joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x470aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x48e57c]
mov edx, dword [eax + 0xc]
mov ecx, 0x48e57c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push ecx
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.MinorVersion
lea esi, [esp + 0x1c]
lea edi, [ebx + 1]
call fcn.00454940
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov byte [esp + 0x44], 1
call fcn.00454940
push SysReAllocStringLen
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x48], bl
call fcn.0044da20
push eax
mov byte [esp + 0x3c], 2
call fcn.00446f90
mov esi, eax
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or ebp, 0xffffffff
add esp, 4
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x446c6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x446c8d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x446d38
lea ebx, [esp + 0x14]
call fcn.004469a0
mov eax, ebx
call fcn.00446a50
mov edx, dword [esp + 0x14]
mov ecx, 2
cmp dword [edx - 0xc], ecx
jle 0x446d38
mov eax, ebx
push eax
lea eax, [ecx - 1]
lea edx, [esp + 0x1c]
call fcn.00446b00
mov edi, ebx
mov byte [esp + 0x38], 3
call fcn.00452c80
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x446cf6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push esi
call fcn.00461172
mov edi, eax
lea eax, [esi - 0x10]
add esp, 4
mov dword [esp + 0x38], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x446d22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov dword [esp + 0x38], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x446d59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x449110
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x491864]
sub esp, 0x1c
push ebx
xor ecx, ecx
push esi
push edi
cmp eax, ecx
jne 0x4492f2
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [esi + 0x4ec]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004460c0
add esp, 8
mov dword [esi + 0x4e8], eax
call fcn.004466c0
mov dword [esi + 0x4f0], eax
call fcn.00446bb0
mov dword [esi + 0x4f4], eax
call fcn.00448fb0
mov esi, eax
mov edi, dword [esi + 0xc]
mov dword [esp + 0x10], esi
cmp edi, dword [esi + 0x10]
jbe 0x449182
call fcn.004605e2
mov ebx, dword [esi]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
lea esp, [esp]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esi + 0xc], eax
jbe 0x4491a1
call fcn.004605e2
mov esi, dword [esi]
test ebx, ebx
je 0x4491ab
cmp ebx, esi
je 0x4491b0
call fcn.004605e2
cmp edi, dword [esp + 0x14]
je 0x449292
test ebx, ebx
jne 0x44927f
call fcn.004605e2
cmp edi, dword [ebx + 0x10]
jb 0x4491d1
call fcn.004605e2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
add edi, 4
push eax
mov dword [esp + 0x1c], 1
call fcn.00449030
mov esi, dword [esp + 0x20]
mov ebx, dword [edi + 0x18]
mov edi, dword [edi]
test esi, esi
je 0x4491fc
cmp esi, edi
je 0x449201
call fcn.004605e2
mov edi, dword [esp + 0x24]
cmp edi, ebx
je 0x44924c
test esi, esi
jne 0x449286
call fcn.004605e2
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x44921e
call fcn.004605e2
mov ebx, dword [ebp + 8]
movzx ecx, word [edi + 0x1e]
mov eax, dword [ebx + 0x4f8]
cmp eax, ecx
jg 0x449246
test esi, esi
jne 0x44928a
call fcn.004605e2
cmp edi, dword [esi + 0x18]
jne 0x449242
call fcn.004605e2
movzx eax, word [edi + 0x1e]
mov dword [ebx + 0x4f8], eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x44928e
call fcn.004605e2
xor eax, eax
mov edx, dword [esp + 0x1c]
cmp edx, dword [eax + 0x10]
jb 0x449269
call fcn.004605e2
add dword [esp + 0x1c], 0x24
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
jmp 0x449190
mov ebx, dword [ebx]
jmp 0x4491c7
mov eax, dword [esi]
jmp 0x449214
mov esi, dword [esi]
jmp 0x449238
mov eax, dword [eax]
jmp 0x44925b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
shr eax, 0xa
cmp ecx, 9
jne 0x4492b2
cmp eax, 1
jne 0x4492dd
jmp 0x4492df
cmp ecx, 4
jne 0x4492dd
cmp eax, 2
je 0x4492c0
cmp eax, ecx
jne 0x4492c7
mov eax, 2
jmp 0x4492df
cmp eax, 1
je 0x4492d6
cmp eax, 3
je 0x4492d6
cmp eax, 5
jne 0x4492dd
mov eax, 3
jmp 0x4492df
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x4fc], eax
mov eax, 1
mov dword [0x491864], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4498d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.00462160
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44993a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x449923
cmp eax, 4
jne 0x44993a
cmp dword [esp + 8], 0x5a
jb 0x44993a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00460259
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.00460259
add esp, 0x118
ret

Function at 0x449a50
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp + 4]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push 0
push 0
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x449aa1
xor eax, eax
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x18]
push 0x80020011
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret 8

Function at 0x449bf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xe0
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0xd8], eax
mov ecx, dword [esi + 0x59c]
push ebx
xor ebx, ebx
push ebp
xor eax, eax
push edi
cmp ecx, ebx
je 0x449d0f
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
push edx
push ecx
call eax
xor ecx, ecx
test eax, eax
setge cl
xor edx, edx
mov ebp, ecx
cmp ebp, ebx
sete dl
mov dword [esi + 0x58c], edx
cmp ebp, ebx
je 0x449d0d
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov eax, dword [esi + 0x1208]
mov ecx, dword [eax + 4]
lea edi, [esi + 0x11f0]
push ecx
mov ecx, edi
call fcn.00427fb0
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
mov dword [eax], eax
mov edi, dword [edi + 0x18]
lea eax, [esi + 0x11b8]
mov dword [edi + 8], edi
call fcn.00449ba0
push 0xc6
lea eax, [esp + 0x1e]
xor edx, edx
push ebx
push eax
mov word [esp + 0x24], dx
call fcn.00462160
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push str.lastscantime
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0xc8
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x449d0d
cmp dword [esp + 0x10], ebx
jbe 0x449d0d
lea edi, [esi + 0xbc]
lea edx, [esp + 0x18]
call fcn.00454900
mov eax, ebp
mov ecx, dword [esp + 0xe4]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00460259
add esp, 0xe0
ret
Function at 0x449ee0
Capabilities:
Modify service

Disassembly:
sub esp, 8
push ebp
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
cmp ebp, esi
je 0x449fad
push edi
push 3
push str.wuauserv
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
je 0x449fa5
lea eax, [esp + 0xc]
push eax
push esi
push esi
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x449f9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x449f9a
mov eax, dword [esp + 0xc]
push ebx
push eax
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x449f99
lea ecx, [esp + 0x10]
push ecx
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x449f92
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
push edx
mov edx, dword [esi + 0x10]
push 0
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi]
push 0
push edx
push eax
push 0xffffffffffffffff
push 3
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x449f92
mov dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 0x10]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret

Function at 0x449fc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push str.popautofixwnd
push str.SOFTWARE360SafeLeak
xor edi, edi
push SysReAllocStringLen
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], 4
mov dword [esp + 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44a016
cmp dword [esp + 8], 4
jne 0x44a016
cmp dword [esp + 0xc], edi
jbe 0x44a016
cmp dword [esp + 4], 1
je 0x44a07f
cmp dword [esi + 0x62c], edi
je 0x44a07f
mov eax, dword [esi + 0xc80]
cmp eax, 1
jne 0x44a069
cmp dword [esi + 0xc58], edi
je 0x44a069
cmp dword [esi + 0x628], edi
jne 0x44a069
push 4
lea eax, [esp + 8]
push eax
push 4
push str.popautofixwnd
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, 1
pop edi
add esp, 0xc
ret
cmp eax, 2
jne 0x44a07f
cmp dword [esi + 0x628], edi
jne 0x44a07f
push 4
lea ecx, [esp + 8]
push ecx
jmp 0x44a040
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x44a670
Capabilities:
Set registry value

Disassembly:
push ecx
cmp dword [eax + 0x458], 0
je 0x44a6a7
push 4
lea ecx, [esp + 4]
push ecx
push 4
push str.Silent
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.AutoFixTip_ok
jmp 0x44a6ac
push str.AutoFixTip_fail
push str.action_s
push str.http:__update.360safe.com_safe_leakpop.html_
push 1
mov ecx, 0x490040
call fcn.0045dc00
mov eax, 1
mov dword [esi], 0
add esp, 0x10
pop ecx
ret
Function at 0x44a6e0
Capabilities:
Create process on windows

Disassembly:
cmp dword [esp + 0x18], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
jne 0x44a83a
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ebp
push ebx
lea eax, [edi + 0x2c]
push eax
mov eax, dword [esp + 0x20]
mov ecx, esi
call fcn.00455730
test eax, eax
jne 0x44a74f
cmp dword [esp + 0x18], 0x111
jne 0x44a7bc
mov ecx, 0x8006
cmp cx, bx
jne 0x44a75b
mov edx, ebx
shr edx, 0x10
cmp ax, dx
jne 0x44a7bc
mov ecx, dword [edi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [ebp], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x802b
cmp dx, bx
jne 0x44a799
mov eax, ebx
shr eax, 0x10
xor ecx, ecx
cmp cx, ax
jne 0x44a7bc
push 5
push ecx
push ecx
push str.http:__bbs.360.cn_3451604_39153114.html
push str.Open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18
mov edx, 0x8038
cmp dx, bx
jne 0x44a7bc
mov eax, ebx
shr eax, 0x10
xor ecx, ecx
cmp cx, ax
jne 0x44a7bc
pop edi
pop esi
mov dword [ebp], ecx
pop ebp
lea eax, [ecx + 1]
pop ebx
ret 0x18
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
mov ecx, edi
mov dword [esp + 0x2c], 1
call fcn.00454e20
cmp dword [esp + 0x28], 0
mov dword [ebp], eax
jne 0x44a74f
mov eax, dword [esp + 0x18]
cmp eax, 0x110
jne 0x44a802
push edi
call fcn.0044a0f0
pop edi
pop esi
mov dword [ebp], eax
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp eax, 5
jne 0x44a843
cmp ebx, 1
je 0x44a833
mov eax, dword [esp + 0x20]
mov ecx, eax
shr ecx, 0x10
movzx eax, ax
push ecx
mov esi, edi
call fcn.0044a590
mov edx, dword [edi + 4]
push 0x105
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [ebp], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
cmp eax, 0x113
jne 0x44a86c
test ebx, ebx
jne 0x44a859
mov eax, dword [edi + 4]
push ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
mov dword [ebp], 1
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp eax, 2
jne 0x44a89a
lea esi, [esp + 0x28]
mov eax, edi
mov dword [esp + 0x28], 1
call fcn.0044a670
cmp dword [esp + 0x28], 0
mov dword [ebp], eax
je 0x44a83a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp eax, 0x201
jne 0x44a83a
mov ecx, dword [edi + 4]
push 0
push 0xf012
push 0x112
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov dword [ebp], 0
pop ebp
mov eax, 1
pop ebx
ret 0x18

Function at 0x44ac00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.MPProtect
push str.SOFTWARE360Safe_safemon
push SysReAllocStringLen
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp dword [esp], 1
sete al
add esp, 0xc
ret
Function at 0x44ac50
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x470996
mov eax, dword fs:[0]
push eax
sub esp, 0x7e8
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x7e0], eax
push ebp
push esi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x7f4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x804]
xor eax, eax
push 0x7ce
push eax
lea ecx, [esp + 0x26]
mov dword [esp + 0x14], 0
push ecx
mov word [esp + 0x28], ax
call fcn.00462160
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x7d0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
push 0x9d2b
mov dword [esp + 0x800], 0
call fcn.00454520
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x44ad2e
lea edx, [esp + 0x10]
push edx
mov eax, 0x9d2b
call fcn.00454600
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov dword [esp + 0x808], 1
call fcn.0044e380
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44ad6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x7fc], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44ad93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
lea ecx, [esp + 0x20]
call fcn.00454940
mov eax, ebp
mov ecx, dword [esp + 0x7f4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x7e0]
xor ecx, esp
call fcn.00460259
add esp, 0x7f4
ret 4
Function at 0x44add0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x470962
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 4
lea ecx, [esp + 0x28]
push ecx
push 4
mov eax, esi
neg eax
push str.MPProtect
sbb eax, eax
mov ebx, 2
push str.SOFTWARE360Safe_safemon
add eax, ebx
mov dword [esp + 0x28], 0
push SysReAllocStringLen
mov dword [esp + 0x3c], eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [esp + 0x2c], eax
mov ecx, 0x48e57c
test esi, esi
je 0x44ae87
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
push 0x9d4c
mov dword [esp + 0x3c], 0
call fcn.00454520
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x44ae78
lea edx, [esp + 0x1c]
push edx
mov eax, 0x9d4c
call fcn.00454600
mov ebx, 1
mov dword [esp + 0x38], ebx
mov edi, dword [esp + 0x1c]
jmp 0x44aeca
mov eax, dword [0x48e57c]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x9d14
mov dword [esp + 0x3c], ebx
call fcn.00454520
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x44aebe
lea eax, [esp + 0x18]
push eax
mov eax, 0x9d14
call fcn.00454600
mov dword [esp + 0x38], 3
mov edi, dword [esp + 0x18]
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
mov dword [esp + 0x14], ebx
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
push 0x9c8a
mov dword [esp + 0x3c], 4
call fcn.00454520
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x44af13
lea edx, [esp + 0x20]
push edx
mov eax, 0x9c8a
call fcn.00454600
mov esi, dword [esp + 0x20]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
mov dword [esp + 0x44], 5
call fcn.0044e380
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44af4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x38], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44af6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x38], 1
test bl, 2
je 0x44af9f
mov eax, dword [esp + 0x18]
and ebx, 0xfffffffd
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44af9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x38], 0xffffffff
test bl, 1
je 0x44afcc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44afcc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
cmp dword [esp + 0x2c], eax
sete al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x44b3e0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push str.360leakrepair_onfixing_mutex
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x44b407
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44b40e
mov eax, esi
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret

Function at 0x44b420
Capabilities:
Check if file exists
Delete registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, eax
push esi
xor ebp, ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44b4e6
push str._d__cu
call fcn.0044d980
mov edi, eax
push 0xea60
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x14], ebp
cmp eax, ebp
jne 0x44b479
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x44b479
cmp dword [esp + 0x14], 0x3600
jne 0x44b479
mov ebp, 1
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.aiAddMenu
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call ebx
push str.aiBackup
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call ebx
mov ecx, dword [esp + 0x14]
push edi
push ecx
push str._d__cu
push esi
lea edx, [esp + 0x28]
push 0x47b468
push edx
call fcn.0044e380
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44b4df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x44d5e0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
xor edi, edi
mov word [esp + 0x10], ax
call fcn.00462160
add esp, 0xc
push str.360softmgr_testdir.dat
push esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x44d64d
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x20c]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00460259
add esp, 0x20c
ret

Function at 0x44d980
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push 0x3c
lea eax, [esp + 8]
push 0
push eax
call fcn.00462160
mov ecx, dword [esp + 0x50]
add esp, 0xc
push esi
mov dword [esp + 8], 0x3c
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0x47abd0
mov dword [esp + 0x24], 5
mov dword [esp + 0xc], 0x440
call fcn.0045eb50
add esp, 4
test eax, eax
je 0x44d9d8
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x48]
push 0x47b310
push eax
call fcn.0044e380
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44da11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c]
add esp, 0x40
ret 4

Function at 0x44db10
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
or edx, 1
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44db72
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [esi + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret