, 0x224
ret
mov ecx, dword [esp + 0x220]
xor ecx, esp
xor eax, eax
call fcn.004a0e91
add esp, 0x224
ret

Function at 0x42aad0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x42ab1e
cmp dword [esp + 8], 2
jne 0x42ab1e
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a0e91
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.004a0e91
add esp, 0x118
ret

Function at 0x42ab40
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push 0x4e2f10
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42ab8c
lea ecx, [esp]
push ecx
call eax
jmp 0x42ab96
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
je 0x42abab
cmp ax, 6
je 0x42abab
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x42abc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [0x508e8c]
test eax, eax
jne 0x42ac45
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x104
lea eax, [esp]
cmp word [eax], 0
je 0x42ac05
add eax, 2
sub ecx, 1
jne 0x42abf5
jmp 0x42ac29
test ecx, ecx
je 0x42ac29
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2]
push str._ntdll.dll
mov eax, SysReAllocString
call fcn.00406320
push str.RtlGetVersion
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x508e8c], eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004a0e91
add esp, 0x20c
ret

Function at 0x42acf0
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4cb40b
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
mov eax, dword [0x4ffeb0]
xor eax, esp
push eax
lea eax, [esp + 0x338]
mov dword fs:[0], eax
push 0x11c
xor esi, esi
lea eax, [esp + 0x14]
push esi
push eax
call fcn.004a0bd0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ad66
cmp dword [esp + 0x14], 6
jne 0x42ad66
cmp dword [esp + 0x18], 1
jae 0x42ae19
push esi
push 0x25
lea edx, [esp + 0x134]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [0x50739c]
mov edx, dword [eax + 0xc]
mov ecx, 0x50739c
call edx
add eax, 0x10
mov dword [esp + 8], eax
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0xc]
push 0x4e198c
push ecx
mov dword [esp + 0x34c], esi
call fcn.00404ba0
add esp, 0xc
push 0xd
push str.kernel32.dll
lea ecx, [esp + 0x10]
call fcn.004057c0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0xc]
push eax
push esi
call fcn.0042a8e0
add esp, 0xc
test eax, eax
je 0x42ae20
mov eax, dword [esp + 0xc]
mov ecx, eax
shr ecx, 0x10
cmp ecx, 6
jne 0x42ae20
cmp ax, 1
jb 0x42ae20
lea eax, [esi - 0x10]
mov dword [esp + 0x340], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ae19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x42ae49
lea eax, [esi - 0x10]
mov dword [esp + 0x340], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ae47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x338]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004a0e91
add esp, 0x33c
ret
Function at 0x42ae70
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42aec2
cmp dword [esp + 4], 6
jne 0x42aec2
cmp dword [esp + 8], 1
jne 0x42aec2
call fcn.0042ab40
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004a0e91
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.004a0e91
add esp, 0x118
ret

Function at 0x42afe0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x14c
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x148], eax
xor eax, eax
push str.GetNativeSystemInfo
push 0x4e2f10
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42b03e
lea ecx, [esp + 4]
push ecx
call eax
jmp 0x42b049
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push esi
push 0x11c
lea eax, [esp + 0x34]
push 0
push eax
call fcn.004a0bd0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x11c
call esi
test eax, eax
jne 0x42b086
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], 0x114
call esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 8]
push ecx
push 0x4e0d00
mov dword [esp + 0x10], 0
call fcn.0042a8e0
add esp, 0xc
pop esi
test eax, eax
je 0x42b0cf
mov ecx, dword [esp]
mov eax, ecx
movzx edx, cx
mov ecx, dword [esp + 4]
shr eax, 0x10
cmp cx, 9
je 0x42b0e6
cmp cx, 6
je 0x42b0e6
cmp eax, 5
jne 0x42b0f1
cmp edx, 2
jne 0x42b0f1
xor al, al
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.004a0e91
add esp, 0x14c
ret
cmp eax, 6
jb 0x42b0cf
jne 0x42b0f1
test edx, edx
je 0x42b0cf
mov ecx, dword [esp + 0x148]
xor ecx, esp
mov al, 1
call fcn.004a0e91
add esp, 0x14c
ret
Function at 0x42b110
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x4f27a8
push 0x4a19a0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4ffeb0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x42b24a
cmp word [esi], 0
je 0x42b24a
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42b176
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x42b24a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b24a
xor eax, eax
mov word [ebp], ax
push 0x7fe
push eax
lea ecx, [ebp + 2]
push ecx
call fcn.004a0bd0
push esi
push str.__s_
push 0x3ff
lea edx, [ebp]
push edx
call fcn.0040a3d0
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004a0bd0
add esp, 0x28
mov dword [ebp - 0x54], 0x3c
lea ecx, [ebp]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x40], str._disablesp_3
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x50], 0x440
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x42b228
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x42b236
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x42b253
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.004a0e91
add ebp, 0x804
mov esp, ebp
pop ebp
ret
Function at 0x42b410
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push str.SB_State
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 4
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x42b47f
push 4
lea eax, [esp + 0xc]
push eax
push 4
push str.SB_State
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
call esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push str.SB_Entry_Known
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x42b4c5
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push str.SB_Entry_Known
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.SB_RightMenu
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x42b50b
push 4
lea edx, [esp + 0xc]
push edx
push 4
push str.SB_RightMenu
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
call esi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x42b6f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x248
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x56]
mov edi, 1
push ecx
mov byte [esp + 0x1f], 1
mov dword [esp + 0x20], edi
mov word [esp + 0x58], ax
call fcn.004a0bd0
mov ebp, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.ImagePath
push str.Software360TotalSecurity_srvtpi360bsmon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0x208
call ebp
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x42b775
cmp dword [esp + 0x14], edi
jne 0x42b775
cmp dword [esp + 0x18], 0
jne 0x42b7af
mov ecx, 0xa
mov esi, str.safemon360bsmon.tpi
lea edi, [esp + 0x20]
push 0x2a
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x24]
push edx
push 1
push str.ImagePath
push str.Software360TotalSecurity_srvtpi360bsmon
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
call ebx
mov edi, 1
test eax, eax
je 0x42b7af
mov byte [esp + 0x13], 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x4e2e48
push str.Software360TotalSecurity_srvtpi360bsmon
mov esi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 3
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call ebp
test eax, eax
jne 0x42b7f4
cmp dword [esp + 0x14], esi
jne 0x42b7f4
cmp dword [esp + 0x1c], edi
je 0x42b818
push esi
lea eax, [esp + 0x20]
push eax
push esi
push 0x4e2e48
push str.Software360TotalSecurity_srvtpi360bsmon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], edi
call ebx
test eax, eax
je 0x42b818
xor al, al
jmp 0x42b821
xor eax, eax
cmp byte [esp + 0x13], al
setne al
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a0e91
add esp, 0x248
ret

Function at 0x42b9e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4ffeb0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.004a0bd0
lea edx, [esp + 0x10]
push str.SoftMgr360SoftMgrS.dll
push edx
call fcn.0042b2f0
add esp, 0x14
lea eax, [esp + 4]
lea edx, [eax + 2]
pop ebx
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ba30
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 4]
push ecx
push 1
push str.ImagePath
push str.Software360safe360krnlsvc_softmgrs
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov al, 1
call fcn.004a0e91
add esp, 0x20c
ret