joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412d57
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
cmp dword [eax + 0x18], 8
mov dword [ebp - 4], ecx
jb 0x412d6b
mov eax, dword [eax + 4]
jmp 0x412d6e
add eax, 4
lea edx, [ebp - 4]
push edx
push ecx
push ecx
push ecx
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
leave
ret 4

Function at 0x413381
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
cmp dword [eax + 0x18], 8
mov dword [ebp - 4], ecx
jb 0x413395
mov eax, dword [eax + 4]
jmp 0x413398
add eax, 4
lea edx, [ebp - 4]
push edx
push ecx
push ecx
push ecx
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4133b4
or eax, 0xffffffff
jmp 0x4133b7
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4133bb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x18], 8
mov dword [ebp - 4], esi
jb 0x4133cd
mov eax, dword [eax + 4]
jmp 0x4133d0
add eax, 4
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push 0
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4133f6
cmp dword [ebp - 4], esi
jne 0x4133f6
mov al, 1
jmp 0x4133f8
xor al, al
leave
ret 0xc

Function at 0x4133fc
Capabilities:
Set registry value

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x413407
mov eax, dword [eax + 4]
jmp 0x41340a
add eax, 4
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x18]
push 0
push eax
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb al, al
inc al
ret 0x10
Function at 0x41342e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x413469
mov al, 1
jmp 0x413555
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor ebx, ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x41348c
cmp eax, 2
jmp 0x413552
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [edi + eax*2]
cmp word [esi - 2], 0x5c
je 0x4134aa
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x41350a
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0x224]
push edi
push dword [ebp - 0x220]
call fcn.0041342e
test al, al
je 0x413526
lea eax, [ebp - 0x22c]
push eax
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x104
call ebx
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x4134cb
xor eax, eax
mov word [esi - 2], ax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
cmp dword [ebp - 0x21c], ecx
sete cl
cmp ecx, eax
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ce01
leave
ret 8

Function at 0x413c11
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp byte [esi + 4], bl
jne 0x413c28
xor al, al
pop esi
pop ebx
leave
ret
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x413c22
cmp dword [esi + 0x20], 8
jb 0x413c44
mov esi, dword [esi + 0xc]
jmp 0x413c47
add esi, 0xc
push edi
push 4
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
jne 0x413c68
push dword [ebp - 4]
call esi
mov al, bl
pop edi
jmp 0x413c24
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x413c85
cmp dword [ebp - 0x28], 4
sete bl
push edi
call esi
jmp 0x413c5e
Function at 0x413ebc
Capabilities:
Hash data using sha256

Disassembly:
push 0x40
lea eax, [esi + 0x30]
push 0
push eax
call fcn.0044d3d0
and dword [esi + 0x28], 0
and dword [esi + 0x2c], 0
add esp, 0xc
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
ret
Function at 0x420c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x47c2ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x49cff4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov dword [esi], ebx
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x18], bl
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
call fcn.00420410
mov dword [esi + 0x48], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x420e70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x47c33b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x49cff4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
lea eax, [edi + 0x14]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00402132
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 0
call fcn.00420b20
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x42c540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebp
xor eax, eax
mov ebp, ecx
cmp dword [ebp + 0x10], 2
push esi
setne al
mov esi, eax
call fcn.0042c400
mov ecx, ebp
mov byte [esp + 0xc], al
call fcn.0042c400
mov byte [esp + 0xd], al
mov eax, dword [ebp]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 8], 0
jne 0x42c6c5
push ebx
movzx ebx, byte [esp + esi + 0x10]
push edi
lea edi, [esp + esi + 0x14]
xor esi, 1
movzx eax, byte [esp + esi + 0x14]
lea esi, [esp + esi + 0x14]
shl ebx, 8
or ebx, eax
lea ecx, [ebx - 0xdc00]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
cmp ecx, 0x3ff
jbe 0x42c69d
lea edx, [ebx - 0xd800]
cmp edx, 0x3ff
ja 0x42c6b6
mov ecx, ebp
call fcn.0042c400
mov ecx, ebp
mov byte [esp + 0x14], al
call fcn.0042c400
mov byte [esp + 0x15], al
mov eax, dword [ebp]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 8], 0
jne 0x42c69d
lea ebx, [ebx]
movzx esi, byte [edi]
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax]
shl esi, 8
or esi, ecx
cmp esi, 0xdc00
jb 0x42c628
cmp ebx, 0xe000
jae 0x42c628
and ebx, 0x3ff
shl ebx, 0xa
and esi, 0x3ff
or ebx, esi
add ebx, 0x10000
jmp 0x42c674
lea edx, [esp + 0x13]
lea edi, [ebp + 0x20]
push edx
mov ecx, edi
mov byte [esp + 0x17], 0xef
call fcn.0042c270
lea eax, [esp + 0x13]
push eax
mov ecx, edi
mov byte [esp + 0x17], 0xbf
call fcn.0042c270
lea ecx, [esp + 0x13]
push ecx
mov ecx, edi
mov byte [esp + 0x17], 0xbd
call fcn.0042c270
cmp esi, 0xd800
jb 0x42c6b6
cmp ebx, 0xe000
jae 0x42c6b6
mov edi, dword [esp + 0x1c]
mov ebx, esi
mov ecx, ebp
call fcn.0042c400
mov ecx, ebp
mov byte [esp + 0x14], al
call fcn.0042c400
mov byte [esp + 0x15], al
mov eax, dword [ebp]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
cmp dword [ecx + eax + 8], 0
je 0x42c5f0
push 0xfffd
add ebp, 0x20
push ebp
call fcn.0042c2e0
add esp, 8
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret
push ebx
add ebp, 0x20
push ebp
call fcn.0042c2e0
add esp, 8
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x442147
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x228
lea ebp, [esp - 4]
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp + 0x228], eax
push 0x30
mov eax, 0x47f2ab
call fcn.00455d21
mov eax, dword [ebp + 0x234]
xor ebx, ebx
push ebx
push 0x441291
push 8
push 0x3b
push 0x486290
push eax
mov edi, ecx
call fcn.00456238
add esp, 0x18
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.004448c1
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x4421f9
mov esi, dword [esi + 4]
cmp esi, 0xf0000000
je 0x442234
cmp esi, 0xf0000001
je 0x44222d
lea eax, [ebp]
push eax
push 1
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x442228
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x4421f9
test byte [eax + 0x1c], 1
je 0x4421f9
cmp byte [eax + 0x19], 2
jb 0x4421f9
push 0x486280
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043f09c
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x34]
call fcn.0044487f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
call fcn.0044ce01
add ebp, 0x22c
leave
ret
lea eax, [ebp]
jmp 0x442239
call fcn.00446ab8
jmp 0x442239
call fcn.00446be0
push eax
mov ecx, edi
call fcn.0040db0b
xor esi, esi
inc esi
jmp 0x4421fb

Function at 0x4437a0
Capabilities:
Get common file path

Disassembly:
push 0x58
mov eax, 0x47f3ea
call fcn.00455d8d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
call fcn.004448c1
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
mov byte [ebp - 0x35], 1
mov byte [ebp - 4], 1
call fcn.0040da71
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.00442cd1
test ebx, ebx
je 0x4437eb
cmp ebx, esi
jbe 0x443828
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x443824
test byte [eax + 0x1c], 1
je 0x443824
cmp byte [eax + 0x19], 2
jb 0x443824
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x49cba4]
push 0x4868f4
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00443431
add esp, 0x14
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.00444839
test al, al
je 0x443838
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.0044487f
mov al, byte [ebp - 0x35]
call fcn.00455de9
ret
Function at 0x443925
Capabilities:
Get common file path

Disassembly:
push 0x58
mov eax, 0x47f417
call fcn.00455d8d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
call fcn.004448c1
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
mov byte [ebp - 0x35], 1
mov byte [ebp - 4], 1
call fcn.0040da71
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.00442cd1
test ebx, ebx
je 0x443970
cmp ebx, esi
jbe 0x4439ad
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x4439a9
test byte [eax + 0x1c], 1
je 0x4439a9
cmp byte [eax + 0x19], 2
jb 0x4439a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x49cba4]
push 0x4868f4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00443431
add esp, 0x14
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.00444839
test al, al
je 0x4439bd
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.0044487f
mov al, byte [ebp - 0x35]
call fcn.00455de9
ret
Function at 0x444cff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x444d36
xor eax, eax
jmp 0x444d75
cmp dword [ebp - 4], 4
je 0x444d72
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x444d69
test byte [eax + 0x1c], 1
je 0x444d69
cmp byte [eax + 0x19], 2
jb 0x444d69
push 0x4869c8
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043f09c
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x444d32
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x445612
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x47f577
call fcn.00455d8d
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ecx
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x445658
xor eax, eax
jmp 0x445849
cmp dword [ebp - 0x3c], 1
je 0x44569a
cmp dword [ebp - 0x3c], 2
je 0x44569a
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x445691
test byte [eax + 0x1c], 1
je 0x445691
cmp byte [eax + 0x19], 2
jb 0x445691
push 0x4869c8
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043f09c
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x445651
test byte [ebp - 0x38], 1
je 0x4456c1
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x445691
test byte [eax + 0x1c], 1
je 0x445691
cmp byte [eax + 0x19], 2
jb 0x445691
push 0x4869c8
push 0x1a
jmp 0x445683
lea ecx, [ebp - 0x68]
call fcn.004448c1
mov eax, dword [ebp - 0x38]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x38], eax
shr eax, 1
push eax
mov byte [ebp - 4], 1
call fcn.0044377f
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
push dword [esi + 4]
call edi
mov ecx, dword [ebp - 0x40]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.00442cd1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x445822
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x44573b
test byte [eax + 0x1c], 1
je 0x44573b
cmp byte [eax + 0x19], 2
jb 0x44573b
push ecx
push 0x4869c8
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00443431
add esp, 0x14
mov ecx, dword [ebp - 0x40]
call fcn.0040dca1
jmp 0x445822
lea ecx, [ebp - 0x68]
call fcn.00444839
test al, al
je 0x445835
mov dword [esi + 8], 0xe
xor eax, eax
cmp dword [esi + 8], eax
lea ecx, [ebp - 0x68]
sete al
mov esi, eax
call fcn.0044487f
mov eax, esi
call fcn.00455de9
ret 8
Function at 0x44653b
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4466d1
test esi, esi
je 0x4466d1
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x64
jb 0x4466d1
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0044d3d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4465b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4466d4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x4466bc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x4466bc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00456990
add esp, 0xc
test eax, eax
jne 0x4466b5
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4466b5
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4465b6
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push str.SoftwareSymantecIsolation
push str.reghive
push str.isolation
call fcn.00446249
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x446658
push 0x7a
jmp 0x4466d3
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x446684
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4466a7
cmp eax, 5
jne 0x446696
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_ACCESS_DENIED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4466a7
cmp eax, 2
jne 0x4466a2
push str.CIsolation::GetRegistryHive__:_RegOpenKeyEx___returned_ERROR_FILE_NOT_FOUND
jmp 0x44668e
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x4466d4
mov eax, 0x54f
jmp 0x4466d4
push 0x1c
push str.SoftwareSymantecIsolation
push ebx
push esi
call fcn.0045119c
add esp, 0x10
xor eax, eax
jmp 0x4466d4
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ce01
leave
ret
Function at 0x4466e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x446821
test esi, esi
je 0x446821
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x26
jb 0x446821
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0044d3d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x44675e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x446824
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x44681d
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x44681d
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00456990
add esp, 0xc
test eax, eax
jne 0x446816
push str.isolate.ini
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x446816
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44675e
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x48c3b0
push str.silo
push str.isolation
call fcn.00446249
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x4467f8
push 0x7a
jmp 0x446823
push esi
call fcn.004458f7
pop ecx
test al, al
jne 0x446808
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x446824
mov eax, 0x54f
jmp 0x446824
push 2
jmp 0x446823
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ce01
leave
ret
Function at 0x446ab8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
call fcn.004468f1
pop ecx
test al, al
je 0x446ba3
push edi
push 0xffffffffffffffff
push 0x4a0d44
lea ecx, [ebp - 0x74]
call fcn.00448fc4
mov eax, dword [0x4a0d6c]
cmp dword [eax - 0xc], edi
je 0x446b06
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.00448feb
mov eax, esi
jmp 0x446bd2
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.0044d3d0
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x400000
call fcn.00446849
add esp, 0x18
test eax, eax
je 0x446b33
xor esi, esi
jmp 0x446af7
push ebx
mov esi, 0x4a0d6c
push 0x105
mov ecx, esi
call fcn.0040da71
push edi
push 0x1c
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x446b7b
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
test eax, eax
je 0x446b79
push dword [0x4a0d64]
push ebx
call edi
test eax, eax
je 0x446b79
xor edi, edi
inc edi
jmp 0x446b7b
xor edi, edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.00442cd1
pop ebx
test edi, edi
je 0x446b94
mov esi, dword [0x4a0d6c]
jmp 0x446af7
mov ecx, esi
call fcn.0040dca1
lea ecx, [ebp - 0x74]
call fcn.00448feb
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x446bd0
test byte [eax + 0x1c], 1
je 0x446bd0
cmp byte [eax + 0x19], 2
jb 0x446bd0
push 0x486a28
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043f09c
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044ce01
leave
ret
Function at 0x446be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
call fcn.004468f1
pop ecx
test al, al
je 0x446ccb
push edi
push 0xffffffffffffffff
push 0x4a0d44
lea ecx, [ebp - 0x74]
call fcn.00448fc4
mov eax, dword [0x4a0d70]
cmp dword [eax - 0xc], edi
je 0x446c2e
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.00448feb
mov eax, esi
jmp 0x446cfa
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.0044d3d0
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x400000
call fcn.00446849
add esp, 0x18
test eax, eax
je 0x446c5b
xor esi, esi
jmp 0x446c1f
push ebx
mov esi, 0x4a0d70
push 0x105
mov ecx, esi
call fcn.0040da71
push edi
push 0x23
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x446ca3
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
test eax, eax
je 0x446ca1
push dword [0x4a0d64]
push ebx
call edi
test eax, eax
je 0x446ca1
xor edi, edi
inc edi
jmp 0x446ca3
xor edi, edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.00442cd1
pop ebx
test edi, edi
je 0x446cbc
mov esi, dword [0x4a0d70]
jmp 0x446c1f
mov ecx, esi
call fcn.0040dca1
lea ecx, [ebp - 0x74]
call fcn.00448feb
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x446cf8
test byte [eax + 0x1c], 1
je 0x446cf8
cmp byte [eax + 0x19], 2
jb 0x446cf8
push 0x486a28
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043f09c
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044ce01
leave
ret

Function at 0x4472b4
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
call fcn.00446f5a
mov ecx, dword [0x4a0d78]
test ecx, ecx
jne 0x4472d7
push 0x4a0d74
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x4a0d78]
mov eax, dword [esp + 8]
xor edx, edx
div ecx
push ebx
xor ebx, ebx
push 4
cmp ebx, edx
sbb edx, edx
imul eax, ecx
and edx, ecx
add edx, eax
pop eax
push eax
push 0x1000
push edx
push ebx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0xc], eax
pop ebx
test eax, eax
jne 0x447341
mov eax, dword [0x49cba4]
cmp eax, 0x49cba4
je 0x447339
test byte [eax + 0x1c], 1
je 0x447339
cmp byte [eax + 0x19], 2
jb 0x447339
push 0x486c3c
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0043f09c
add esp, 0x10
and dword [esi + 8], 0
and dword [esi + 4], 0
mov eax, dword [esi + 0xc]
pop esi
ret 4