joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461c1d
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4dffd4
call fcn.004b5417
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], eax
mov esi, 0x53eda8
test byte [0x53eda4], bl
jne 0x461c77
or dword [0x53eda4], ebx
mov dword [ebp - 4], ebx
push edi
mov ecx, esi
mov dword [0x53edc0], 7
call fcn.0040daa0
push 0x4ef618
call fcn.004b78c0
pop ecx
mov byte [ebp - 4], 0
cmp byte [0x53eda0], bl
jne 0x461c90
mov ecx, dword [ebp - 0x238]
push esi
call fcn.0040c600
jmp 0x461d4b
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b47e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x461d39
push edi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x21c], 7
call fcn.0040daa0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x218]
call fcn.00445e05
pop ecx
pop ecx
test al, al
je 0x461d28
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x240]
call fcn.0045910b
pop ecx
pop ecx
test al, al
je 0x461d28
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
call fcn.0040d3a0
mov byte [ebp - 4], 0
push edi
push ebx
lea ecx, [ebp - 0x234]
call fcn.0040d590
mov ecx, dword [ebp - 0x238]
push esi
mov byte [0x53eda0], bl
call fcn.0040c600
mov dword [ebp - 4], edi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp - 0x238]
call fcn.004b549a
ret

Function at 0x461d60
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4e003a
call fcn.004b5417
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], eax
mov esi, 0x53edcc
test byte [0x53edc8], bl
jne 0x461dba
or dword [0x53edc8], ebx
mov dword [ebp - 4], ebx
push edi
mov ecx, esi
mov dword [0x53ede4], 7
call fcn.0040daa0
push 0x4ef627
call fcn.004b78c0
pop ecx
mov byte [ebp - 4], 0
cmp byte [0x53edc4], bl
jne 0x461dd3
mov ecx, dword [ebp - 0x238]
push esi
call fcn.0040c600
jmp 0x461e8e
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b47e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x461e7c
push edi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x21c], 7
call fcn.0040daa0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x218]
call fcn.00445e05
pop ecx
pop ecx
test al, al
je 0x461e6b
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x240]
call fcn.00458f89
pop ecx
pop ecx
test al, al
je 0x461e6b
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
call fcn.0040d3a0
mov byte [ebp - 4], 0
push edi
push ebx
lea ecx, [ebp - 0x234]
call fcn.0040d590
mov ecx, dword [ebp - 0x238]
push esi
mov byte [0x53edc4], bl
call fcn.0040c600
mov dword [ebp - 4], edi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp - 0x238]
call fcn.004b549a
ret
Function at 0x461fd6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4dc3d2
call fcn.004b53ae
xor esi, esi
cmp dword [ebp + 0x14], esi
je 0x46205a
cmp dword [ebp + 8], esi
je 0x46205a
cmp dword [ebp + 0xc], esi
je 0x46205a
cmp dword [ebp + 0x18], esi
je 0x46205a
lea ecx, [ebp - 0x10]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
push 4
mov dword [ebp - 0x14], esi
pop esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov bl, 1
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x462048
cmp dword [ebp - 0x14], esi
je 0x46204a
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
mov al, bl
jmp 0x46205c
xor al, al
call fcn.004b5486
ret

Function at 0x462062
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x4e0113
call fcn.004b53ae
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x4620db
cmp dword [ebp + 8], esi
je 0x4620db
cmp dword [ebp + 0xc], esi
je 0x4620db
lea ecx, [ebp - 0x10]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push dword [ebp + 0x10]
mov bl, 1
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
push dword [ebp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4620c9
cmp dword [ebp - 0x14], 3
je 0x4620cb
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
mov al, bl
jmp 0x4620dd
xor al, al
call fcn.004b5486
ret

Function at 0x4620e3
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4e00c7
call fcn.004b53ae
xor esi, esi
cmp dword [ebp + 0x14], esi
je 0x46217d
cmp dword [ebp + 8], esi
je 0x46217d
cmp dword [ebp + 0xc], esi
je 0x46217d
cmp dword [ebp + 0x18], esi
je 0x46217d
lea ecx, [ebp - 0x14]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x14]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46214e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
mov al, bl
jmp 0x46217f
xor al, al
call fcn.004b5486
ret
Function at 0x462185
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4e00c7
call fcn.004b53ae
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x462216
cmp dword [ebp + 8], esi
je 0x462216
cmp dword [ebp + 0xc], esi
je 0x462216
lea ecx, [ebp - 0x14]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4621e7
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
mov al, bl
jmp 0x462218
xor al, al
call fcn.004b5486
ret

Function at 0x46221e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4e00c7
call fcn.004b53ae
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x4622af
cmp dword [ebp + 8], esi
je 0x4622af
cmp dword [ebp + 0xc], esi
je 0x4622af
lea ecx, [ebp - 0x14]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462280
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
mov al, bl
jmp 0x4622b1
xor al, al
call fcn.004b5486
ret

Function at 0x462435
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4dc3d2
call fcn.004b53ae
xor eax, eax
mov ebx, str.software360TotalSecurity
cmp eax, ebx
je 0x4624be
mov edi, str.FullCheck
cmp eax, edi
je 0x4624be
mov esi, str.Options
cmp eax, esi
je 0x4624be
lea ecx, [ebp - 0x10]
call fcn.004413bb
and dword [ebp - 4], 0
push edi
push ebx
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp - 0x14], 0
add esp, 0x10
push 4
pop edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
mov bl, 1
push 0x80000001
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4624ac
cmp dword [ebp - 0x14], edi
je 0x4624ae
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
mov al, bl
jmp 0x4624c0
xor al, al
call fcn.004b5486
ret
Function at 0x4624c6
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4e0113
call fcn.004b53ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x462559
mov edi, str.FullCheck
cmp eax, edi
je 0x462559
mov ebx, str.Options
cmp eax, ebx
je 0x462559
lea ecx, [ebp - 0x10]
call fcn.004413bb
and dword [ebp - 4], 0
push edi
push esi
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp + 8], 0
add esp, 0x10
lea eax, [ebp + 8]
push eax
push esi
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46253a
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp + 8], 0
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
call fcn.004b5486
ret

Function at 0x46255f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4e0136
call fcn.004b53ae
and dword [ebp - 0x10], 0
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4625dd
mov ebx, str.FullCheck
cmp eax, ebx
je 0x4625dd
mov edi, str.Options
cmp eax, edi
je 0x4625dd
lea ecx, [ebp - 0x14]
call fcn.004413bb
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 0x14]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp - 0x1c], 0
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x4625eb
or dword [ebp - 0x10], eax
jmp 0x4625f0
not eax
and dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.004624c6
pop ecx
call fcn.004b5486
ret
Function at 0x462e04
Capabilities:
Encode data using xor

Disassembly:
push 0x6c
mov eax, 0x4e022b
call fcn.004b5417
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], edi
cmp dword [esi + 0x14], ebx
jne 0x462e3e
mov ecx, edi
call fcn.0040c310
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 1
mov eax, edi
jmp 0x462f38
cmp eax, ebx
jne 0x462e47
mov eax, str.Experience
push eax
lea ecx, [ebp - 0x78]
call fcn.0040c330
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00460cfd
mov byte [ebp - 4], 0
push ebx
push edi
lea ecx, [ebp - 0x78]
call fcn.0040d2f0
push 0xf
pop ebx
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.0040d1d0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
push esi
lea ecx, [ebp - 0x4c]
call fcn.004612b1
push 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], ebx
call fcn.0040d1d0
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.00431b50
movsx ebx, byte [eax]
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
test eax, eax
jbe 0x462eeb
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
call fcn.0043fd28
mov cl, bl
add cl, byte [ebp - 0x4c]
xor cl, byte [eax]
mov byte [ebp - 0x5c], cl
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x48]
push edi
call fcn.00432b50
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x50]
jb 0x462ebf
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.00431b50
mov al, byte [eax]
mov byte [ebp - 0x50], al
push dword [ebp - 0x50]
lea ecx, [ebp - 0x48]
push edi
call fcn.00432b50
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.0040c370
mov dword [ebp - 0x58], edi
mov byte [ebp - 4], 2
push 0
push edi
lea ecx, [ebp - 0x48]
call fcn.0040d2f0
mov byte [ebp - 4], 0
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov eax, dword [ebp - 0x54]
call fcn.004b549a
ret
Function at 0x462f3e
Capabilities:
Encode data using xor

Disassembly:
push 0x70
mov eax, 0x4e0281
call fcn.004b5417
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], eax
cmp dword [esi + 0x14], edi
jne 0x462f7b
mov ecx, ebx
call fcn.0040c310
mov dword [ebp - 4], edi
mov dword [ebp - 0x58], 1
mov eax, ebx
jmp 0x46305c
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.0040d1d0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x14]
dec eax
push eax
mov ecx, esi
call fcn.00431b50
movsx eax, byte [eax]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0x14]
lea edi, [eax - 1]
test edi, edi
jbe 0x462fda
push dword [ebp - 0x4c]
mov ecx, esi
call fcn.00431b50
mov cl, byte [ebp - 0x60]
add cl, byte [ebp - 0x4c]
xor cl, byte [eax]
mov byte [ebp - 0x5c], cl
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00432b50
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edi
jb 0x462fb1
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x462fe6
mov eax, str.Experience
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040c330
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
call fcn.00460cfd
mov byte [ebp - 4], bl
xor esi, esi
push esi
push ebx
lea ecx, [ebp - 0x7c]
call fcn.0040d2f0
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.0040d1d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x50]
call fcn.004613b4
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
call fcn.0040c370
mov dword [ebp - 0x58], ebx
mov byte [ebp - 4], bl
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040d2f0
mov byte [ebp - 4], 0
push esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov eax, dword [ebp - 0x54]
call fcn.004b549a
ret
Function at 0x46366e
Capabilities:
Delete registry value

Disassembly:
push 0x80
mov eax, 0x4e0419
call fcn.004b5417
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0
jne 0x4636f3
xor eax, eax
mov edi, str.software360TotalSecurity
cmp eax, edi
je 0x4636ec
mov ebx, 0x4fc4f8
cmp eax, ebx
je 0x4636ec
mov esi, str.Hash
cmp eax, esi
je 0x4636ec
lea ecx, [ebp - 0x74]
call fcn.004413bb
and dword [ebp - 4], 0
push ebx
push edi
lea eax, [ebp - 0x74]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
push esi
push dword [ebp - 0x74]
mov bl, 1
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x4636d9
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0044209e
mov al, bl
jmp 0x4637d8
xor al, al
jmp 0x4637d8
push 0
lea ecx, [ebp - 0x8c]
call fcn.004a9f53
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x6c]
call fcn.004a6dcb
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x74], esp
push esi
call fcn.004aafdc
mov byte [ebp - 4], 3
push str.hash
lea ecx, [ebp - 0x8c]
call fcn.004ad9bd
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004aa702
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x6c]
call fcn.004ad43c
mov byte [ebp - 4], 4
mov esi, str.Hash
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00462e04
add esp, 0xc
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x46377c
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
push 0x80000002
push str.software360TotalSecurity
inc ecx
push ecx
push eax
push esi
push 0x4fc4f8
call fcn.00462185
add esp, 0x18
mov byte [ebp - 0x6d], al
mov byte [ebp - 4], 4
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov byte [ebp - 4], 2
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040d2f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6c]
call fcn.00460d6f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.004aa6b7
mov al, byte [ebp - 0x6d]
call fcn.004b549a
ret

Function at 0x463ca5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x463cfc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0x463c80
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
cmp edi, esi
je 0x463cf6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
jmp 0x463d06
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowW]
pop esi
leave
ret
Function at 0x4652ce
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x44
mov eax, 0x4e0920
call fcn.004b5417
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], ebx
cmp esi, ebx
jne 0x465302
mov ecx, edi
call fcn.0040c5e0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 1
jmp 0x4653fb
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], 7
call fcn.0040daa0
xor eax, eax
inc eax
mov dword [ebp - 4], eax
push ebx
push 0x80
push 3
push ebx
push eax
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x48], eax
cmp eax, 0xffffffff
je 0x4653dd
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x4653d1
push 0x541444
push esi
call fcn.004b6290
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4653d1
push esi
push ebx
push edi
call fcn.004b47e0
add esp, 0xc
push ebx
lea eax, [ebp - 0x44]
push eax
push esi
push edi
push dword [ebp - 0x48]
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4653ca
cmp dword [ebp - 0x44], esi
jne 0x4653ca
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004b47e0
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call fcn.00466647
add esp, 0x18
test eax, eax
je 0x4653ca
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00461b49
mov byte [ebp - 4], 2
push dword [eax]
lea ecx, [ebp - 0x3c]
call fcn.0040c660
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040d610
push edi
call fcn.004b5ee1
pop ecx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x50]
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
call fcn.0040c600
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], bl
push ebx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040d590
mov eax, edi
call fcn.004b549a
ret

Function at 0x465410
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
push esi
jne 0x465424
mov esi, 0x4fc6c0
jmp 0x46543c
cmp dword [ebp + 8], 3
jne 0x465431
mov esi, str.EnableKP
jmp 0x46543c
cmp dword [ebp + 8], 2
jne 0x46548c
mov esi, 0x4fc698
lea eax, [ebp + 8]
push eax
push 2
push ebx
push str.Software360TotalSecuritydeepscan
push 0x80000002
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465469
cmp dword [ebp + 8], ebx
jne 0x465469
cmp eax, 2
jne 0x465488
xor ebx, ebx
inc ebx
jmp 0x465488
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x46547c
cmp eax, 2
jne 0x46547f
xor ebx, ebx
inc ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x46548e
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4654ad
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4654cc
xor eax, eax
jmp 0x46553a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call esi
test eax, eax
jne 0x465539
push edi
mov edi, 0x208
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004b47e0
push ebx
push str._s.bak
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00411380
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
test eax, eax
je 0x465533
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x465539
push ebx
call fcn.00465494
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b48bf
leave
ret 4

Function at 0x4655ce
Capabilities:
Check if file exists
Check os version
Create directory
Get common file path

Disassembly:
push 0x10
mov eax, 0x4e0976
call fcn.004b53ae
xor edi, edi
mov dword [ebp - 0x18], edi
cmp dword [0x53edfc], edi
jne 0x4655fc
push 0x53edf8
mov dword [0x53edf8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x53edfc]
cmp eax, 6
ja 0x465611
jne 0x465686
cmp dword [0x53ee00], 2
jb 0x465686
lea eax, [ebp - 0x14]
push eax
call fcn.00465549
pop ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], edi
jne 0x465645
mov ecx, dword [ebp + 8]
push 0x50ea8c
call fcn.0044bc85
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
jmp 0x465712
mov esi, str.temp_
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0040d610
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00445250
add esp, 0xc
jmp 0x465636
lea ecx, [ebp - 0x10]
call fcn.0040c7d0
mov dword [ebp - 4], 3
push 0x400
lea ecx, [ebp - 0x10]
call fcn.00444b2e
xor ebx, ebx
inc ebx
push ebx
push 0x23
mov esi, eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4656c2
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.360Safe
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040c8c0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4656ef
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4f8b70
lea ecx, [ebp - 0x10]
call fcn.00444b0f
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004420c1
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040d610
mov eax, dword [ebp + 8]
call fcn.004b5486
ret