joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447667
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x514ae1
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4476f3
cmp dword [ebp + 8], eax
je 0x4476f3
cmp dword [ebp + 0xc], eax
je 0x4476f3
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.00429c50
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov bl, 1
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x18], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4476e5
cmp dword [ebp - 0x14], 0xb
je 0x4476e7
xor bl, bl
lea eax, [esi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x4476f5
xor al, al
call fcn.004f2236
ret

Function at 0x4476fb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x514ae1
call fcn.004f215e
xor eax, eax
mov esi, str.Software360
cmp eax, esi
je 0x44778d
mov ebx, str.360Speedld
cmp eax, ebx
je 0x44778d
mov edi, str.myboottime
cmp eax, edi
je 0x44778d
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.00429c50
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push SysReAllocString
mov bl, 1
mov dword [ebp - 0x18], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x44777f
cmp dword [ebp - 0x14], 0xb
je 0x447781
xor bl, bl
lea eax, [esi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x44778f
xor al, al
call fcn.004f2236
ret

Function at 0x447795
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5149c5
call fcn.004f215e
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x447836
cmp dword [ebp + 8], edi
je 0x447836
cmp dword [ebp + 0xc], edi
je 0x447836
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x14]
mov dword [ebp - 4], edi
push str._s_s
call fcn.00429c50
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x44780c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.0040557a
mov al, bl
jmp 0x447838
xor al, al
call fcn.004f2236
ret
Function at 0x44783e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5149c5
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4478dd
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4478dd
cmp dword [ebp + 0xc], edi
je 0x4478dd
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.00429c50
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4478b3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.0040557a
mov al, bl
jmp 0x4478df
xor al, al
call fcn.004f2236
ret

Function at 0x4478e5
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5149c5
call fcn.004f215e
xor eax, eax
mov esi, str.Software360
cmp eax, esi
je 0x44798d
mov edi, str.360Speedld
cmp eax, edi
je 0x44798d
mov ebx, str.myboottime
cmp eax, ebx
je 0x44798d
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push edi
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.00429c50
and dword [ebp - 0x10], 0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x447965
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
mov edi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 8]
push eax
push 0xb
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.0040557a
mov al, bl
jmp 0x44798f
xor al, al
call fcn.004f2236
ret

Function at 0x447995
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x5149e8
call fcn.004f215e
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x447a30
mov ebx, 0x541058
cmp eax, ebx
je 0x447a30
mov edi, str.Device
cmp eax, edi
je 0x447a30
cmp dword [ebp + 8], eax
je 0x447a30
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x447a30
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.00429c50
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
mov bl, 1
push eax
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x447a22
cmp dword [ebp - 0x14], 3
je 0x447a24
xor bl, bl
lea eax, [esi - 0x10]
call fcn.0040557a
mov al, bl
jmp 0x447a32
xor al, al
call fcn.004f2236
ret
Function at 0x448417
Capabilities:
Get geographical location

Disassembly:
push 0x24
mov eax, 0x51cec3
call fcn.004f215e
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax + 0x18], 8
push esi
jb 0x448434
mov eax, dword [eax + 4]
jmp 0x448437
add eax, 4
push eax
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.Country
push eax
call fcn.00423662
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov ebx, str.SOFTWARE360TotalSecurityDailyNews
push ebx
push eax
mov dword [ebp - 4], esi
call fcn.00405747
or dword [ebp - 4], 0xffffffff
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.004049f3
push eax
call fcn.00404ad9
add esp, 0xc
lea esi, [ebp - 0x20]
call fcn.00401105
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp dword [eax + 0x18], 8
push esi
jb 0x448495
mov eax, dword [eax + 4]
jmp 0x448498
add eax, 4
push eax
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.Lang
push eax
call fcn.00423662
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
push ebx
push eax
mov dword [ebp - 4], 1
call fcn.00405747
or dword [ebp - 4], 0xffffffff
push edi
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.004049f3
push eax
call fcn.00404ad9
add esp, 0xc
lea esi, [ebp - 0x30]
call fcn.00401105
call fcn.004f2236
ret
Function at 0x44b7df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x51fbab
call fcn.004f215e
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x44b8f0
cmp dword [esi + 0x18], edi
je 0x44b81c
cmp dword [esi + 0x1c], 8
jb 0x44b80e
mov edx, dword [esi + 8]
jmp 0x44b811
lea edx, [esi + 8]
movzx eax, byte [esi]
push eax
mov ecx, ebx
call fcn.0044c8aa
cmp dword [esi + 0x34], edi
je 0x44b859
cmp dword [esi + 0x38], 8
jb 0x44b82c
mov eax, dword [esi + 0x24]
jmp 0x44b82f
lea eax, [esi + 0x24]
cmp eax, edi
je 0x44b859
push eax
mov eax, dword [ebx + 0x1ac]
push 0x3ed
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov dword [ecx], eax
cmp eax, edi
je 0x44b851
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
call fcn.0044fe69
add esp, 0xc
cmp dword [esi + 0x54], edi
je 0x44b87b
cmp dword [esi + 0x58], 8
jb 0x44b869
mov eax, dword [esi + 0x44]
jmp 0x44b86c
lea eax, [esi + 0x44]
movzx ecx, byte [esi + 0x3c]
push ecx
push eax
push 1
mov ecx, ebx
call fcn.0044cc65
cmp dword [esi + 0x90], edi
je 0x44b8a3
lea eax, [esi + 0x7c]
cmp dword [eax + 0x18], 8
jb 0x44b891
mov eax, dword [eax + 4]
jmp 0x44b894
add eax, 4
movzx ecx, byte [esi + 0x78]
push ecx
push eax
push 2
mov ecx, ebx
call fcn.0044cc65
mov eax, dword [esi + 0xb4]
mov edi, dword [ebx + 0x1bc]
cmp eax, 0xffffffff
je 0x44b8b6
mov edi, eax
mov eax, dword [esi + 0xb8]
cmp eax, 0xffffffff
je 0x44b8c9
push eax
mov eax, ebx
call fcn.0044cd00
push dword [ebx + 0x1b8]
push edi
push ebx
call fcn.0044ba56
or dword [ebp - 4], 0xffffffff
push 0x44afcc
push 3
push 0x3c
push esi
call fcn.004eb81b
push esi
call fcn.004e7360
pop ecx
xor eax, eax
call fcn.004f2236
ret 4
Function at 0x45c3ed
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x45c401
xor al, al
jmp 0x45c492
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45c47a
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x45c46d
mov eax, dword [ebp + 0x10]
push 0x582e91
push esi
mov dword [eax], esi
call fcn.004eb416
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, ebx
je 0x45c46d
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c46d
cmp dword [ebp - 8], esi
jne 0x45c46d
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
cmp byte [ebp - 1], bl
jne 0x45c48e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045c366
add esp, 0xc
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret
Function at 0x466c59
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x30]
test eax, eax
je 0x466c6d
cmp dword [esi + 0x2c], 0
je 0x466c6d
push eax
call fcn.004e85e3
pop ecx
mov eax, dword [esi + 0x18]
sub eax, 0x10
call fcn.0040557a
mov eax, dword [esi + 0x14]
sub eax, 0x10
call fcn.0040557a
mov eax, dword [esi + 0x10]
sub eax, 0x10
jmp fcn.0040557a

Function at 0x4676a5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x46777e
cmp dword [ebp + 8], ebx
je 0x46777e
mov eax, dword [esi + 0x1008]
mov edi, dword [ebp + 0xc]
cmp edi, eax
ja 0x467701
push edi
lea ebx, [esi + 8]
push ebx
push dword [ebp + 8]
call fcn.004ea300
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
sub dword [esi + 0x1008], edi
push dword [esi + 0x1008]
lea eax, [edi + esi + 8]
push eax
push ebx
call fcn.004f01e0
add esp, 0x18
xor eax, eax
inc eax
jmp 0x467780
mov edx, dword [esi + 0x100c]
cmp edx, dword [esi + 0x1010]
jb 0x467736
cmp eax, ebx
jbe 0x467723
push eax
lea eax, [esi + 8]
push eax
push dword [ebp + 8]
call fcn.004ea300
add esp, 0xc
mov eax, dword [esi + 0x1008]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [esi + 0x1008], ebx
jmp 0x4676fc
push ebx
lea edx, [ebp + 0xc]
push edx
mov edx, 0x1000
sub edx, eax
push edx
lea eax, [eax + esi + 8]
push eax
push ecx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x467779
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jbe 0x467779
push dword [ebp + 0x10]
add dword [esi + 0x1008], eax
add dword [esi + 0x100c], eax
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.004676a5
jmp 0x467780
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x467865
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [esi + 8]
sub edi, eax
je 0x467880
push edi
push eax
push dword [esi]
call fcn.004ea300
add esp, 0xc
mov eax, dword [esi]
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, 0x1000
sub ecx, edi
mov dword [esi + 4], eax
add eax, edi
push ecx
push eax
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 4]
pop edi
je 0x4678bd
test eax, eax
je 0x4678bd
add dword [esi + 8], eax
cmp eax, dword [ebp + 8]
sbb eax, eax
inc eax
jmp 0x4678c2
add dword [esi + 8], eax
xor eax, eax
leave
ret 4

Function at 0x467984
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, ecx
jne 0x467996
xor eax, eax
inc eax
leave
ret
push 0
lea edx, [ebp - 4]
push edx
sub eax, ecx
push eax
push ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4679be
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
cmp dword [ebp - 4], ecx
jne 0x4679be
mov dword [esi + 4], eax
jmp 0x467991
mov eax, dword [esi]
mov dword [esi + 4], eax
xor eax, eax
leave
ret
Function at 0x467a70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, ecx
push edi
mov dword [edi], vtable.CWDCtrlHistory.0
call fcn.00467d14
lea esi, [edi + 0xc]
call fcn.004368b8
push dword [esi + 0x14]
call fcn.004e7360
push dword [esi]
and dword [esi + 0x14], 0
call fcn.004e7360
mov eax, dword [edi + 8]
pop ecx
pop ecx
sub eax, 0x10
pop edi
pop esi
jmp fcn.0040557a
Function at 0x467aaa
Capabilities:
Get file size

Disassembly:
push 0x70
mov eax, 0x518879
call fcn.004f215e
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 1
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x467ae4
lea eax, [ebp + 0xc]
push ebx
push 0x80
push 3
push ebx
push 2
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x467b58
push 0x1000
call fcn.004eaa86
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
call fcn.00467944
test eax, eax
jne 0x467b6d
cmp dword [ebp - 0x14], 0xffffffff
je 0x467b46
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jne 0x467b3d
lea esi, [ebp - 0x20]
call fcn.00467984
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], ebx
je 0x467b54
push dword [ebp - 0x20]
call fcn.004e8476
pop ecx
xor edi, edi
jmp 0x467b5b
xor edi, edi
inc edi
push ebx
push 1
lea esi, [ebp + 8]
call fcn.00404e82
mov eax, edi
jmp 0x467c69
cmp dword [ebp - 0x38], 1
jne 0x467b27
jmp 0x467baf
lea edi, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.004678c6
test eax, eax
je 0x467bc8
mov edi, dword [esi + 0x20]
lea eax, [ebp - 0x34]
push eax
push dword [edi + 4]
push edi
call fcn.0046cf4f
mov ecx, dword [esi + 0x24]
mov edx, 0xfffffff
sub edx, ecx
cmp edx, 1
jb 0x467c03
inc ecx
mov dword [esi + 0x24], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.00467944
test eax, eax
jne 0x467b75
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x467bf8
push 1
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x467bf8
xor ecx, ecx
cmp edi, eax
sete cl
mov eax, ecx
cmp eax, ebx
jne 0x467c2e
push esi
call fcn.00467d14
jmp 0x467b27
push str.list_T__too_long
lea ecx, [ebp - 0x54]
call fcn.00405375
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.00405e9b
push 0x559d84
lea eax, [ebp - 0x7c]
push eax
call fcn.004f1d2c
cmp dword [ebp - 0x14], 0xffffffff
je 0x467c4d
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jne 0x467c44
lea esi, [ebp - 0x20]
call fcn.00467984
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], ebx
je 0x467c5b
push dword [ebp - 0x20]
call fcn.004e8476
pop ecx
push ebx
push 1
lea esi, [ebp + 8]
call fcn.00404e82
xor eax, eax
inc eax
call fcn.004f2236
ret 0x1c
Function at 0x468045
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x4680f2
cmp dword [esi + 0x24], 8
jb 0x46806d
mov eax, dword [esi + 0x10]
jmp 0x468070
lea eax, [esi + 0x10]
lea ecx, [ebp - 0x38]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4680f2
cmp dword [ebp - 0x1c], edi
ja 0x4680f2
cmp dword [ebp - 0x18], 0x800000
jae 0x4680f2
cmp dword [esi + 0x24], 8
mov dword [ebp - 8], edi
jb 0x46809c
mov ebx, dword [esi + 0x10]
jmp 0x46809f
lea ebx, [esi + 0x10]
cmp ebx, edi
je 0x4680b2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4680b6
xor eax, eax
jmp 0x4680ce
lea edi, [eax + eax]
mov eax, edi
call fcn.004f3800
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004406e2
xor edi, edi
push 0x541edc
push eax
lea eax, [ebp - 8]
push eax
call fcn.004f0609
add esp, 0xc
test eax, eax
je 0x468105
cmp dword [ebp - 8], edi
je 0x4680f2
push dword [ebp - 8]
call fcn.004ecd4b
pop ecx
xor eax, eax
lea esp, [ebp - 0x40]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e736b
leave
ret
cmp dword [ebp - 8], edi
je 0x4680f2
push dword [ebp - 8]
mov edi, dword [ebp - 0x18]
push 4
lea eax, [ebp - 0x10]
push 1
xor ebx, ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.004eccb7
add esp, 0x10
cmp eax, 4
jne 0x4681a7
cmp dword [ebp - 0x10], 1
jne 0x4681d0
lea eax, [edi - 4]
mov edi, 0xaa0
xor edx, edx
mov ecx, edi
div ecx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x4681a7
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x46815a
push eax
call fcn.004e8476
pop ecx
mov dword [esi + 8], ebx
push ebx
push 4
push dword [ebp - 8]
mov dword [esi + 4], ebx
call fcn.004ec992
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xaa0
push eax
call fcn.004eaa86
add esp, 0x10
mov dword [esi + 8], eax
cmp eax, ebx
je 0x4681a7
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push eax
call fcn.004eccb7
mov ecx, dword [ebp - 0xc]
add esp, 0x10
cmp eax, ecx
je 0x4681af
push dword [esi + 8]
call fcn.004e8476
pop ecx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
cmp dword [ebp - 8], ebx
jmp 0x4680e7
cmp ecx, ebx
jle 0x4681cd
mov dword [ebp - 0x14], ecx
mov eax, dword [esi + 8]
add eax, ebx
je 0x4681c3
push eax
call fcn.004687ff
add ebx, edi
dec dword [ebp - 0x14]
jne 0x4681b6
mov ecx, dword [ebp - 0xc]
mov dword [esi + 4], ecx
push dword [ebp - 8]
call fcn.004ecd4b
xor eax, eax
pop ecx
inc eax
jmp 0x4680f4
Function at 0x468c58
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
cmp dword [esi + 0x20], edi
jne 0x468c78
xor eax, eax
jmp 0x468d53
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], eax
cmp dword [esi + 4], edi
jbe 0x468c9e
mov ebx, eax
test ebx, ebx
je 0x468c92
push ebx
call fcn.004687ff
inc edi
add ebx, 0xaa0
cmp edi, dword [esi + 4]
jb 0x468c88
xor eax, eax
cmp dword [esi + 0x24], 8
mov dword [ebp - 8], eax
jb 0x468cae
mov ebx, dword [esi + 0x10]
jmp 0x468cb1
lea ebx, [esi + 0x10]
cmp ebx, eax
je 0x468cde
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x468cc8
xor eax, eax
jmp 0x468cde
lea edi, [eax + eax]
mov eax, edi
call fcn.004f3800
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004406e2
push 0x541fd4
push eax
lea eax, [ebp - 8]
push eax
call fcn.004f0609
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x468d30
test eax, eax
jne 0x468d30
push dword [ebp - 8]
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0xc]
push 4
push eax
mov dword [ebp - 0xc], edi
call fcn.004ecf29
push dword [ebp - 8]
push dword [esi + 4]
push 0xaa0
push dword [esi + 8]
call fcn.004ecf29
push dword [ebp - 8]
call fcn.004ecd4b
add esp, 0x24
mov dword [ebp - 0xc], edi
xor edi, edi
cmp dword [esi + 4], edi
jbe 0x468d50
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x468d44
push ebx
call fcn.004687ff
inc edi
add ebx, 0xaa0
cmp edi, dword [esi + 4]
jb 0x468d3a
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e736b
leave
ret

Function at 0x468e04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push str.BlockTimes
push str.SOFTWARE360Safe_safemon
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [esi + 4]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp edx, ebx
jbe 0x468e7e
push edi
xor edi, edi
cmp dword [ebp - 4], ebx
jl 0x468e6f
cmp dword [ebp - 4], edx
jae 0x468e6f
mov ecx, dword [esi + 8]
add ecx, edi
cmp dword [ecx + 0xc], ebx
ja 0x468e6c
cmp dword [ecx + 0x14], ebx
jbe 0x468e6f
inc dword [ebp - 8]
inc dword [ebp - 4]
add edi, 0xaa0
cmp dword [ebp - 4], edx
jb 0x468e53
pop edi
mov ecx, dword [ebp - 8]
add ecx, eax
push ecx
call fcn.00467e02
neg eax
sbb eax, eax
pop ecx
neg eax
dec eax
pop ebx
leave
ret

Function at 0x469243
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
sub eax, 0x10
mov dword [esi], vtable.CFileHistoryRecord.0
call fcn.0040557a
mov eax, dword [esi + 8]
sub eax, 0x10
call fcn.0040557a
mov eax, dword [esi + 4]
sub eax, 0x10
pop esi
jmp fcn.0040557a