joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006a757
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x1c
mov eax, 0x10113a38
call fcn.100604ea
mov eax, edx
mov dword [ebp - 0x1c], eax
xor esi, esi
mov edi, esi
test ecx, ecx
je 0x1006a8a0
test eax, eax
je 0x1006a8a0
push 2
push esi
push ecx
call dword [0x10127960]
mov ebx, eax
test ebx, ebx
je 0x1006a8a0
mov eax, str.FEATURE
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1006a804
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1006a804
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1006a7fb
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.1004c039
mov edi, eax
pop ecx
test edi, edi
je 0x1006a7fb
mov eax, dword [ebp - 0x10]
inc eax
push eax
push esi
push edi
call fcn.1003e610
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
call fcn.1003e090
add esp, 0x18
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x1006a8a0
push edi
lea ecx, [ebp - 0x14]
call fcn.10004ca7
push edi
mov dword [ebp - 4], esi
call fcn.10041699
pop ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.1000774b
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
push 0x2c
call fcn.1006d2fa
mov eax, dword [ebp - 0x24]
mov edi, esi
pop ecx
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1006a882
mov ebx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*4]
push ebx
call fcn.1000526f
test eax, eax
je 0x1006a87f
mov eax, dword [ebp - 0x24]
inc edi
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x1006a860
jmp 0x1006a882
xor esi, esi
inc esi
lea ecx, [ebp - 0x28]
call fcn.1000835e
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10002a86
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10002a86
mov eax, esi
call fcn.100604b3
ret
Function at 0x1006adec
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x878
mov eax, dword [0x10188074]
xor eax, esp
mov dword [esp + 0x874], eax
push esi
mov esi, ecx
mov dword [esp + 8], esi
push edi
mov edi, edx
test esi, esi
je 0x1006af99
test edi, edi
je 0x1006af99
push 0x208
lea eax, [esp + 0x674]
push 0
push eax
call fcn.1003e610
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1006ae4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str...
push esi
lea eax, [esp + 0x678]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x250
lea eax, [esp + 0x14]
push 0
push eax
call fcn.1003e610
add esp, 0xc
push 0x18
pop ecx
call fcn.10008812
test eax, eax
je 0x1006ae8f
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x674]
push ecx
call eax
jmp 0x1006aea2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x674]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006b011
lea ecx, [esp + 0x3c]
mov eax, 0x10133a08
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006aedc
test dx, dx
je 0x1006aed8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006aedc
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006aeb6
xor eax, eax
jmp 0x1006aee1
sbb eax, eax
or eax, 1
test eax, eax
je 0x1006aff7
lea ecx, [esp + 0x3c]
mov eax, 0x10132ed0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006af18
test dx, dx
je 0x1006af14
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006af18
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006aef2
xor eax, eax
jmp 0x1006af1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x1006aff7
push 0x208
lea eax, [esp + 0x46c]
push 0
push eax
call fcn.1003e610
push 0x208
lea eax, [esp + 0x270]
push 0
push eax
call fcn.1003e610
add esp, 0x18
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x3c]
push eax
push edi
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test byte [esp + 0x10], 0x10
je 0x1006afaf
lea edx, [esp + 0x260]
lea ecx, [esp + 0x468]
call fcn.1006adec
test eax, eax
jne 0x1006aff7
xor eax, eax
mov ecx, dword [esp + 0x87c]
pop edi
pop esi
xor ecx, esp
call fcn.10038cf9
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x260]
call fcn.100081c1
push 0x2a
pop ecx
call fcn.10008812
push 0
test eax, eax
je 0x1006afdd
lea ecx, [esp + 0x264]
push ecx
lea ecx, [esp + 0x470]
push ecx
call eax
jmp 0x1006aff3
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1006b016
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.100077ab
test eax, eax
jne 0x1006aead
mov ecx, esi
call fcn.1000778f
xor eax, eax
inc eax
jmp 0x1006af9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006af99

Function at 0x1006b1cd
Capabilities:
Create process on windows

Disassembly:
or dword [ecx + 4], 0x1000
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret
Function at 0x1006b74f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10191940]
mov dword [ebp - 4], ecx
push esi
test eax, eax
jne 0x1006b76e
call fcn.10003900
mov eax, dword [0x10191940]
test eax, eax
je 0x1006b79e
call eax
mov esi, eax
test esi, esi
je 0x1006b79e
cmp dword [ebp - 4], 0
je 0x1006b79e
mov ecx, dword [esi]
push 1
push str.deepscan
push esi
call dword [ecx + 0x10]
test eax, eax
je 0x1006b79e
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esi]
push 0
push esi
call dword [eax + 4]
push 4
lea eax, [ebp - 4]
push eax
push 4
push str.LasdFindCount
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [0x101916a0], 1
pop esi
leave
ret
Function at 0x1006bbbb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x10113cce
call fcn.1006051e
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x22c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x230], eax
call fcn.100029f0
push eax
lea ecx, [ebp - 0x220]
call fcn.1000281b
xor esi, esi
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], esi
call fcn.1007647f
lea ecx, [ebp - 0x228]
call fcn.1007647f
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x22c], 1
push esi
push eax
call fcn.1003e610
add esp, 0xc
mov dword [ebx], esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x22c]
push eax
push str.SpyerDate
push str.Software360Safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1006bc6d
sub ecx, edx
sar ecx, 1
jne 0x1006bc9a
lea ecx, [ebp - 0x244]
call fcn.10076369
push eax
lea ecx, [ebp - 0x228]
call fcn.10076489
jmp 0x1006bd1a
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1006bca3
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jg 0x1006bcd7
lea esi, [ecx + ecx]
mov eax, esi
call fcn.10039490
mov ecx, esp
lea edx, [ebp - 0x21c]
push 3
push esi
call fcn.10007907
mov esi, eax
push esi
lea ecx, [ebp - 0x228]
call fcn.10076436
lea ecx, [ebp - 0x228]
call fcn.10076600
push eax
lea ecx, [ebp - 0x228]
call fcn.1007661a
push eax
lea ecx, [ebp - 0x228]
call fcn.10076635
push eax
push str._d__d__d
push dword [ebp - 0x230]
call fcn.10008c51
add esp, 0x14
lea ecx, [ebp - 0x244]
call fcn.10076369
push eax
lea ecx, [ebp - 0x238]
call fcn.10076489
push 0x44
lea eax, [ebp - 0x228]
push eax
call fcn.1007649f
mov esi, eax
test esi, esi
je 0x1006bd60
js 0x1006bdbe
push esi
lea eax, [ebp - 0x220]
push 0x101338c0
push eax
call fcn.10008c51
mov dword [ebx], esi
jmp 0x1006bde7
push 0x48
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
call fcn.1007649f
test eax, eax
je 0x1006bd82
js 0x1006bdbe
push eax
push 0x101338c8
jmp 0x1006bddb
push 0x4e
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
call fcn.1007649f
test eax, eax
je 0x1006bda4
js 0x1006bdbe
push eax
push 0x101338d4
jmp 0x1006bddb
push 0x53
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
call fcn.1007649f
test eax, eax
je 0x1006bdea
jns 0x1006bdd5
push 0x1013270c
mov ecx, edi
call fcn.100026e3
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
jmp 0x1006be00
push eax
push 0x101338e0
lea eax, [ebp - 0x220]
push eax
call fcn.10008c51
add esp, 0xc
mov esi, dword [ebp - 0x220]
lea ecx, [esi - 0x10]
call fcn.10001ef7
add eax, 0x10
lea ecx, [esi - 0x10]
mov dword [edi], eax
call fcn.10002a86
mov eax, edi
lea esp, [ebp - 0x254]
call fcn.100604c8
ret
Function at 0x1006bfb2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.100029f0
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000281b
lea ecx, [ebp - 0x22c]
call fcn.1007647f
lea ecx, [ebp - 0x224]
call fcn.1007647f
push 0x208
xor esi, esi
mov dword [ebp - 0x218], 1
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1003e610
add esp, 0xc
mov dword [ebp - 0x214], 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push str.showapknotifytime
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1006c04b
sub ecx, edx
sar ecx, 1
jne 0x1006c061
or esi, 0xffffffff
jmp 0x1006c0d1
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1006c06a
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jg 0x1006c09e
lea esi, [ecx + ecx]
mov eax, esi
call fcn.10039490
mov ecx, esp
lea edx, [ebp - 0x210]
push 3
push esi
call fcn.10007907
mov esi, eax
push esi
lea ecx, [ebp - 0x224]
call fcn.10076436
lea ecx, [ebp - 0x234]
call fcn.10076369
push eax
lea ecx, [ebp - 0x22c]
call fcn.10076489
push 0x44
lea eax, [ebp - 0x224]
push eax
call fcn.1007649f
mov esi, eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.10002a86
mov eax, esi
lea esp, [ebp - 0x238]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038cf9
leave
ret
Function at 0x1006c232
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x10113d43
call fcn.100604ea
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.10004863
call fcn.100029f0
push eax
lea ecx, [ebp - 0x14]
call fcn.1000281b
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x10], edi
call fcn.100029f0
push eax
lea ecx, [ebp - 0x24]
call fcn.1000281b
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x10]
add eax, 2
push eax
mov dword [ebp - 0x10], eax
call fcn.100390c2
mov esi, eax
pop ecx
test esi, esi
je 0x1006c368
push dword [ebp - 0x10]
push edi
push esi
call fcn.1003e610
lea eax, [ebp - 0x10]
mov edx, str.SYSTEMCurrentControlSetControlSession_Manager
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push str.PendingFileRenameOperations
call fcn.10007849
add esp, 0x1c
test eax, eax
jne 0x1006c361
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
test ecx, 0xfffffffe
jbe 0x1006c361
push 2
pop ebx
xor eax, eax
cmp word [esi + ebx - 2], ax
jne 0x1006c352
push eax
push 0x1013270c
lea ecx, [ebp - 0x14]
call fcn.1000262a
call fcn.100029f0
mov ecx, dword [ebp - 0x1c]
push eax
mov eax, edi
sub eax, ecx
push eax
lea eax, [esi + ecx*2]
push eax
lea ecx, [ebp - 0x20]
call fcn.10007ce6
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.100052b3
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 1]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
call fcn.10007bda
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.10002a86
mov ecx, dword [ebp - 0x10]
mov eax, ecx
inc edi
shr eax, 1
add ebx, 2
cmp edi, eax
jl 0x1006c2ed
mov ebx, dword [ebp + 0xc]
push esi
call fcn.10038d3b
pop ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
sar esi, 2
lea ecx, [ecx - 0x10]
call fcn.10002a86
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10002a86
xor eax, eax
cmp eax, esi
sbb eax, eax
neg eax
call fcn.100604b3
ret
Function at 0x1006c847
Capabilities:
Check if file exists

Disassembly:
push 0x474
mov eax, 0x10113e20
call fcn.1006051e
mov edi, edx
mov esi, ecx
test esi, esi
jne 0x1006c868
mov eax, 0x80004005
jmp 0x1006ca97
test edi, edi
jne 0x1006ca7c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1006ca94
push 0x410
xor ebx, ebx
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.1003e610
add esp, 0xc
call fcn.100029f0
push eax
lea ecx, [ebp - 0x424]
call fcn.1000281b
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x1006ca86
push esi
lea ecx, [ebp - 0x428]
call fcn.100026e3
push 0x1013270c
push 0x10133700
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call int.10004f6b
test edi, edi
jne 0x1006c964
call fcn.100029f0
push eax
lea ecx, [ebp - 0x42c]
call fcn.1000281b
mov byte [ebp - 4], 2
lea edx, [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
call fcn.1006e920
test eax, eax
je 0x1006c929
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x428]
call fcn.100052b3
mov ecx, dword [ebp - 0x428]
lea edx, [ebp - 0x42c]
push ebx
call fcn.1006ea4e
pop ecx
test eax, eax
je 0x1006c952
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x428]
call fcn.100052b3
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.10002a86
push str.explorer.exe
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x480]
push ebx
push eax
call fcn.1003e610
add esp, 0xc
mov dword [ebp - 0x480], esi
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 5
pop eax
lea ecx, [ebp - 0x420]
mov word [ebp - 0x450], ax
mov dword [ebp - 0x454], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1006c9ba
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x424]
call fcn.10008b1c
push 0xb
push str.__select___
lea ecx, [ebp - 0x424]
call fcn.10008b1c
mov eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x424]
push dword [eax - 0xc]
push eax
call fcn.10008b1c
push 1
push 0x10132a74
lea ecx, [ebp - 0x424]
call fcn.10008b1c
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x480]
push eax
push ebx
sub esp, 0x14
lea ecx, [ebp - 0x424]
push ebx
call fcn.100025c3
mov edx, eax
call fcn.10007996
push ebx
lea ecx, [ebp - 0x424]
call fcn.100025ff
push dword [ebp - 0x438]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x43c]
call esi
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.10002a86
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.10002a86
xor eax, eax
jmp 0x1006ca97
call fcn.1006ca9d
jmp 0x1006c877
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.10002a86
xor eax, eax
inc eax
call fcn.100604c8
ret
Function at 0x1006cadd
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x63c
mov eax, 0x10113e76
call fcn.1006051e
mov esi, 0x410
lea eax, [ebp - 0x628]
xor edi, edi
push esi
push edi
push eax
mov dword [ebp - 0x62c], edi
call fcn.1003e610
add esp, 0xc
mov dword [ebp - 0x634], esi
lea eax, [ebp - 0x634]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x638], ebx
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x638]
push eax
push str.360DeepscanRunOnce
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call fcn.100029f0
push eax
lea ecx, [ebp - 0x630]
call fcn.1000281b
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x10193b38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....deepscandsmain.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x630]
push str.__s___dbootini__moduledeepscandsmainnew.dll__entryCreatePage__title360
push eax
call fcn.10008c51
mov esi, dword [ebp - 0x630]
lea eax, [ebp - 0x628]
add esp, 0xc
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1006cc66
push edi
call fcn.1004bd30
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 4
sub edi, eax
lea eax, [ebp - 0x63c]
push eax
push 4
push 0x10134f00
push str.SOFTWARE360Safe360Scan
mov dword [ebp - 0x63c], edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
and dword [ebp - 0x62c], 0
lea ecx, [ebp - 0x62c]
mov eax, dword [esi - 0xc]
push ecx
add eax, eax
push eax
push esi
sub esp, 0x14
call fcn.10081159
pop ecx
mov ecx, eax
call fcn.10081128
test eax, eax
jne 0x1006cc59
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push ebx
push str.360DeepscanRunOnce
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov dword [ebp - 0x62c], eax
jmp 0x1006cc5f
mov eax, dword [ebp - 0x62c]
xor ebx, ebx
test eax, eax
sete bl
lea ecx, [esi - 0x10]
call fcn.10002a86
mov eax, ebx
call fcn.100604c8
ret
Function at 0x1006ec71
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov dword [ebp - 8], eax
mov ebx, edx
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
mov edi, ecx
push eax
lea eax, [ebp - 0xc]
push eax
push str.QVMOpen
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
jne 0x1006ecb4
inc esi
test edi, edi
je 0x1006ece0
push dword [ebp - 8]
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push str.QVMOpen
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1006ece7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov dword [ebp - 8], eax
mov ebx, edx
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
mov edi, ecx
push eax
lea eax, [ebp - 0xc]
push eax
push str.DeepScanQVM
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
jne 0x1006ed2a
inc esi
test edi, edi
je 0x1006ed56
push dword [ebp - 8]
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push str.DeepScanQVM
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1006ed5d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov dword [ebp - 8], eax
mov ebx, edx
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
mov edi, ecx
push eax
lea eax, [ebp - 0xc]
push eax
push str.KunpengOpen
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
jne 0x1006eda0
inc esi
test edi, edi
je 0x1006edcc
push dword [ebp - 8]
xor eax, eax
test ebx, ebx
setne al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push str.KunpengOpen
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1006edd3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 4
pop eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0xc]
push eax
push str.HeuristicOpen
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
jne 0x1006ee10
inc esi
mov eax, esi
pop esi
leave
ret

Function at 0x1006efc1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0xa0]
push 0x18
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
rep movsd dword es:[edi], dword [esi]
push 0xe
pop ecx
movsw word es:[edi], word [esi]
mov esi, str.PendingFileRenameOperations
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
mov edi, 0x100000
push edi
call fcn.1004c039
mov esi, eax
pop ecx
test esi, esi
je 0x1006f071
push edi
xor edi, edi
push edi
push esi
call fcn.1003e610
add esp, 0xc
mov dword [ebp - 0xa4], 0x100000
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], 7
push eax
push esi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xa0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [esi], di
je 0x1006f068
mov edx, dword [ebp - 0xa4]
mov ecx, esi
push ebx
shr edx, 1
call fcn.1006ef13
pop ecx
mov edi, eax
push esi
call fcn.10041699
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038cf9
leave
ret

Function at 0x1006f541
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
and dword [ebp - 4], 0
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push edi
push 4
pop eax
mov dword [ebp - 8], eax
mov edi, str.SOFTWARE360Safe360Scan
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.TZoneLoaded
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 4
lea eax, [ebp - 4]
xor ebx, ebx
cmp dword [ebp - 4], ebx
push eax
push 4
push str.TZoneLoaded
push edi
push esi
setne bl
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1006fa28
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
call fcn.1009fa4d
test eax, eax
je 0x1006fa59
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1006fa5b
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push eax
push eax
push 1
push dword [esi + 0x1c]
call fcn.1006b518
add esp, 0x10
pop esi
ret
xor eax, eax
pop esi
ret