joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4cffab
xor edx, edx
cmp edx, str.DailyNews
je 0x4cffab
xor eax, eax
cmp eax, str.ShowMalwareNews
je 0x4cffab
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.DailyNews
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4cff87
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.ShowMalwareNews
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret

Function at 0x4d0160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d021b
xor edx, edx
cmp edx, str.DailyNews
je 0x4d021b
xor eax, eax
cmp eax, str.AutoCountry
je 0x4d021b
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.DailyNews
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d01f7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.AutoCountry
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret
Function at 0x4d0900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
mov al, 1
mov dword [ebp - 0xc], 0
cmp ecx, str.software360TotalSecurity
je 0x4d09c0
xor edx, edx
cmp edx, str.UserProfile
je 0x4d09c0
cmp ecx, str.AutoUpdate
je 0x4d09c0
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
push ebx
mov ecx, 0x599458
call eax
push str.UserProfile
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push str.AutoUpdate
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov bl, 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4d09a3
cmp dword [ebp - 8], 4
je 0x4d09a5
xor bl, bl
lea ecx, [ebp - 4]
call fcn.00443d90
cmp bl, 1
pop ebx
jne 0x4d09be
cmp dword [ebp - 0xc], 1
sete al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4d09d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
cmp byte [ebp + 8], al
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d0a8f
xor edx, edx
cmp edx, str.UserProfile
je 0x4d0a8f
xor eax, eax
cmp eax, str.AutoUpdate
je 0x4d0a8f
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.UserProfile
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d0a6b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.AutoUpdate
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret
Function at 0x4d0e80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
cmp byte [ebp + 8], al
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d0f3f
xor edx, edx
cmp edx, str.UserProfile
je 0x4d0f3f
xor eax, eax
cmp eax, str.MenuScan
je 0x4d0f3f
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.UserProfile
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d0f1b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.MenuScan
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret
Function at 0x4d0f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
cmp ecx, 1
jne 0x4d0f6c
mov eax, 0x30003b0f
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x4d1014
xor ecx, ecx
xor edx, edx
mov eax, 0x30013f0f
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp edx, str.software360TotalSecurity
je 0x4d1008
cmp edx, str.ActiveProtection
je 0x4d1008
cmp edx, str.ExtFlags
je 0x4d1008
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.ActiveProtection
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push str.ExtFlags
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [ebp + 8]
call fcn.00443d90
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
and ecx, 0x500000
or eax, ecx
mov esp, ebp
pop ebp
ret
cmp ecx, 3
jne 0x4d1022
mov eax, 0x70533f0f
mov esp, ebp
pop ebp
ret
cmp ecx, 0xfe
jne 0x4d10f6
xor edx, edx
cmp edx, str.software360TotalSecurity
je 0x4d10ce
xor eax, eax
cmp eax, str.ActiveProtection
je 0x4d10ce
xor ecx, ecx
cmp ecx, str.CustomFlags
je 0x4d10ce
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
push ebx
mov ecx, 0x599458
call eax
push str.ActiveProtection
push str.software360TotalSecurity
lea ecx, [ebp + 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp + 8], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push str.CustomFlags
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov bl, 1
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4d10bf
cmp dword [ebp - 8], 4
je 0x4d10c1
xor bl, bl
lea ecx, [ebp + 8]
call fcn.00443d90
test bl, bl
pop ebx
jne 0x4d10f3
push 0
push 0
call fcn.004d6940
add esp, 8
cmp eax, 0xfe
jne 0x4d10e6
mov eax, 2
push eax
call fcn.004d0f50
add esp, 4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4d16c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d1787
xor edx, edx
cmp edx, str.DeepScan
je 0x4d1787
xor eax, eax
cmp eax, str.Plan
je 0x4d1787
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.DeepScan
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d1756
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Plan
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d1850
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp eax, 1
ja 0x4d192a
mov dword [ebp - 8], eax
xor eax, eax
push ebx
cmp eax, str.software360TotalSecurity
je 0x4d1920
xor ecx, ecx
cmp ecx, str.DeepScan
je 0x4d1920
xor edx, edx
cmp edx, str.Scope
je 0x4d1920
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.DeepScan
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d18ef
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Scope
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4d1aa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov cx, word [ebp + 8]
movzx eax, cx
sub esp, 8
sub eax, 1
push esi
mov si, word [ebp + 0x10]
je 0x4d1ac8
sub eax, 1
je 0x4d1ae5
sub eax, 1
jne 0x4d1aeb
cmp word [ebp + 0xc], 0x1e
ja 0x4d1aeb
push ebx
mov bx, word [ebp + 0x14]
cmp bx, 0x18
jae 0x4d1add
mov dx, word [ebp + 0x18]
cmp dx, 0x3c
jb 0x4d1af2
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp si, 6
jbe 0x4d1ac8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, 2
xor eax, eax
cmp di, cx
pop edi
jne 0x4d1b05
movzx eax, si
jmp 0x4d1b13
mov esi, 3
cmp si, cx
jne 0x4d1b13
movzx eax, word [ebp + 0xc]
movzx cx, cl
shl cx, 8
movzx eax, al
movzx ecx, cx
or ecx, eax
movzx ax, bl
shl ax, 8
movzx eax, ax
movzx edx, dl
or eax, edx
shl ecx, 0x10
add ecx, eax
xor eax, eax
mov dword [ebp - 8], ecx
cmp eax, str.software360TotalSecurity
je 0x4d1bf0
xor ecx, ecx
cmp ecx, str.DeepScan
je 0x4d1bf0
xor edx, edx
cmp edx, str.Scheme
je 0x4d1bf0
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.DeepScan
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d1bbe
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], esi
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Scheme
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor bl, bl
movzx eax, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d1ca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d1d67
xor edx, edx
cmp edx, str.DeepScan
je 0x4d1d67
xor eax, eax
cmp eax, str.Perf1
je 0x4d1d67
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.DeepScan
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d1d36
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Perf1
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d1e20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4d1ee7
xor edx, edx
cmp edx, str.DeepScan
je 0x4d1ee7
xor eax, eax
cmp eax, str.Perf2
je 0x4d1ee7
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.DeepScan
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d1eb6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Perf2
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d20c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
mov dword [ebp - 8], eax
cmp dword [0x5993b0], ebx
jne 0x4d217c
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4d222f
xor ecx, ecx
cmp ecx, str.TrashClean
je 0x4d222f
xor edx, edx
cmp edx, str.Plan
je 0x4d222f
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.TrashClean
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d2161
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Plan
push ecx
push SysReAllocString
jmp 0x4d2214
xor edx, edx
cmp edx, str.software360TotalSecurity
je 0x4d222f
xor eax, eax
cmp eax, str.TrashClean
je 0x4d222f
xor ecx, ecx
cmp ecx, str.Plan
je 0x4d222f
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.TrashClean
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d21fe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Plan
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp eax, 1
ja 0x4d258f
push ebx
xor ebx, ebx
mov dword [ebp - 8], eax
cmp dword [0x5993b0], ebx
jne 0x4d24d0
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4d2585
xor ecx, ecx
cmp ecx, str.TrashClean
je 0x4d2585
xor edx, edx
cmp edx, str.ActionType
je 0x4d2585
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.TrashClean
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d24b5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.ActionType
push ecx
push SysReAllocString
jmp 0x4d2568
xor edx, edx
cmp edx, str.software360TotalSecurity
je 0x4d2585
xor eax, eax
cmp eax, str.TrashClean
je 0x4d2585
xor ecx, ecx
cmp ecx, str.ActionType
je 0x4d2585
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.TrashClean
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d2552
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.ActionType
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
mov al, bl
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4d2ef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
mov dword [ebp - 8], eax
cmp dword [0x5993b0], ebx
jne 0x4d2fac
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4d305f
xor ecx, ecx
cmp ecx, str.TrashClean
je 0x4d305f
xor edx, edx
cmp edx, str.Perf1
je 0x4d305f
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.TrashClean
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d2f91
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Perf1
push ecx
push SysReAllocString
jmp 0x4d3044
xor edx, edx
cmp edx, str.software360TotalSecurity
je 0x4d305f
xor eax, eax
cmp eax, str.TrashClean
je 0x4d305f
xor ecx, ecx
cmp ecx, str.Perf1
je 0x4d305f
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.TrashClean
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d302e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Perf1
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3240
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
setne al
mov dword [ebp - 8], eax
cmp dword [0x5993b0], ebx
jne 0x4d32fc
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4d33af
xor ecx, ecx
cmp ecx, str.TrashClean
je 0x4d33af
xor edx, edx
cmp edx, str.Perf2
je 0x4d33af
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.TrashClean
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 8]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d32e1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.Perf2
push ecx
push SysReAllocString
jmp 0x4d3394
xor edx, edx
cmp edx, str.software360TotalSecurity
je 0x4d33af
xor eax, eax
cmp eax, str.TrashClean
je 0x4d33af
xor ecx, ecx
cmp ecx, str.Perf2
je 0x4d33af
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.TrashClean
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4d337e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Perf2
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
movzx eax, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
movzx eax, al
pop ebx
mov esp, ebp
pop ebp
ret