joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45064a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push 3
push 0x60000
push eax
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x45069c
push str.CreateFile_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x450796
push str.full
push esi
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 1
call fcn.004756c6
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfff2feaa
pop ecx
add esi, 0x1f01ff
pop ecx
cmp dword [ebp + 0x14], ebx
je 0x4506f0
mov ecx, dword [ebp - 0x18]
push 3
push 1
push esi
push edi
push 1
push dword [ebp - 0x14]
call fcn.00450436
mov edi, eax
jmp 0x450778
push 0x14
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00475410
push str.Everyone
push edi
call fcn.004756c6
add esp, 0x14
test eax, eax
jne 0x450745
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov edi, eax
cmp edi, ebx
jne 0x450733
push str.AllocateAndInitializeSid_fail
jmp 0x450772
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], eax
jmp 0x450751
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x18]
push 3
push 1
push esi
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [ebp - 0x14]
call fcn.00450323
mov edi, eax
cmp edi, ebx
je 0x450778
push str.Failed_to_add_ACE_to_object
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x45078f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp edi, ebx
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
leave
ret 0x10
Function at 0x4507a7
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x2a4]
sub esp, 0x324
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x2a0], eax
push ebx
mov ebx, dword [ebp + 0x2ac]
push esi
lea eax, [ebp - 0x7c]
push edi
push eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], 0x114
call fcn.00403cd8
pop ecx
test eax, eax
je 0x4508b1
xor edi, edi
cmp dword [ebp - 0x78], 6
jne 0x4507f5
cmp dword [ebp - 0x74], 4
je 0x450808
cmp dword [ebp - 0x78], 0xa
jne 0x4508b1
cmp dword [ebp - 0x74], edi
jne 0x4508b1
push 0x208
lea eax, [ebp + 0x98]
push edi
push eax
call fcn.00475410
add esp, 0xc
push edi
push 0x26
lea eax, [ebp + 0x98]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x98]
push eax
call fcn.00475eae
push eax
lea eax, [ebp + 0x98]
push ebx
push eax
call fcn.00477d0d
add esp, 0x10
test eax, eax
je 0x4508b1
lea eax, [ebp + 0x98]
push 0x20
push eax
call fcn.004750f0
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x450890
push str.__x86_
push esi
call fcn.004756c6
pop ecx
pop ecx
test eax, eax
jne 0x450890
lea eax, [ebp + 0x98]
sub esi, eax
sar esi, 1
dec esi
push esi
push ebx
push eax
call fcn.00477d0d
add esp, 0xc
test eax, eax
je 0x4508b1
push str.add_ac
call fcn.00404d2e
pop ecx
mov ecx, dword [ebp - 0x80]
push edi
push str.nofull
push str.ALL_APPLICATION_PACKAGES
push ebx
call fcn.0045064a
jmp 0x4508b3
xor eax, eax
mov ecx, dword [ebp + 0x2a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
add ebp, 0x2a4
leave
ret 4

Function at 0x4522ef
Capabilities:
Set registry value

Disassembly:
push 0x20
mov eax, 0x4b1976
call fcn.00476519
mov esi, ecx
push 0x4f9e00
lea ecx, [ebp - 0x28]
call fcn.0040293e
lea eax, [esi + 4]
mov edx, dword [eax + 0x10]
sub edx, dword [eax + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2c], ecx
test edx, 0xfffffff8
jne 0x452334
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x24]
push eax
jmp 0x45234e
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push eax
mov ecx, esi
call fcn.0045215f
test eax, eax
je 0x452365
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push 7
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
inc eax
call fcn.0047659c
ret
Function at 0x452c39
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4b1a62
call fcn.004764b0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 0x80000
xor ebx, ebx
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
push dword [ebp - 0x14]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004161c9
mov esi, eax
test esi, esi
je 0x452ccf
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0040b33f
test edi, edi
je 0x452cde
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
cmp edi, 0xea
jne 0x452cd5
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add eax, eax
mov dword [ebp - 0x14], eax
call fcn.00402963
inc ebx
cmp ebx, 0xa
jl 0x452c58
jmp 0x452cfc
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
jmp 0x452cff
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + 4]
push eax
push dword [ebp + 8]
push dword [ebp - 0x14]
push esi
call fcn.004528ea
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
inc eax
call fcn.00476588
ret 4

Function at 0x452d07
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4b1a62
call fcn.004764b0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 0x80000
xor ebx, ebx
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
push dword [ebp - 0x14]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004161c9
mov esi, eax
test esi, esi
je 0x452d9d
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0040b33f
test edi, edi
je 0x452dac
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
cmp edi, 0xea
jne 0x452da3
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add eax, eax
mov dword [ebp - 0x14], eax
call fcn.00402963
inc ebx
cmp ebx, 0xa
jl 0x452d26
jmp 0x452dcf
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
jmp 0x452dd2
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
push esi
call fcn.00452999
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
inc eax
call fcn.00476588
ret 0x10
Function at 0x452dda
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4b1a62
call fcn.004764b0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x14], 0x80000
xor ebx, ebx
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
push dword [ebp - 0x14]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004161c9
mov esi, eax
test esi, esi
je 0x452e70
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0040b33f
test edi, edi
je 0x452e7f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
cmp edi, 0xea
jne 0x452e76
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add eax, eax
mov dword [ebp - 0x14], eax
call fcn.00402963
inc ebx
cmp ebx, 0xa
jl 0x452df9
jmp 0x452e96
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
jmp 0x452e99
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.00452bbb
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
inc eax
call fcn.00476588
ret

Function at 0x4536e0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xc4]
sub esp, 0x144
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0xc0], eax
mov eax, dword [0x4ee018]
test eax, eax
jl 0x453712
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x45379b
and dword [0x4ee018], 0
push esi
push 0x24
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00475410
mov esi, 0x11c
push esi
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.00475410
add esp, 0x18
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x45375f
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x114
call esi
test eax, eax
je 0x453798
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x453798
lea ecx, [ebp - 0x80]
push ecx
call eax
cmp word [ebp - 0x80], 9
je 0x45378e
cmp word [ebp - 0x80], 6
jne 0x453798
xor eax, eax
inc eax
mov dword [0x4ee018], eax
jmp 0x45379a
xor eax, eax
pop esi
mov ecx, dword [ebp + 0xc0]
xor ecx, ebp
call fcn.0047548a
add ebp, 0xc4
leave
ret
Function at 0x453802
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push 0x208
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4d288c
xor esi, esi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
inc esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x453872
push str.firstaid_superkiller.exe
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4538a3
lea eax, [ebp - 0x78]
push eax
call fcn.00401e3f
pop ecx
test eax, eax
je 0x4538a3
push 0
push esi
push esi
lea eax, [ebp - 0x78]
push eax
call fcn.00401f29
test eax, eax
je 0x4538a3
mov eax, esi
jmp 0x4538a5
xor eax, eax
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop esi
call fcn.0047548a
add ebp, 0x194
leave
ret

Function at 0x4538c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x190], eax
and dword [ebp - 0x7c], 0
push esi
mov esi, dword [ebp + 0x19c]
push 0x208
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4d288c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x453947
push str.firstaid
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
jmp 0x45394c
push 0x4d3230
mov ecx, esi
call fcn.0040260e
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047548a
add ebp, 0x194
leave
ret
Function at 0x453b9e
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0xc
mov eax, 0x4b1b30
call fcn.004764b0
xor edi, edi
push 0x4f9e00
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edi
call fcn.0040293e
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0x45396b
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
jne 0x453bee
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
call fcn.00476588
ret
push 0x493e0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x453c39
cmp eax, 0xffffffff
je 0x453c23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], edi
je 0x453c1e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00401df2
mov edi, dword [ebp - 0x18]
jmp 0x453c2a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402963
mov eax, edi
jmp 0x453be8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x453c23
Function at 0x453c43
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x4b1b6b
call fcn.004764b0
mov eax, dword [ebp + 0x214]
and dword [ebp - 0x1c], 0
mov ebx, str.SuperKiller.exe
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403a22
add esp, 0xc
and dword [ebp - 4], 0
mov edi, 0x4d2f50
push edi
mov esi, 0x4bc150
push esi
lea ecx, [ebp - 0x10]
call fcn.0041db5c
xor eax, eax
push 0x206
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00475410
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040260e
push str.360SuperKillerSuperKiller.ini
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00403a22
add esp, 0xc
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00402963
push edi
push esi
lea ecx, [ebp - 0x18]
call fcn.0041db5c
push dword [ebp - 0x18]
push 0x4b8cbc
push str.PromptCP
push str.Main
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x453dda
push dword [ebp - 0x10]
call fcn.00401e3f
pop ecx
test eax, eax
je 0x453dda
xor edi, edi
push edi
push 1
push 1
push dword [ebp - 0x10]
call fcn.00401f29
test eax, eax
je 0x453dda
push 0x4f9e00
lea ecx, [ebp - 0x14]
call fcn.0040293e
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 4
call fcn.00404c45
pop ecx
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x453d80
push dword [ebp - 0x14]
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push ebx
lea ecx, [ebp - 0x14]
call fcn.00403af2
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
call esi
test eax, eax
je 0x453daf
push 5
push 0x4d3230
push ebx
jmp 0x453dc2
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x453dd2
push 5
push 0x4d3230
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x1c], 1
call fcn.004449b0
add esp, 0x10
lea ecx, [ebx - 0x10]
call fcn.00402963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x20c
leave
ret
Function at 0x453e16
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x514
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x514], eax
push 0xc
mov eax, 0x4b1ba3
call fcn.004764b0
xor ebx, ebx
push 0x4f9e00
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.0040293e
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call fcn.00453b9e
pop ecx
test eax, eax
je 0x453f54
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x453f54
xor eax, eax
push 0x40e
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0x100
mov word [ebp + 0x410], ax
lea eax, [ebp + 0x412]
push ebx
push eax
call fcn.00475410
lea eax, [ebp + 0x410]
push 0x80
push eax
call fcn.00453608
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x14
lea eax, [ebp + 0x410]
push eax
lea eax, [ebp]
push eax
call edi
lea eax, [ebp]
push eax
call esi
test eax, eax
jne 0x453ef2
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call fcn.004537b0
pop ecx
pop ecx
test eax, eax
je 0x453f54
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4bc0c8
lea eax, [ebp]
push eax
call edi
lea eax, [ebp]
push eax
call esi
test eax, eax
je 0x453f54
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040260e
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00453c43
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.00402963
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x514]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x518
leave
ret
Function at 0x454b4c
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0xc
mov eax, 0x4b1d03
call fcn.004764b0
mov esi, dword [ebp + 0x41c]
xor eax, eax
push 0x40e
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4d288c
push 0x4d2898
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0x208
mov dword [ebp - 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.360util.dll
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x454c37
lea eax, [ebp]
push eax
mov ecx, 0x4f7e20
call fcn.00454aae
test eax, eax
je 0x454c37
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00454b31
test eax, eax
mov eax, dword [ebp - 0x10]
pop ecx
jl 0x454c29
test eax, eax
je 0x454c29
test esi, esi
je 0x454c16
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], ecx
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x454c24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x454c39
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x454c37
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x414
leave
ret 4

Function at 0x454de5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push 1
push esi
lea ecx, [ebp - 8]
call fcn.00403b79
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x454e0f
push 1
push ebx
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x1c]
cmp eax, ebx
je 0x454e1b
cmp eax, 0xffffffff
jne 0x454e30
push ebx
push ebx
push esi
push 0x454dd1
push ebx
push ebx
call fcn.00475fc9
add esp, 0x18
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x18], ebx
je 0x454e5e
mov esi, dword [esi + 0x1c]
cmp esi, ebx
je 0x454e5e
cmp esi, 0xffffffff
je 0x454e5e
xor esi, esi
inc esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 8]
mov byte [ebp - 4], bl
call fcn.00417e3d
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
jmp 0x454e44
Function at 0x454efb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x4b1db0
call fcn.00476519
mov ebx, ecx
mov dword [ebp - 0x60], ebx
call fcn.00403cbb
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
lea ecx, [ebx + 0x24]
mov byte [ebp - 4], 3
call fcn.00414e96
lea edi, [ebx + 0x3c]
push 0x4f9e00
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0040293e
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
push eax
push str.setup_time
push str.SOFTWARE360Safe_stat
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 5
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x454fe6
push 0xa
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push 0xa
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x4c]
call fcn.0047a8a2
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push str._4d_2d_2d
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
call fcn.0047a82c
add esp, 0x20
push 0xffffffffffffffff
push esi
push esi
push esi
push dword [ebp - 0x48]
lea ecx, [ebp - 0x58]
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
call fcn.00454977
push dword [eax + 4]
mov ecx, dword [eax]
push ecx
push str._I64d
push 0x14
lea esi, [ebx + 0x3c]
push 0x14
mov ecx, esi
call fcn.004161c9
push eax
call fcn.00479e62
mov ecx, esi
jmp 0x455039
push esi
call fcn.00476079
pop ecx
push 0xffffffffffffffff
push esi
push esi
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
call fcn.00454a86
push eax
lea ecx, [ebp - 0x40]
call fcn.00454a6a
push eax
lea ecx, [ebp - 0x40]
call fcn.00454a4a
push eax
lea ecx, [ebp - 0x58]
call fcn.00454977
push dword [eax + 4]
mov ecx, dword [eax]
push ecx
push str._I64d
push 0x14
push 0x14
mov ecx, edi
call fcn.004161c9
push eax
call fcn.00479e62
mov ecx, edi
add esp, 0x14
push 0xffffffffffffffff
call fcn.0040b33f
mov eax, ebx
call fcn.0047659c
ret