joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e400
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea edx, [ebp - 0x418]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x44e451
xor eax, eax
jmp 0x44e6bc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ebd80
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0044ea70
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360Util.dll
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call fcn.0040ee70
add esp, 4
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x44e6ba
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x428]
call fcn.0040f510
push str.__elevated
lea ecx, [ebp - 0x428]
call fcn.0040e800
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0040eed0
add esp, 4
and eax, 0x20
je 0x44e51d
push 0
call fcn.0049d1c0
add esp, 4
test eax, eax
jne 0x44e51d
push str._ElevateStandUserSaas
lea ecx, [ebp - 0x428]
call fcn.0040e800
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
push 0
push str._ElevateStandUserSaas
lea ecx, [ebp - 0x428]
call fcn.0040f570
cmp eax, 0xffffffff
je 0x44e579
lea ecx, [ebp - 0x420]
push ecx
push 7
push 0xbb8
lea ecx, [ebp - 0x428]
call fcn.0044ea20
push eax
lea edx, [ebp - 0x418]
push edx
call fcn.0040eea0
add esp, 0x14
mov dword [ebp - 0x424], eax
jmp 0x44e59f
push 0xbb8
lea ecx, [ebp - 0x428]
call fcn.0044ea20
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0044ea90
add esp, 0xc
mov dword [ebp - 0x424], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0040eed0
add esp, 4
and eax, 0x20
je 0x44e5e3
push 0
call fcn.0049d1c0
add esp, 4
test eax, eax
jne 0x44e5e3
mov dword [ebp - 0x468], 1
lea ecx, [ebp - 0x428]
call fcn.004335b0
mov eax, dword [ebp - 0x468]
jmp 0x44e6bc
cmp dword [ebp - 0x424], 0
jne 0x44e690
mov dword [ebp - 0x464], 0
push 0x38
push 0
lea ecx, [ebp - 0x460]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x464], 0x3c
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], str.runas
lea edx, [ebp - 0x418]
mov dword [ebp - 0x454], edx
lea ecx, [ebp - 0x428]
call fcn.0044ea20
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 1
lea eax, [ebp - 0x464]
push eax
call fcn.00417df0
add esp, 4
mov dword [ebp - 0x46c], eax
lea ecx, [ebp - 0x428]
call fcn.004335b0
mov eax, dword [ebp - 0x46c]
jmp 0x44e6bc
mov dword [ebp - 0x470], 1
lea ecx, [ebp - 0x428]
call fcn.004335b0
mov eax, dword [ebp - 0x470]
jmp 0x44e6bc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x44fc30
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 0x23c]
cmp dword [eax + 0x40], 0
jne 0x44fc5a
jmp 0x44fe02
mov ecx, dword [ebp - 0x23c]
add ecx, 0x4c
call fcn.0047ef80
test eax, eax
jne 0x44fc7e
mov ecx, dword [ebp - 0x23c]
add ecx, 0x50
call fcn.0047ef80
test eax, eax
je 0x44fc83
jmp 0x44fe02
lea ecx, [ebp - 0x18]
call fcn.00444840
push 0x5129ec
lea ecx, [ebp - 0x234]
call fcn.0040f510
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x23c]
add eax, 0x28
push ecx
mov ecx, esp
push eax
call fcn.00418370
call fcn.0049b090
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.004335b0
lea ecx, [ebp - 0x18]
call fcn.0043c600
cmp eax, 1
jb 0x44fdfa
push 0
lea ecx, [ebp - 0x18]
call fcn.0048aac0
push eax
lea ecx, [ebp - 0x1c]
call fcn.00418370
lea ecx, [ebp - 0x18]
call fcn.0043c600
cmp eax, 2
jb 0x44fd15
push 1
lea ecx, [ebp - 0x18]
call fcn.0048aac0
push eax
mov ecx, dword [ebp - 0x23c]
add ecx, 0x50
call fcn.00418390
lea ecx, [ebp - 0x1c]
call fcn.00416e70
push 0
push 0x512a6c
lea ecx, [ebp - 0x1c]
call fcn.0040f570
test eax, eax
jl 0x44fd63
mov ecx, 0x535320
call fcn.00416d90
push eax
lea ecx, [ebp - 0x20]
call fcn.00418370
lea ecx, [ebp - 0x20]
call fcn.0044ea20
push eax
push 0x512a6c
lea ecx, [ebp - 0x1c]
call fcn.0041f6b0
lea ecx, [ebp - 0x20]
call fcn.004335b0
jmp 0x44fdb6
push 0
push 0x512a68
lea ecx, [ebp - 0x1c]
call fcn.0040f570
test eax, eax
jl 0x44fdb6
push 0x208
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea edx, [ebp - 0x230]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0044ea20
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040f550
lea ecx, [ebp - 0x1c]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44fdf2
push 0
lea ecx, [ebp - 0x1c]
call fcn.0044ea20
push eax
call fcn.0043f790
add esp, 8
test eax, eax
je 0x44fdf2
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x23c]
add ecx, 0x4c
call fcn.00418390
lea ecx, [ebp - 0x1c]
call fcn.004335b0
lea ecx, [ebp - 0x18]
call fcn.00444870
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x450a30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00450b40
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x450b37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x450b0e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.00444840
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.00450cf0
mov dword [ebp - 0x20], 0
jmp 0x450aa5
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
lea ecx, [ebp - 0x1c]
call fcn.0043c600
cmp dword [ebp - 0x20], eax
jae 0x450aec
cmp dword [ebp + 0x18], 0
je 0x450aea
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0048aac0
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x28]
call fcn.00450c40
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x450aea
jmp 0x450aec
jmp 0x450a9c
lea ecx, [ebp - 0x1c]
call fcn.0043c600
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 0x24], edx
lea ecx, [ebp - 0x1c]
call fcn.00423490
mov eax, dword [ebp - 0x24]
jmp 0x450b39
mov eax, dword [ebp - 0x28]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.0043c620
mov edx, dword [ebp - 0x28]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x14

Function at 0x450b40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x450b72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x450b72
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x450cf0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x244], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x450d37
jmp 0x450e0b
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x450d8a
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x450e0b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x238]
je 0x450de7
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x450de7
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x248]
call fcn.00450e20
test eax, eax
je 0x450de7
mov edx, dword [ebp - 0x238]
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0043c620
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x450d9a
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 8
Function at 0x451010
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x814], 0x400
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 8], 0
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push str.Q360SafeMainClass
push str.Q360SafeMutex_Q360DsMainMutex
push str.Q360SafeMutex
mov ecx, dword [ebp - 0x81c]
call fcn.00450a30
test eax, eax
je 0x45117d
push str.360safe_Already_runned_n
call fcn.00420df0
add esp, 4
cmp dword [ebp - 4], 0
je 0x45116a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x4510d1
xor eax, eax
jmp 0x451182
mov ecx, 0x535320
call fcn.00416890
test eax, eax
jne 0x45116a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x451132
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x818]
call fcn.0040f510
push 0
push 0x512ae8
lea ecx, [ebp - 0x818]
call fcn.0040f570
test eax, eax
jl 0x45111b
jmp 0x451127
push 9
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x818]
call fcn.004335b0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x45114c
push 5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x81c]
call fcn.00451190
xor eax, eax
jmp 0x451182
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x451190
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x820], 0
push 0x800
push 0
lea ecx, [ebp - 0x81c]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x820], 0x804
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x81c]
push ecx
call fcn.0040ee20
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x804
lea edx, [ebp - 0x820]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1388
push 1
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x4a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4

Function at 0x454770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0x512c60
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 0
jne 0x4547bc
mov eax, 1
jmp 0x4547be
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4547d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0x512c78
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 0
je 0x454819
xor eax, eax
jmp 0x45481e
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x454830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push str.UDiskAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 0
je 0x454879
xor eax, eax
jmp 0x45487e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x454890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push str.ExecAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 0
je 0x4548d9
xor eax, eax
jmp 0x4548de
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x454c10
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004ec880
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x101c], ecx
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b270
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x454c5c
push 1
mov ecx, dword [ebp - 0x101c]
call fcn.00455d70
jmp 0x454da8
mov dword [ebp - 0x1018], 0x400
mov ax, word [0x52022c]
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dx, word [0x52022c]
mov word [ebp - 0x1010], dx
push 0x7fe
push 0
lea eax, [ebp - 0x100e]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x810], 0x800
push 0x800
push 0
lea ecx, [ebp - 0x808]
push ecx
call fcn.004ebd80
add esp, 0xc
mov edx, 0x22
mov word [ebp - 0x1010], dx
push 0x3fe
lea eax, [ebp - 0x100e]
push eax
push str.safemon360Tray.exe___start
push 0
call fcn.0041b720
add esp, 0x10
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x80c]
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x454d5a
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x808]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x454d5a
mov dword [ebp - 0x1014], 1
cmp dword [ebp - 0x1014], 0
jne 0x454d9b
cmp dword [ebp + 8], 0
je 0x454d9b
lea eax, [ebp - 0x1010]
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x1010]
push ecx
push 1
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b650
add esp, 0x18
push 0
mov ecx, dword [ebp - 0x101c]
call fcn.00455d70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4
Function at 0x454dc0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x454e95
mov ax, word [0x52022c]
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004ebd80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 8], eax
push 0x104
lea edx, [ebp - 0x218]
push edx
push str.safemon360Tray.exe
push 0
call fcn.0041b720
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x454e74
push str._updatesetup
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x454e74
push 0x3e8
push 1
push 5
push str._updatesetup
lea ecx, [ebp - 0x218]
push ecx
push 0
call fcn.00456380
add esp, 0x18
jmp 0x454e93
push 0x3e8
push 1
push 5
push 0x52022c
lea edx, [ebp - 0x218]
push edx
push 0
call fcn.00456380
add esp, 0x18
jmp 0x454ead
push 0x168
mov eax, dword [ebp + 8]
push eax
push 0x416
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4

Function at 0x455470
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x45548d
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp + 8]
push ecx
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esp, ebp
pop ebp
ret 8

Function at 0x4554b0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 0
je 0x4554e4
push 4
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp + 8]
push ecx
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x4554f8
mov edx, dword [ebp + 8]
push edx
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esp, ebp
pop ebp
ret 8
Function at 0x4555e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push str.NoDriveTypeAutoRun
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp + 8], 0
je 0x455642
mov eax, dword [ebp - 0xc]
and eax, 0xfffffffb
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xffffffdf
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
and edx, 0xffffffbf
mov dword [ebp - 0xc], edx
jmp 0x45565d
mov eax, dword [ebp - 0xc]
or eax, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push str.NoDriveTypeAutoRun
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esp, ebp
pop ebp
ret 4

Function at 0x455e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x455de0
push 0
push 0
call fcn.004eddb8
add esp, 0x18
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x456380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x526af8
push 0x4ebe00
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1870
call fcn.004ec880
mov eax, dword [0x533014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1838], 0
mov dword [ebp - 0x1c], 0x400
push 0x800
push 0
lea eax, [ebp - 0x1820]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x1820]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041b720
add esp, 0x10
mov dword [ebp - 0x1880], 0
push 0x40
push 0
lea ecx, [ebp - 0x187c]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x1834], 0
xor edx, edx
mov dword [ebp - 0x1830], edx
mov dword [ebp - 0x182c], edx
mov dword [ebp - 0x1828], edx
mov dword [ebp - 0x1880], 0x44
lea eax, [ebp - 0x1880]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x1854], 1
mov cx, word [ebp + 0x14]
mov word [ebp - 0x1850], cx
mov dword [ebp - 0x1884], 0x800
xor edx, edx
mov word [ebp - 0x1020], dx
push 0xffe
push 0
lea eax, [ebp - 0x101e]
push eax
call fcn.004ebd80
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x4564ad
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004ebfed
add esp, 4
mov dword [ebp - 0x1888], eax
jmp 0x4564b7
mov dword [ebp - 0x1888], 0
mov edx, dword [ebp - 0x1888]
mov dword [ebp - 0x1824], edx
lea eax, [ebp - 0x1820]
push eax
push 0x512fec
lea ecx, [ebp - 0x1020]
push ecx
call fcn.004565b0
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x1020]
push eax
call fcn.004565e0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1834]
push ecx
lea edx, [ebp - 0x1880]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1020]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1838], eax
cmp dword [ebp - 0x1838], 0
je 0x456561
cmp dword [ebp + 0x18], 0
je 0x456547
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 0x1834]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0x1830]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1834]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
jmp 0x456584
mov eax, dword [ebp - 0x1838]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret