joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568b6b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5c5678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x238], edi
test byte [0x5d3814], 1
lea ebx, [edi + 7]
jne 0x45d789
or dword [0x5d3814], 1
xor eax, eax
push 0x57cac0
mov dword [0x5d3810], ebx
mov dword [0x5d380c], edi
mov word [0x5d37fc], ax
call fcn.0053d8c3
add esp, 4
cmp byte [0x5d3231], 1
jne 0x45d7a3
xor ecx, ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
jmp 0x45d887
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push edi
push eax
mov word [ebp - 0x218], dx
call fcn.00545940
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45d874
xor edx, edx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
lea eax, [ebp - 0x238]
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x218]
push eax
push ecx
call fcn.00405600
add esp, 8
test al, al
je 0x45d840
mov edx, dword [ebp - 0x238]
push edx
lea ecx, [ebp - 0x234]
call fcn.004059f0
add esp, 4
test al, al
je 0x45d840
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
push eax
mov eax, 0x5d37f8
call fcn.00412610
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x45d85f
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.0053d782
add esp, 4
xor edx, edx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], dx
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov byte [0x5d3231], 1
mov word [esi + 4], ax
push 0xffffffffffffffff
push edi
push 0x5d37f8
mov eax, esi
call fcn.00412610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d78d
mov esp, ebp
pop ebp
ret
Function at 0x45dba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dc99
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x34]
call fcn.00409e10
mov dword [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x45dbf2
mov eax, dword [eax + 4]
jmp 0x45dbf5
add eax, 4
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.00425130
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 8
jb 0x45dc16
mov edx, dword [ebp - 0x30]
push edx
call fcn.0053d782
add esp, 4
mov edx, dword [0x5ce94c]
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], esi
call eax
add eax, 0x10
mov dword [edi], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
mov esi, str.profile_premium.jpg
mov dword [ebp - 0x14], 1
call fcn.004236c0
add esp, 8
mov byte [ebp - 4], 4
call fcn.00425450
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45dc83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45dc98
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x45dced
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp + 0xc]
push eax
mov esi, str.profile.jpg
call fcn.004236c0
add esp, 8
mov byte [ebp - 4], 5
call fcn.00425450
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45dcd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45dced
mov esi, edi
call fcn.00425260
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45dd10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45dd30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dc38
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x34]
call fcn.00409e10
xor esi, esi
mov edi, 8
mov dword [ebp - 4], esi
cmp dword [eax + 0x18], edi
jb 0x45dd74
mov eax, dword [eax + 4]
jmp 0x45dd77
add eax, 4
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00425130
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], edi
jb 0x45dd97
mov edx, dword [ebp - 0x30]
push edx
call fcn.0053d782
add esp, 4
mov edx, dword [0x5ce94c]
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], esi
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
mov esi, str.profile_premium.jpg
mov byte [ebp - 4], 3
call fcn.004236c0
add esp, 8
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00425450
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45de05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call ebx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
mov esi, str.profile.jpg
call fcn.004236c0
add esp, 8
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00425450
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45de55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x10]
push esi
call ebx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45de7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45dea1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ed00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563ce8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045ee20
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x45ed38
lea eax, [ebx + 1]
jmp 0x45ed42
cmp eax, 1
jne 0x45ed42
mov eax, 2
mov dword [ebp - 0x14], eax
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x45ee04
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x45ee04
xor edx, edx
cmp edx, str.DeviceStatus
je 0x45ee04
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0043d4e0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x45edc8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0x10]
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push str.DeviceStatus
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [ebp - 0x10]
sete bl
call fcn.0046d830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ee20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562c00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp eax, str.software360TotalSecurity
je 0x45ef8e
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x45ef8e
xor edx, edx
cmp edx, str.DeviceStatus
je 0x45ef8e
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0043d4e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
push str.DeviceStatus
push eax
push SysReAllocString
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x45eedf
cmp dword [ebp - 0x18], 4
je 0x45eee2
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0046d830
cmp byte [ebp - 0xd], bl
je 0x45ef8c
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jbe 0x45ef8e
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
mov dword [ebp - 0x24], ebx
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0043d4e0
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x45ef68
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x18]
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push str.DeviceStatus
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [ebp - 0x18]
call fcn.0046d830
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fb90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], esi
cmp eax, str.software360TotalSecurity
je 0x45fc43
xor ecx, ecx
cmp ecx, str.Experience
je 0x45fc43
xor edx, edx
cmp edx, str.AccountFlags
je 0x45fc43
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.Experience
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0043d4e0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push str.AccountFlags
push eax
push SysReAllocString
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.0046d830
mov eax, dword [ebp - 0x14]
or eax, 1
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
cmp ecx, str.software360TotalSecurity
je 0x45fcfb
xor edx, edx
cmp edx, str.Experience
je 0x45fcfb
xor eax, eax
cmp eax, str.AccountFlags
je 0x45fcfb
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push str.Experience
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0043d4e0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x45fcd7
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x18]
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.AccountFlags
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [ebp - 0x18]
call fcn.0046d830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x463670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563148
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463744
test edi, edi
je 0x463744
cmp dword [ebp + 8], eax
je 0x463744
test esi, esi
je 0x463744
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043d4e0
mov edx, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
mov edi, 4
push esi
mov bl, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x463727
cmp dword [ebp - 0x14], edi
je 0x463729
xor bl, bl
lea eax, [ebp - 0x10]
call fcn.0046d830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563148
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463843
test edi, edi
je 0x463843
test esi, esi
je 0x463843
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043d4e0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add esp, 0xc
push ecx
mov ecx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0x10]
push esi
push ecx
mov bl, 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x46380a
cmp dword [ebp - 0x14], 3
je 0x46380c
xor bl, bl
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46382f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a5e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463951
test edi, edi
je 0x463951
test esi, esi
je 0x463951
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043d4e0
mov edx, dword [ebp + 8]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0x10]
push esi
push ecx
mov bl, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x463918
mov eax, dword [ebp - 0x14]
cmp eax, 0xb
je 0x46391a
cmp eax, 4
je 0x46391a
xor bl, bl
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46393d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463970
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463a4b
xor ebx, ebx
cmp edi, ebx
je 0x463a4b
cmp dword [ebp + 8], ebx
je 0x463a4b
cmp esi, ebx
je 0x463a4b
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0043d4e0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x463a14
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ecx
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [ebp - 0x14]
sete bl
call fcn.0046d830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b68
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463b60
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x463b60
xor ebx, ebx
cmp esi, ebx
je 0x463b60
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0043d4e0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x463b0a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 3
push esi
mov esi, dword [ebp - 0x14]
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [esi - 0x10]
sete bl
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x463b4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463b80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b68
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x14]
mov edi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463c73
xor esi, esi
cmp edi, esi
je 0x463c73
cmp dword [ebp + 8], esi
je 0x463c73
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0043d4e0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x463c20
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push ecx
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [esi - 0x10]
sete bl
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x463c5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463c90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563118
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x463d36
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x463d36
test esi, esi
je 0x463d36
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043d4e0
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push esi
push ecx
push SysReAllocString
mov bl, 1
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x463d1b
xor bl, bl
lea eax, [ebp - 0x10]
call fcn.0046d830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret