joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a880
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bc26
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x28]
call fcn.00403840
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00401800
add esp, 4
test eax, eax
jne 0x48a8e5
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401eb0
mov eax, dword [ebp - 0x2c]
jmp 0x48aa39
push str.setting.ini
lea ecx, [ebp - 0x28]
call fcn.00401990
lea ecx, [ebp - 0x28]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48a923
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401eb0
mov eax, dword [ebp - 0x30]
jmp 0x48aa39
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
lea ecx, [ebp - 0x28]
call fcn.0043e290
push eax
push 0
push 0x540ba4
push 0x5409f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
lea ecx, [ebp - 0x28]
call fcn.0043e290
push eax
push 0
push 0x549f74
push 0x5409f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x28]
call fcn.0043e290
push eax
push 0
push 0x549f6c
push 0x5409f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.0043e290
push eax
push 0
push 0x549f64
push 0x5409f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
call fcn.00403840
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00403840
mov byte [ebp - 4], 2
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.0048cec0
test eax, eax
je 0x48aa08
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.00401970
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401eb0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48d170
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c090
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 8]
call fcn.00401f80
lea ecx, [ebp - 0x10]
call fcn.00403840
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403840
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push eax
call fcn.00401800
add esp, 4
test eax, eax
jne 0x48d1f5
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x18]
jmp 0x48d363
push str.SDVersion.dll
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00403700
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48d27c
push str.360sd.exe
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00403700
add esp, 0xc
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00401eb0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48d2b9
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x24]
jmp 0x48d363
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp - 0x14]
push eax
call fcn.00401e10
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00401620
add esp, 8
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x54]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00401eb0
lea ecx, [ebp - 0x10]
call fcn.00402010
movzx ecx, al
test ecx, ecx
je 0x48d332
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x30]
jmp 0x48d363
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401970
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48d380
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c0b3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00403840
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00401800
add esp, 4
test eax, eax
je 0x48d3fc
push str.setting.ini
lea ecx, [ebp - 0x10]
call fcn.00401990
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48d3fc
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov al, byte [ebp - 0x11]
jmp 0x48d412
mov byte [ebp - 0x12], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov al, byte [ebp - 0x12]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x48d6d0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
cmp dword [0x58fc38], 0
je 0x48d70a
cmp dword [0x58fc38], 0xffffffff
je 0x48d70a
push 0
mov eax, dword [0x58fc38]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x58fc38], 0
push 0
push 0
push 0
push 0x48d430
push 0
push 0
call fcn.004b17b2
add esp, 0x18
mov dword [0x58fc38], eax
mov esp, ebp
pop ebp
ret

Function at 0x48d730
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
call fcn.0048d380
movzx eax, al
test eax, eax
je 0x48d758
mov dword [ebp - 0x10], 1
jmp 0x48d7ff
mov dword [ebp - 8], 0
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.SOFTWARE360Safe360Ent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48d793
jmp 0x48d7ff
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push str.SDFound
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48d7ff
push str.EntClientSDReport.dat
lea eax, [ebp - 0x18]
push eax
call fcn.00401270
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.00402010
movzx ecx, al
test ecx, ecx
jne 0x48d7f7
lea ecx, [ebp - 0x18]
call fcn.0043e290
push eax
push 0
push str.SDFound
push str.History
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
call fcn.00401eb0
cmp dword [ebp - 8], 0
je 0x48d80f
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
call fcn.0048d6d0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x48d820
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c122
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x1c]
call fcn.00403840
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 8], 1
je 0x48d897
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00401800
add esp, 4
test eax, eax
je 0x48d897
push str.setting.ini
lea ecx, [ebp - 0x1c]
call fcn.00401990
lea ecx, [ebp - 0x1c]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48d897
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x30], 4
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARE360Safe360Ent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x48d8ea
jmp 0x48d919
mov ecx, dword [ebp - 0x30]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
push str.SDFound
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x48d912
jmp 0x48d919
mov dword [ebp - 0x28], 1
cmp dword [ebp - 0x14], 0
je 0x48d929
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.EntClientSDReport.dat
lea eax, [ebp - 0x24]
push eax
call fcn.00401270
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00402010
movzx ecx, al
test ecx, ecx
jne 0x48d99c
lea ecx, [ebp - 0x34]
call fcn.00403840
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
push edx
push 0x542fc8
lea eax, [ebp - 0x34]
push eax
call fcn.00409170
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x34]
call fcn.0043e290
push eax
push str.SDFound
push str.History
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x48d9d0
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x838], 0
xor ecx, ecx
mov dword [ebp - 0x834], ecx
xor edx, edx
mov word [ebp - 0x828], dx
push 0x81e
push 0
lea eax, [ebp - 0x826]
push eax
call fcn.004b0ac0
add esp, 0xc
push 0x820
lea ecx, [ebp - 0x828]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x48da5b
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x830]
mov dword [edx], eax
mov ecx, dword [ebp - 0x82c]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
jmp 0x48dabf
push 0
push 0
lea edx, [ebp - 0x838]
push edx
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x48da90
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x830]
mov dword [ecx], edx
mov eax, dword [ebp - 0x82c]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
jmp 0x48dabf
mov ecx, dword [ebp - 0x838]
mov dword [ebp - 0x830], ecx
mov edx, dword [ebp - 0x834]
mov dword [ebp - 0x82c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x830]
mov dword [eax], ecx
mov edx, dword [ebp - 0x82c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret 4
Function at 0x492250
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c786
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x28], 0
cmp dword [ebp + 8], 0
je 0x4922af
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARE360Safe360Ent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4922df
jmp 0x49230e
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push str.AgreeStartOptimize
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x492307
jmp 0x49230e
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x14], 0
je 0x49231e
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.EntClientASO.dat
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401270
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00402010
movzx edx, al
test edx, edx
jne 0x492394
lea ecx, [ebp - 0x30]
call fcn.00403840
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
push eax
push 0x542fc8
lea ecx, [ebp - 0x30]
push ecx
call fcn.00409170
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x30]
call fcn.0043e290
push eax
push str.LastDecide
push 0x54a8a8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401eb0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4923c0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c7b9
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x20]
call fcn.00403840
mov dword [ebp - 4], 0
push str.360EntClient_update.ini
lea eax, [ebp - 0x2c]
push eax
call fcn.00401270
add esp, 8
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x20]
call fcn.00401970
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00401eb0
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
push 0
push str.switch
push str.360safe
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49246f
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x30]
jmp 0x492565
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWARE360Safe360Ent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4924b4
jmp 0x49253d
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.AgreeStartOptimize
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x49253d
push str.EntClientASO.dat
lea edx, [ebp - 0x34]
push edx
call fcn.00401270
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401970
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00401eb0
lea ecx, [ebp - 0x20]
call fcn.00402010
movzx edx, al
test edx, edx
jne 0x49253d
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
push 0
push str.LastDecide
push 0x54a8a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x14], 0
je 0x49254d
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x492580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], 4
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWARE360softmgr_softmgrs
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4925ca
jmp 0x4925ea
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.speedld
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x4925fa
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x492e20
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa50
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x14], eax
push 1
push str.SeDebugPrivilege
call fcn.00492d60
add esp, 8
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x492e63
mov eax, dword [ebp - 4]
jmp 0x492faa
mov dword [ebp - 0x248], 0
push 0x228
push 0
lea eax, [ebp - 0x244]
push eax
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x248], 0x22c
mov dword [ebp - 0xc], 0x410
cmp dword [ebp + 0x14], 0
je 0x492ea6
mov ecx, dword [ebp - 0xc]
or ecx, 0x100001
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x492f9d
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004b55b5
add esp, 8
test eax, eax
jne 0x492f85
xor eax, eax
mov word [ebp - 0xa50], ax
push 0x7fe
push 0
lea ecx, [ebp - 0xa4e]
push ecx
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x24c], 0
mov edx, dword [ebp - 0x240]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x492f85
cmp dword [ebp + 0x10], 0
je 0x492f7a
push 0x3ff
lea ecx, [ebp - 0xa50]
push ecx
push 0
mov edx, dword [ebp - 0x24c]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0xa50]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004b55b5
add esp, 8
test eax, eax
jne 0x492f6b
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 4], edx
jmp 0x492f9d
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x492f85
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 4], ecx
jmp 0x492f9d
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x10], eax
jmp 0x492eb9
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret
Function at 0x492fd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2818
call fcn.004b0a90
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2814], 0x400
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.004b0ac0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x2810], dx
push 0x1ffe
push 0
lea eax, [ebp - 0x280e]
push eax
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x810], 0x400
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x80c]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x493117
push 0x5c
lea ecx, [ebp - 0x808]
push ecx
call fcn.004036e0
add esp, 8
mov dword [ebp - 0x2818], eax
mov edx, dword [ebp - 0x2818]
add edx, 2
mov dword [ebp - 0x2818], edx
xor eax, eax
mov ecx, dword [ebp - 0x2818]
mov word [ecx], ax
push 0x1000
lea edx, [ebp - 0x2810]
push edx
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x493117
push str.SoftMgr_somkernl.dll
push 0x2000
lea ecx, [ebp - 0x2810]
push ecx
call fcn.00469710
lea edx, [ebp - 0x2810]
push edx
call fcn.00401c70
add esp, 4
test eax, eax
jne 0x4930e6
mov eax, 0x80004005
jmp 0x493131
lea eax, [ebp - 0x2810]
push eax
call fcn.00401c90
mov dword [0x58fb3c], eax
cmp dword [0x58fb3c], 0
je 0x493117
push str.SomPlugin
mov ecx, dword [0x58fb3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x58f88c], eax
cmp dword [0x58f88c], 0
jne 0x493127
mov eax, 0x80004005
jmp 0x493131
push 0
push 0xffffffffffffffff
call dword [0x58f88c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret
Function at 0x49a860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 0xc], 0
je 0x49a895
cmp dword [ebp + 8], 0
je 0x49a895
mov eax, dword [ebp + 8]
push eax
call fcn.004b0eb7
add esp, 4
test eax, eax
jbe 0x49a895
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004b0eb7
add esp, 4
test eax, eax
ja 0x49a89c
xor eax, eax
jmp 0x49a940
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARE360Safe360Ent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49a8e3
jmp 0x49a92d
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004b0eb7
add esp, 4
lea edx, [eax + eax + 2]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49a926
jmp 0x49a92d
mov dword [ebp - 0x14], 1
cmp dword [ebp - 8], 0
je 0x49a93d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8