joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4236b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetMalloc]
push edi
lea eax, [esp + 0xc]
push eax
call esi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ebx, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jl 0x42371c
lea ecx, [esp + 0x10]
push ecx
push 0x23
push 0
call edi
test eax, eax
jl 0x423710
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call ebx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0xc]
push eax
call esi
test eax, eax
jl 0x42375f
lea ecx, [esp + 0x10]
push ecx
push 0x1a
push 0
call edi
test eax, eax
jl 0x423753
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call ebx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00461862
add esp, 0x214
ret

Function at 0x423910
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x180c
call fcn.00462620
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x1808], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x423a32
test esi, esi
je 0x423a32
push 0x800
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00461880
add esp, 0xc
push edi
push esi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x10]
push edx
call ebx
test eax, eax
jne 0x423a32
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x423a32
push 0x80
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4239ab
lea edx, [esp + 0x10]
push edx
call ebx
push 0x800
lea eax, [esp + 0x814]
push 0
mov ecx, 0x200
lea esi, [esp + 0x18]
lea edi, [esp + 0x1018]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00461880
add esp, 0xc
lea ecx, [esp + 0x1010]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x810]
push edx
push 0
push 0x487a6c
lea eax, [esp + 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 0x810]
push ecx
call ebx
lea edx, [esp + 0x810]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x423a32
push 4
push 0
lea ecx, [esp + 0x818]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x1814]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00461862
mov esp, ebp
pop ebp
ret 8
Function at 0x423e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47ec88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi], vtable.C360SafeOldInstallFeature.0
mov dword [esi + 4], eax
mov ecx, dword [0x4a1014]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov edx, dword [0x4a1014]
mov dword [esp + 0x14], eax
mov dword [esi + 0x10], edx
mov ecx, dword [0x4a1014]
mov dword [esi + 0x14], ecx
mov edx, dword [0x4a1014]
mov dword [esi + 0x18], edx
mov ecx, dword [0x4a1014]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x4a1014]
mov dword [esi + 0x20], edx
mov ecx, dword [0x4a1014]
mov dword [esi + 0x2c], ecx
mov edx, dword [0x4a1014]
mov dword [esi + 0x30], edx
mov ecx, dword [esi + 4]
mov byte [esp + 0x14], 7
mov dword [esi + 0x24], eax
cmp ecx, eax
je 0x423ee9
call fcn.0043f760
mov dword [esi + 0x24], eax
mov ecx, esi
call fcn.00423c10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x423f10
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47ecbb
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x818]
mov dword fs:[0], eax
mov esi, dword [esp + 0x828]
test esi, esi
je 0x42400d
push 0x800
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00461880
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push str.SOFTWAREKasperskyLabSetupFolders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42400d
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0xc]
call fcn.0041deb0
lea ecx, [esp + 8]
mov dword [esp + 0x820], 0
call fcn.00423a70
push 0x22
lea ecx, [esp + 0xc]
call fcn.00423b40
lea ecx, [esp + 8]
call fcn.00423ad0
push 0x22
lea ecx, [esp + 0xc]
call fcn.00423ba0
mov edx, dword [esp + 8]
push str.avp.exe
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
test eax, eax
jne 0x424011
call fcn.0041c130
xor eax, eax
jmp 0x42401b
call fcn.0041c130
mov eax, 1
mov ecx, dword [esp + 0x818]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.00461862
add esp, 0x81c
ret 4
Function at 0x424460
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0x218
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x228]
mov dword [esp + 0x10], 0x104
test edi, edi
je 0x4244fe
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push edi
push 0
mov dword [esp + 0x28], 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4244fe
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4244fe
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4244fe
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push 0
call ebx
test eax, eax
je 0x4244f7
mov eax, esi
jmp 0x424500
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00461862
add esp, 0x218
ret 4

Function at 0x4245b0
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
je 0x424644
lea ecx, [esp]
push ecx
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
jne 0x424644
push edi
mov edi, dword [esp + 8]
add edi, 0xffffffff
js 0x424643
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
push esi
mov esi, edi
shl esi, 5
jmp 0x424600
mov ecx, dword [esp + 0x20]
cmp dword [esi + eax + 4], ecx
jne 0x424638
test ebx, ebx
je 0x424628
cmp dword [esi + eax + 0x14], 0
jne 0x424638
push ebx
lea edx, [esi + eax + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTrusteeNameW]
push eax
call ebp
test eax, eax
je 0x424634
mov eax, dword [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
mov eax, dword [esp + 0x10]
dec edi
sub esi, 0x20
test edi, edi
jge 0x424600
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
Function at 0x424e20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x47edff
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CCommandParser.0
mov eax, dword [0x4a1014]
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, dword [0x4a1014]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esi + 8], ecx
mov edx, dword [0x4a1014]
mov dword [esi + 0xc], edx
mov ecx, dword [0x4a1014]
mov dword [esi + 0x10], ecx
mov edx, dword [0x4a1014]
mov dword [esi + 0x14], edx
mov ecx, 1
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x54], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 4
call fcn.0041deb0
lea ecx, [esp + 0x20]
push ecx
mov ecx, edi
mov byte [esp + 0x1c], 5
call fcn.0041ca20
mov eax, dword [esp + 0x20]
lea edx, [eax - 0xc]
cmp edx, dword [0x4a1010]
je 0x424f02
lea edi, [eax - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x424f02
push edi
call fcn.00461ef0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x426de0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47efd3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esi + 0x24]
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.CCustomizeMessageBox.0
call fcn.0041deb0
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 1
call fcn.0041deb0
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x44], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], ecx
mov dword [esi + 0x40], edx
mov dword [esi + 0x3c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x1c

Function at 0x427280
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.00425dc0
mov eax, dword [esi + 0x38]
test eax, eax
jle 0x42730e
cmp dword [esi + 0x30], 0
je 0x42730e
push ebp
xor ebp, ebp
test eax, eax
jle 0x427309
xor ebx, ebx
mov ecx, dword [esi + 4]
lea eax, [ebp + 0xee]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x427309
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x30]
lea eax, [ebx + edx + 4]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x30]
mov edx, dword [ebx + ecx]
push edx
push 0xfffffffffffffff4
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 0x30]
mov ecx, dword [ebx + eax]
push 4
push str.Common_button_small.png
push ecx
mov ecx, esi
call fcn.00427030
mov edx, dword [esi + 4]
push edi
push edx
mov ecx, esi
call fcn.00426a10
inc ebp
add ebx, 0x44
cmp ebp, dword [esi + 0x38]
jl 0x4272a0
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xee
push eax
call edi
push 0x487bc8
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 4]
push 0xee
push ecx
call edi
push 1
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 4]
push 0xee
push edx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call ebx
mov eax, dword [esi + 4]
push 0xee
push eax
call edi
push 0
push eax
call ebx
mov ecx, dword [esi + 4]
push 0xee
push ecx
call edi
push 0
push eax
call ebx
pop edi
pop esi
pop ebx
ret
Function at 0x427380
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
mov dword [esp + 0x10], 0
test edi, edi
je 0x42740d
call fcn.00437030
test eax, eax
je 0x4273b3
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x2719
push edi
push eax
mov eax, dword [ecx + 0x20]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42740d
push 1
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x20], 0x12c
mov dword [esp + 0x24], 0x82
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 7
push str.Setupmsgboxbkg.png
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push 5
push eax
call edx
mov eax, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7fbc
push eax
mov dword [esp + 0x14], 0
call ebx
mov edi, eax
mov dword [esp + 0xc], 0
test edi, edi
je 0x4274b1
call fcn.00437030
test eax, eax
je 0x427450
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x27d8
push edi
push eax
mov eax, dword [ecx + 0x20]
call eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4274b1
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push 0
push 0
push eax
call edx
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
push 0
call edx
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push 0
call edx
mov eax, dword [esi + 4]
push 0x491898
push str.DynamicTitleBar
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
test edi, edi
je 0x4274b1
push 0x487d5c
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
push str.Common_sys_button_close.png
push 0xf2
mov ecx, esi
call fcn.00427030
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 4]
push ecx
push 0xf2
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esi + 0x44], 0
jne 0x4274f4
mov eax, dword [esi + 4]
push 0
push 0xf2
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x427b10
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [ecx + 4]
push esi
push edi
push 0x42c
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x12]
push edx
mov esi, eax
mov word [esp + 0x14], cx
call fcn.00461880
add esp, 0xc
push 0x103
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 8]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427b70
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
sub eax, edx
sar eax, 1
push eax
push eax
push 0xb1
push esi
call edi
push 0
push 0
push 0xb7
push esi
call edi
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.00461862
add esp, 0x20c
ret
Function at 0x4284d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x24
push ebp
push esi
test ecx, ecx
je 0x4284de
lea ebp, [ecx - 0x50]
jmp 0x4284e0
xor ebp, ebp
cmp dword [esp + 0x3c], 0
mov ecx, dword [ebp + 4]
je 0x428567
mov eax, dword [esp + 0x30]
push ebx
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [esp + 0x3c]
mov edi, eax
push edi
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0041c3e0
test eax, eax
je 0x42855b
mov edx, dword [esi]
mov dword [edx - 8], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + edi*2], cx
mov eax, dword [esi]
test eax, eax
je 0x42855b
lea edx, [edi + 1]
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.0041c4e0
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi]
mov dword [ecx - 8], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
cmp dword [esp + 0x10], edi
pop edi
pop ebx
jge 0x4285b6
xor esi, esi
jmp 0x428580
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, eax
test esi, esi
jne 0x4285ac
push 0xffffffffffffffff
add ebp, 0x50
call dword [sym.imp.USER32.dll_MessageBeep]
test ebp, ebp
je 0x428594
lea eax, [ebp - 0x50]
jmp 0x428596
xor eax, eax
mov edx, dword [esp + 0x30]
mov eax, dword [eax + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, esi
pop esi
pop ebp
add esp, 0x24
ret 0x18
cmp dword [esp + 0x40], 0
je 0x4285e9
mov ecx, dword [esi]
mov edx, dword [ecx - 8]
cmp edx, dword [esp + 0x44]
jle 0x4285e9
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
lea ecx, [ebp + 0x50]
call fcn.00427ae0
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret 0x18
pop esi
mov eax, 1
pop ebp
add esp, 0x24
ret 0x18
Function at 0x428e50
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x47f148
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [0x4923cc]
mov dx, word [esp + 0x3c]
mov esi, ecx
mov ecx, dword [0x4923d0]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov ecx, esi
mov word [esp + 0x20], dx
call fcn.0043bce0
test eax, eax
je 0x429040
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, esi
cmp eax, 3
je 0x429044
call fcn.0043bac0
mov edi, eax
test edi, edi
je 0x428f63
cmp dword [esp + 0x40], 0
jne 0x428f63
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041d020
mov ebx, eax
push 0x9f
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call fcn.0041d020
mov ebx, dword [ebx]
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push 1
push 0x30
push ebx
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x48], 1
call fcn.004414c0
lea ecx, [esp + 0x10]
call fcn.0041c130
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.0041c130
mov ecx, edi
call fcn.00424940
mov ecx, eax
call fcn.00424940
cmp dword [eax], 0
je 0x429040
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
push 0xffffffffffffffff
call eax
xor eax, eax
jmp 0x42904f
push 0x9f
lea ecx, [esp + 0x14]
call fcn.0041d020
mov eax, dword [eax]
add esi, 0x58
push eax
mov ecx, esi
mov dword [esp + 0x38], 2
call fcn.0041ca80
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
mov dword [esp + 0x34], 0xffffffff
cmp ecx, dword [0x4a1010]
je 0x428fbd
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428fbd
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00461ef0
add esp, 4
push 0xe2
lea ecx, [esp + 0x18]
call fcn.0041d020
mov eax, dword [eax]
push esi
push eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x40], 3
call fcn.0041e060
push eax
mov ecx, esi
mov byte [esp + 0x38], 4
call fcn.0041ca20
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x429017
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x429017
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00461ef0
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x429040
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x429040
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00461ef0
add esp, 4
xor eax, eax
jmp 0x42904f
call fcn.0043bb30
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00461862
add esp, 0x28
ret 8
Function at 0x429070
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47f186
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x244]
mov esi, dword [esp + 0x248]
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov word [esp + 0x30], ax
call fcn.00461880
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x34], 1
call edi
test eax, eax
jne 0x42913f
cmp dword [esp + 0x14], ebx
jbe 0x42913f
mov eax, dword [ebp]
lea edx, [esp + 0x24]
push edx
push eax
call fcn.00462130
add esp, 8
test eax, eax
jne 0x42913f
push 0x258
mov ecx, esi
call fcn.0041cf30
mov ebx, 1
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.00461880
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x34], 1
call edi
test eax, eax
jne 0x4291bb
cmp dword [esp + 0x14], eax
jbe 0x4291bb
mov ebp, dword [ebp]
lea edx, [esp + 0x24]
push edx
push ebp
call fcn.00462130
add esp, 8
test eax, eax
jne 0x4291bb
push 0x259
mov ecx, esi
call fcn.0041cf30
mov eax, 1
jmp 0x4291bf
mov eax, dword [esp + 0x18]
test ebx, ebx
jne 0x42921f
test eax, eax
jne 0x42921f
mov eax, dword [esp + 0x240]
dec eax
cmp eax, 8
ja case.0x4291d4.8
jmp dword [eax*4 + 0x4292e0]
push 0x9e
jmp 0x429218
push 0xa0
jmp 0x429218
push 0xa1
jmp 0x429218
push 0xa2
jmp 0x429218
push 0xa3
jmp 0x429218
push 0xd5
jmp 0x429218
push 0x9d
jmp 0x429218
push 0xae
jmp 0x429218
push 0xd6
mov ecx, esi
call fcn.0041cf30
push 0xe2
lea ecx, [esp + 0x1c]
call fcn.0041d020
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x244], 0
call fcn.0041e060
push eax
mov ecx, esi
mov byte [esp + 0x23c], 1
call fcn.0041ca20
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x429285
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x429285
mov edx, dword [esp + 0x20]
add edx, 0xfffffff4
push edx
call fcn.00461ef0
add esp, 4
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a1010]
je 0x4292ae
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4292ae
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00461ef0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00461862
add esp, 0x228
ret 0xc