joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8bfa2a
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 4
bswap ebx
jmp 0x8bfa66
lea esp, [esp + 0x32]
mov esi, 0xa55b4c02
xchg ah, bh
xchg dword [esp], esi
jmp 0x8bfbb8
mov dl, 0x97
bswap ecx
mov word [esp + 0xb], cx
not ecx
mov edx, esi
inc esi
jmp 0x8bfa50
shr bl, cl
cmc
mov cl, 0xf2
mov ch, bh
xchg ch, ah
btc esi, ecx
jmp 0x8bfab3
push dword [esp + 1]
pop dword [esp]
pop bx
xchg dh, cl
xchg byte [esp + 1], dh
lea eax, [ebx + esi]
jmp 0x8bfa88
mov al, 0xad
mov si, ax
shr cx, cl
mov ax, bx
push dword [esp]
sub esp, 0x1c
jmp 0x8bfb0f
bsr bx, si
bsr eax, ebp
mov di, word [esp + 2]
mov edi, 0x9b53587e
mov byte [esp + 5], al
bts bp, bx
jmp 0x8bfa9f
mov byte [esp + 6], dh
sub esp, 0xb
shl cx, 0xc
mov dword [esp + 0x21], esp
pushfd
cpuid
jmp 0x8bfb26
xchg byte [esp + 4], dl
setl cl
adc ebx, 0x6413bead
not ax
xchg byte [esp + 0x23], al
pop eax
jmp 0x8bfaf3
xchg edi, eax
add esp, 3
rdtsc
xchg bp, ax
mov edi, dword [esp + 9]
pop word [esp + 0x23]
jmp 0x8bfb8b
cld
xchg dword [esp], edx
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
mov ax, 0x89fe
mov bp, word [esp + 1]
cld
jmp 0x8bfad8
mov si, 0xd070
not dx
sub esp, 5
lea esp, [esp + 0xa]
mov cx, sp
bswap ebp
jmp 0x8bfba0
bt edx, ecx
xchg dword [esp], esi
inc si
pop dword [esp + 0x15]
pop bx
pop word [esp + 4]
jmp 0x8bfb66
mov word [esp + 0x10], cx
not ah
not dx
mov di, dx
cpuid
jmp 0x8bfc02
mov ebx, 0x30750c2e
xchg dword [esp], ebx
cpuid
xchg cx, dx
xchg al, bl
lea ecx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x8bfb4d
mov ebp, 0x94d52308
cld
rol cx, cl
sbb bh, 0x2c
mov al, 0xac
pop ebx
jmp 0x8bfc16
pop cx
bswap ebx
xchg dword [esp + 7], esi
xchg dword [esp + 7], ecx
mov dl, ch
pop word [esp]
jmp 0x8bfbd2
bsr si, cx
lea esp, [esp + 5]
pop di
dec ebp
setne al
mov si, 0x2f80
jmp 0x8bfbe8
pop word [esp + 9]
lea esp, [esp + 1]
lea ecx, [eax + 0x44]
neg dx
lea esp, [esp + 3]
mov dword [esp + 4], eax
jmp 0x8bfc8a
mov dh, bl
add esp, 0
bswap edx
bsf ebp, ebp
mov di, cx
xchg byte [esp], bh
jmp 0x8bfc6b
mov ah, 0x9b
pop esi
pop ecx
setnp cl
std
lea edx, [edx - 0xbf]
jmp 0x8bfc44
xchg ebp, ebx
mov ax, di
neg dh
rdtsc
pushal
push dword [esp + 3]
jmp 0x8bfcc3
xchg dword [esp + 4], edx
lea esi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
xchg word [esp + 6], bx
lea ebx, [eax*4]
lea edi, [edi*4]
xchg byte [esp + 5], dh
jmp 0x8bfc5b
std
pop word [esp + 0x1b]
pop ax
mov cx, 0xcc41
popal
mov ax, word [esp]
call fcn.008bfcad
add esp, 2
mov bh, byte [esp]
mov dx, di
not si
inc eax
mov dl, 0x14
call fcn.008bfd39
push edi
mov esi, 0x24048f66
mov bl, 0x55
lea ecx, [edi + 0xbf]
mov dx, word [esp + 1]
bsf edi, ebp
jmp 0x8bfcd9
Function at 0x8bff06
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr ebx, cl
add esp, 4
xchg esi, eax
lea ebp, [ecx + ebx]
xchg bx, ax
jmp 0x8bff08
jmp 0x8bfef0
lea ebx, [ebx*4]
mov ebx, dword [esp]
mov edx, dword [esp]
mov ebp, dword [esp]
cld
mov cx, 0x1fe9
jmp 0x8bff59
rdtsc
mov word [esp + 6], bx
xchg dword [esp + 1], eax
mov bh, 0x33
xor cl, 0xef
jmp 0x8bffc0
xchg ah, cl
cmc
mov ecx, ebp
sub esp, 8
xchg byte [esp + 1], dh
lea edi, [ebp*4]
jmp 0x8bff43
mov byte [esp + 0xc], ch
xchg edx, edi
pop dword [esp + 0x15]
popal
mov ebx, edx
mov byte [esp], cl
jmp 0x8bffd6
shr di, 2
lea ecx, [ecx + 0xde]
inc esi
bsf ax, cx
xchg ebp, ebx
jmp 0x8bff91
sub ebx, eax
mov si, word [esp + 4]
xchg word [esp + 2], si
stc
sub esp, 0x1e
mov cx, 0x5935
jmp 0x8bffa7
dec ebp
mov bl, dh
rdtsc
mov di, word [esp + 2]
bsf dx, bx
lea esp, [esp + 1]
jmp 0x8c1f9d
add esp, 1
call fcn.008c0b20
jl 0x8c1faa
xchg ebx, eax
test byte [0x5ac442e1], 0x3d
loope 0x8c1fee
les ebx, [edx + 0x3d]
int3
pop ds
invalid

Function at 0x8c016a
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
mov dword [esp + 0x24], esp
push ecx
mov byte [esp + 1], al
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
jmp 0x8c0125
pushal
push ax
lea esp, [esp + 2]
jmp 0x8c013b
Function at 0x401173
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push str.Global__Q360FWMainMutex__
push 1
push edi
mov dword [0x47bb80], edi
call dword [0x464284]
cmp eax, edi
mov dword [0x47bb80], eax
je 0x401277
call dword [0x464288]
cmp eax, 0xb7
jne 0x401277
push esi
push edi
push 0x471320
call dword [0x46458c]
mov esi, eax
cmp esi, edi
je case.0x401202.2
push 9
push esi
call dword [0x464588]
push esi
call dword [0x464584]
lea eax, [ebp - 4]
push eax
call dword [0x4641f8]
push eax
call dword [0x464418]
or ecx, 0xffffffff
cmp eax, edi
je 0x4011fa
mov ecx, dword [ebp - 4]
push dword [eax + ecx*4 - 4]
call fcn.00401048
pop ecx
mov ecx, eax
lea eax, [ecx - 1]
cmp eax, 0xb
ja case.0x401202.2
jmp dword [eax*4 + 0x40127c]
push edi
push 2
jmp 0x401265
push edi
push 4
jmp 0x401265
push 3
push 2
push 0x3400
push esi
call dword [0x464580]
push edi
push 0x401
jmp 0x401241
push 2
push 2
push 0x3400
push esi
call dword [0x464580]
push edi
push 0x800
push 0x8100
push esi
call dword [0x46457c]
jmp case.0x401202.2
push edi
push 3
jmp 0x401265
push edi
push 5
jmp 0x401265
push 3
jmp 0x401263
push 1
jmp 0x401263
push 2
push 6
push 0x3400
push esi
call dword [0x464580]
push 1
pop eax
pop esi
jmp 0x401279
xor eax, eax
pop edi
leave
ret
Function at 0x4012d5
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x45f6a7
call fcn.00452e40
sub esp, 0x248
call fcn.00401173
test eax, eax
je 0x4012f5
xor eax, eax
jmp 0x4014b6
push ebx
push esi
push edi
lea ecx, [ebp - 0x70]
call fcn.00401605
lea eax, [ebp - 0x70]
mov esi, 0x47bb88
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040158d
push ebx
call dword [0x46465c]
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x34]
mov dword [ebp - 0x38], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push str.32770
push dword [0x47bb8c]
call dword [0x464598]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], 0x471320
push eax
call dword [0x464594]
push ebx
call dword [0x464590]
push ebx
push 0x4012ac
push ebx
push eax
call dword [0x4640f4]
lea ecx, [ebp - 0x254]
call fcn.00424906
push ebx
push ebx
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.00403e32
test eax, eax
jne 0x40139e
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], bl
call fcn.004251df
mov dword [ebp - 4], 2
jmp 0x40149d
lea eax, [ebp - 0x10]
push eax
call dword [0x4641f8]
push eax
call dword [0x464418]
mov ecx, eax
or eax, 0xffffffff
cmp ecx, ebx
je 0x4013c5
mov eax, dword [ebp - 0x10]
push dword [ecx + eax*4 - 4]
call fcn.00401048
pop ecx
dec eax
push 3
cmp eax, 0xb
pop edi
ja case.0x4013d2.2
jmp dword [eax*4 + 0x4014c2]
push ebx
push 2
jmp 0x401441
push ebx
push 4
jmp 0x401441
push edi
push 2
push 0x3400
push dword [ebp - 0x250]
call dword [0x464580]
push ebx
push 0x401
jmp 0x40141a
push 2
push 2
push 0x3400
push dword [ebp - 0x250]
call dword [0x464580]
push ebx
push 0x800
push 0x8100
push dword [ebp - 0x250]
call dword [0x46457c]
jmp case.0x4013d2.2
push ebx
push edi
jmp 0x401441
push ebx
push 5
jmp 0x401441
push edi
jmp 0x40143f
push 1
jmp 0x40143f
push 2
push 6
push 0x3400
push dword [ebp - 0x250]
call dword [0x464580]
push dword [ebp + 0xc]
push dword [ebp - 0x250]
call dword [0x464588]
lea ecx, [ebp - 0x70]
call fcn.004014f2
mov dword [ebp + 0xc], eax
mov eax, dword [0x47bb80]
cmp eax, ebx
je 0x401482
push eax
call dword [0x464280]
mov dword [0x47bb80], ebx
mov ecx, esi
call fcn.004015cc
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], bl
call fcn.004251df
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x60]
call fcn.00407b67
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00407b67
pop edi
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x401b4b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x45f734
call fcn.00452e40
sub esp, 0xa1c
mov ax, word [0x47be6c]
push ebx
push esi
mov esi, ecx
push edi
mov word [ebp - 0x228], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x226]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0x104
stosw word es:[edi], ax
jne 0x401ba1
mov eax, dword [esi]
cmp dword [eax - 8], ebx
jne 0x401d54
cmp dword [esi + 0xc], ebx
je 0x401bd8
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x228]
push edx
lea edx, [ebp - 0x1c]
push edx
push eax
push ecx
push dword [esi + 0x10]
call dword [0x464438]
lea eax, [ebp - 0x228]
push eax
call dword [0x4643b8]
test eax, eax
pop ecx
jne 0x401bec
lea eax, [ebp - 0x228]
push 0x4713f8
push eax
call dword [0x4643bc]
pop ecx
pop ecx
lea eax, [ebp - 0x228]
test eax, eax
je 0x401c03
lea eax, [ebp - 0x228]
push eax
call dword [0x464264]
lea ecx, [ebp - 0x228]
push ecx
push eax
mov ecx, esi
call fcn.00402efd
mov eax, dword [0x4712e0]
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.00402ebc
test eax, eax
je 0x401c30
mov eax, dword [ebp - 0x10]
mov word [eax], 0x5c
lea eax, [ebp - 0x14]
push 1
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00402866
push dword [ebp - 0x10]
mov eax, dword [eax]
mov ebx, dword [0x4643d4]
mov byte [ebp - 4], 1
push eax
call ebx
pop ecx
test eax, eax
pop ecx
je 0x401cb1
mov eax, dword [0x4712e0]
push 1
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
call fcn.00402ebc
test eax, eax
je 0x401c76
mov eax, dword [ebp + 0xc]
mov word [eax], 0x2f
lea eax, [ebp - 0x18]
push 1
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00402866
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call ebx
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x18]
inc bl
call fcn.00402e21
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00402e21
test bl, bl
je 0x401cb3
mov bl, 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402e21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402e21
test bl, bl
je 0x401cdf
mov eax, dword [esi]
push 1
mov ecx, esi
mov eax, dword [eax - 8]
dec eax
push eax
call fcn.004028dc
lea eax, [ebp - 0xa28]
push 0x400
xor edi, edi
push eax
push edi
call fcn.00404534
add esp, 0xc
xor ebx, ebx
cmp dword [esi + 8], edi
jle 0x401d10
lea eax, [ebp - 0xa28]
push eax
call dword [0x464430]
inc ebx
cmp ebx, dword [esi + 8]
jl 0x401cfd
push dword [esi]
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa28]
push eax
call dword [0x464434]
lea eax, [ebp - 0xa28]
push eax
push edi
call fcn.004044e1
pop ecx
test eax, eax
pop ecx
jne 0x401d54
mov ebx, 0x4713f8
mov eax, ebx
test eax, eax
je 0x401d4b
push ebx
call dword [0x464264]
push ebx
push eax
mov ecx, esi
call fcn.00402efd
mov ecx, dword [ebp + 8]
push esi
call fcn.0040267c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4044e1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
cmp dword [ebp + 0xc], 0
je 0x404521
push 0x800
lea eax, [ebp - 0x800]
push 0
push eax
call fcn.00452e6c
lea eax, [ebp - 0x800]
push 0x400
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004045ac
add esp, 0x1c
test eax, eax
jne 0x404525
xor eax, eax
leave
ret
lea eax, [ebp - 0x800]
push eax
call dword [0x464440]
leave
ret
Function at 0x405c1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x43
call dword [0x464578]
push 1
pop edi
cmp eax, edi
je 0x405c51
cmp eax, 2
je 0x405c51
push 7
call fcn.00405e3a
cmp eax, 3
pop ecx
jne 0x405c4a
mov eax, edi
jmp 0x405cdd
push 4
pop esi
cmp eax, esi
jne 0x405c58
xor eax, eax
jmp 0x405cdd
call dword [0x46441c]
test eax, eax
jne 0x405c93
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 8], eax
jmp 0x405cda
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00405ce1
cmp eax, esi
je 0x405cd5
lea ecx, [ebp - 4]
push ecx
push 0xbb8
push edi
push 0x168
push 0x97
push 0x418
push eax
call dword [0x4645b8]
test eax, eax
jne 0x405cd5
call dword [0x464288]
cmp eax, 0x5b4
jne 0x405cd5
mov dword [ebp - 4], esi
xor eax, eax
cmp dword [ebp - 4], esi
setne al
pop edi
pop esi
leave
ret
Function at 0x406130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0x43
call dword [0x464578]
push 1
pop edi
cmp eax, edi
je 0x406167
cmp eax, 2
je 0x406167
push 5
call fcn.00405e3a
cmp eax, 3
pop ecx
jne 0x406160
mov eax, edi
jmp 0x406290
push 4
pop esi
cmp eax, esi
jne 0x40616e
xor eax, eax
jmp 0x406290
call dword [0x46441c]
test eax, eax
jne 0x4061af
lea eax, [ebp - 8]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
jmp 0x406290
push ebx
call fcn.0040bd94
test eax, eax
je 0x40621d
lea eax, [ebp - 0xc]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov ebx, str.SOFTWARE360Safe_safemon
push str.NewExec
mov edi, 0x80000002
push ebx
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x40628f
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push str.ExecAccess
push ebx
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
jmp 0x40628f
lea eax, [ebp - 0xc]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov ebx, str.SOFTWARE360Safe_safemon
push str.NewExec
mov edi, 0x80000002
push ebx
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [0x464438]
cmp dword [ebp - 4], 0
je 0x406257
call fcn.00406294
jmp 0x40628f
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push str.ExecAccess
push ebx
push edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [0x464438]
cmp dword [ebp - 4], 0
jne 0x40628c
call fcn.00406294
test eax, eax
je 0x40628f
push 1
pop eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4063f1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov edi, dword [0x464438]
push eax
lea eax, [ebp - 0xc]
mov ebx, ecx
push eax
push 0x471680
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call edi
xor eax, eax
push 0x44b
cmp dword [ebp - 4], eax
push dword [ebx + 4]
mov ebx, dword [0x4645c0]
setne al
mov dword [ebp - 0x10], eax
call ebx
push 0
push 0
push 0xf0
push eax
call dword [0x464580]
cmp dword [ebp - 0x10], eax
je 0x406467
push 1
pop eax
jmp 0x4064c1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call edi
xor edi, edi
xor eax, eax
cmp dword [ebp - 4], edi
push 0x453
setne al
mov esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call ebx
push edi
push edi
push 0xf0
push eax
call dword [0x464580]
xor ecx, ecx
cmp esi, eax
setne cl
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4064c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.0040c647
test eax, eax
je 0x406525
call fcn.00405c1a
test eax, eax
je 0x4065b3
push 1
lea eax, [ebp - 8]
pop edi
push 4
mov dword [ebp - 4], edi
pop esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x471680
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [0x464438]
cmp dword [ebp - 4], 0
je 0x4065b3
mov eax, edi
jmp 0x4065ba
call fcn.00406130
test eax, eax
jne 0x406537
call fcn.00405c1a
test eax, eax
je 0x4065b3
push ebx
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov edi, dword [0x464438]
push eax
lea eax, [ebp - 8]
mov ebx, 0x80000002
push eax
push 0x471680
push str.SOFTWARE360Safe_safemon
push ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call edi
xor eax, eax
mov dword [ebp - 0xc], esi
cmp dword [ebp - 4], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], esi
setne al
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push ebx
call edi
xor eax, eax
pop ebx
cmp dword [ebp - 4], eax
je 0x4065ae
cmp dword [ebp - 8], eax
je 0x4065b7
push 1
jmp 0x4065b9
cmp dword [ebp - 8], eax
jne 0x4065b7
push 3
jmp 0x4065b9
push 2
pop eax
pop edi
pop esi
leave
ret
Function at 0x406609
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
push 4
mov dword [ebp - 8], esi
pop eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x471680
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464438]
xor edi, edi
cmp dword [ebp - 4], edi
je 0x40666b
call fcn.00405c1a
test eax, eax
je 0x40666b
push 0x44b
push dword [esi + 4]
mov esi, dword [0x4645c0]
call esi
push edi
push ebx
jmp 0x40667d
push 0x44b
push dword [esi + 4]
mov esi, dword [0x4645c0]
call esi
push edi
push edi
mov edi, dword [0x464580]
mov ebx, 0xf1
push ebx
push eax
call edi
push 4
mov dword [ebp - 4], 1
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464438]
cmp dword [ebp - 4], 0
je 0x4066df
call fcn.00406130
test eax, eax
je 0x4066df
mov eax, dword [ebp - 8]
push 0x453
push dword [eax + 4]
call esi
push 0
push 1
jmp 0x4066f0
mov eax, dword [ebp - 8]
push 0x453
push dword [eax + 4]
call esi
push 0
push 0
push ebx
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4069ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 1
mov esi, ecx
pop edi
push 4
mov dword [ebp - 8], edi
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x471680
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464438]
cmp dword [ebp - 8], 0
je 0x406a03
call fcn.00405c1a
test eax, eax
jne 0x406a05
xor edi, edi
cmp dword [esi + 0x6c], edi
je 0x406a7d
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x6c], edi
call fcn.00407e9f
pop ecx
lea eax, [ebp - 4]
push eax
push 0x29cd
push 0x44d
push dword [esi + 4]
test edi, edi
je 0x406a52
call fcn.0042e6c8
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x406a7d
push str.false
push str.rgb_23_121_53_
push dword [ebp - 0x18]
push 0x471848
jmp 0x406a72
call fcn.0042e6c8
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x406a7d
push str.false
push str.rgb_237_28_36
push dword [ebp - 0x18]
push 0x4717f8
push dword [ebp - 4]
call fcn.00406a81
add esp, 0x14
pop edi
pop esi
leave
ret

Function at 0x406b0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov ebx, dword [0x464438]
push eax
lea eax, [ebp - 0x10]
mov edi, ecx
push eax
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call ebx
xor eax, eax
cmp dword [ebp - 8], eax
setne al
cmp dword [edi + 0x70], eax
je 0x406c14
and dword [ebp - 4], 0
mov dword [edi + 0x70], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00407e9f
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call ebx
xor esi, esi
cmp dword [ebp - 8], esi
je 0x406bd9
call fcn.00406130
test eax, eax
je 0x406bd9
lea eax, [ebp - 4]
push eax
push 0x29cd
push 0x451
push dword [edi + 4]
call fcn.0042e6c8
add esp, 0x10
cmp dword [ebp - 4], esi
je 0x406c14
push str.false
push str.rgb_23_121_53_
push dword [ebp - 0x18]
push 0x471848
jmp 0x406c09
lea eax, [ebp - 4]
push eax
push 0x29cd
push 0x451
push dword [edi + 4]
call fcn.0042e6c8
add esp, 0x10
cmp dword [ebp - 4], esi
je 0x406c14
push str.false
push str.rgb_237_28_36
push dword [ebp - 0x18]
push 0x4717f8
push dword [ebp - 4]
call fcn.00406a81
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406c19
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push esi
mov esi, ecx
push eax
call fcn.00407e9f
pop ecx
mov dword [ebp - 8], 1
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.BrowserPlugin
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464438]
cmp dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x29cd
push 0x454
push dword [esi + 4]
je 0x406c9a
call fcn.0042e6c8
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x406cc5
push str.false
push str.rgb_23_121_53_
push dword [ebp - 0x18]
push 0x471848
jmp 0x406cba
call fcn.0042e6c8
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x406cc5
push str.false
push str.rgb_237_28_36
push dword [ebp - 0x18]
push 0x4717f8
push dword [ebp - 4]
call fcn.00406a81
add esp, 0x14
pop esi
leave
ret

Function at 0x406d0a
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
call dword [0x46441c]
test eax, eax
jne 0x406d25
push 0x471984
call fcn.00406e4c
jmp 0x406d49
push 0x43
call dword [0x464578]
push 1
pop ebp
cmp eax, ebp
je 0x406d39
cmp eax, 2
jne 0x406d51
push 0x471984
push 0x471978
call fcn.00406f30
pop ecx
pop ecx
xor eax, eax
jmp 0x406e46
push esi
push edi
mov ecx, ebx
call fcn.004064c6
cmp eax, ebp
jne 0x406daa
call fcn.0040c647
mov ebp, dword [0x464444]
mov edi, str.SOFTWARE360Safe_safemon
test eax, eax
mov esi, 0x80000002
jne 0x406d8e
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 4
push eax
push 4
push str.DefaultBrowserLock
push edi
push esi
call ebp
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 4
push eax
push 4
push 0x471680
push edi
push esi
call ebp
jmp 0x406e2b
call fcn.0040c647
mov esi, dword [0x464580]
mov edi, 0x1411
test eax, eax
jne 0x406dcd
push dword [ebx + 4]
call fcn.00407e22
pop ecx
push ebp
push ebp
push edi
push eax
call esi
push dword [ebx + 4]
call fcn.00407e22
pop ecx
push ebp
push 2
push edi
push eax
call esi
call fcn.0040c647
test eax, eax
mov edi, str.SOFTWARE360Safe_safemon
mov esi, 0x80000002
jne 0x406e0a
lea eax, [esp + 0x10]
push 4
push eax
push 4
push str.DefaultBrowserLock
push edi
push esi
mov dword [esp + 0x28], ebp
call dword [0x464444]
lea eax, [esp + 0x10]
push 4
push eax
push 4
push 0x471680
push edi
push esi
mov dword [esp + 0x28], ebp
call dword [0x464444]
mov ecx, ebx
call fcn.00405b43
mov ecx, ebx
call fcn.004066f9
push 0
mov ecx, ebx
call fcn.00406cc8
mov ecx, ebx
call fcn.00406609
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10