joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445820
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51dbf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0050a6b0
lea edi, [esi + 0x24]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.004f7d40
push ebx
push ebx
push ebx
lea eax, [esi + 0x30]
push ebx
push eax
mov dword [esi], 0x5247b8
mov dword [edi], 0x5247b4
call dword [0x5237cc]
push 0xffffff
mov dword [esi + 0x44], 0xffffff
call dword [0x5230cc]
mov dword [esi + 0x40], eax
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x250]
rep stosd dword es:[edi], eax
mov edi, dword [0x523488]
lea ecx, [esi + 0x14ac]
push str.BG_EDIT
push ecx
mov dword [esi + 0x458], 0x717171
mov dword [esi + 0x2c], ebx
call edi
lea edx, [esi + 0x14ec]
push str.LeftPad
push edx
call edi
lea eax, [esi + 0x152c]
push str.RightPad
push eax
call edi
add esp, 0x18
mov ecx, 0x412
xor eax, eax
lea edi, [esi + 0x45c]
mov dword [esi + 0x1578], ebx
mov dword [esi + 0x156c], ebx
mov dword [esi + 0x1570], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x1584], ebx
mov dword [esi + 0x157c], 8
mov dword [esi + 0x1580], 5
mov dword [esi + 0x14a8], ebx
mov dword [esi + 0x1588], 0x12
mov dword [esi + 0x1574], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44650e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51dc3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x30]
xor ebx, ebx
push 0x1c
mov dword [esp + 0x18], esi
mov byte [esi + 0x14], al
mov byte [esi + 0x15], cl
mov byte [esi + 0x1c], bl
call fcn.0051c5a0
mov edi, eax
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x18], 1
call dword [0x5233d8]
cmp dword [0x5782bc], ebx
jne 0x446562
mov dword [0x5782bc], edi
mov dword [edi], ebx
mov edx, dword [0x5782bc]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x5782b8]
inc ecx
mov dword [0x5782b8], ecx
lea ecx, [esp + 0x10]
call dword [0x5233d4]
cmp ebp, ebx
je 0x446586
push ebp
call fcn.0051c55a
add esp, 4
mov edi, dword [0x5782bc]
push 0x1c
call fcn.0051c5a0
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
add esp, 4
mov dword [eax + 8], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
push edi
mov dword [esi], 0x5247cc
call fcn.004a7f30
mov ecx, eax
call fcn.004a8310
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x44fdb0
Capabilities:
Parse url

Disassembly:
mov eax, 0x1494
call fcn.0051c5b0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14a4]
test esi, esi
push edi
je 0x44ff19
cmp word [esi], 0
je 0x44ff19
mov eax, dword [esp + 0x14ac]
test eax, eax
je 0x44ff19
mov dx, word [0x56bc90]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], dx
mov word [esp + 0x4c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov ebx, dword [0x52345c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x254]
push edx
mov dword [esp + 0x18], eax
mov eax, 0x104
lea ecx, [esp + 0x50]
push 0
push esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
call ebx
mov ebp, dword [0x523ad4]
add esp, 4
push eax
push esi
call ebp
test eax, eax
jne 0x44fec8
mov ecx, 0x411
lea edi, [esp + 0x45e]
mov word [esp + 0x45c], ax
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.http:___s_
lea eax, [esp + 0x464]
push 0x823
push eax
call dword [0x52346c]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x45c]
push ecx
push 0
push edx
call ebx
add esp, 4
push eax
lea eax, [esp + 0x468]
push eax
call ebp
test eax, eax
je 0x44ff19
mov edx, dword [esp + 0x14b0]
mov esi, dword [esp + 0x14ac]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx]
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x254]
push ecx
push eax
push str._s:___s_favicon.ico
push edx
push esi
call dword [0x52346c]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1494
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1494
ret

Function at 0x450600
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov eax, 4
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push edi
mov edi, dword [0x52370c]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push esi
push 0x80000001
mov dword [esp + 0x30], 0
call edi
mov ebp, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x45067c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0x556658
push esi
push 0x80000001
mov dword [esp + 0x3c], 0
call edi
test eax, eax
jne 0x45067c
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
test ebp, ebp
jne 0x45068c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x4506aa
lea edx, [esp + 0x28]
push 4
push edx
push 4
push ebx
push esi
push 0x80000001
call dword [0x523714]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x450730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 0x14]
push eax
xor esi, esi
push ecx
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xbcde0395
mov word [esp + 0x3c], 0xe52f
mov word [esp + 0x3e], 0x467c
mov byte [esp + 0x40], 0x8e
mov byte [esp + 0x41], 0x3d
mov byte [esp + 0x42], 0xc4
mov byte [esp + 0x43], 0x57
mov byte [esp + 0x44], 0x92
mov byte [esp + 0x45], 0x91
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], 0x2e
mov dword [esp + 0x28], 0xa95664d2
mov word [esp + 0x2c], 0x9614
mov word [esp + 0x2e], 0x4f35
mov byte [esp + 0x30], 0xa7
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0x8d
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x17
mov byte [esp + 0x37], 0xe6
mov dword [esp + 0x48], 0xbfa971f1
mov word [esp + 0x4c], 0x4d5e
mov word [esp + 0x4e], 0x40bb
mov byte [esp + 0x50], 0x93
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x96
mov byte [esp + 0x53], 0x70
mov byte [esp + 0x54], 0x39
mov byte [esp + 0x55], 0xbf
mov byte [esp + 0x56], 0xbe
mov byte [esp + 0x57], 0xe4
call dword [0x523c54]
test eax, eax
jl 0x4508bd
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4508bd
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push edx
push 1
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4508b3
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4508b3
lea edx, [esp + 8]
mov dword [esp + 8], esi
mov ecx, dword [eax]
push edx
push esi
lea edx, [esp + 0x3c]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4508a9
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4508a9
lea edx, [esp + 4]
mov dword [esp + 4], esi
mov ecx, dword [eax]
push edx
push esi
push 0x579350
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x45089f
mov eax, dword [esp + 4]
cmp eax, esi
je 0x45089f
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
mov ecx, dword [eax]
push eax
sbb esi, esi
inc esi
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x4508d0
Capabilities:
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
sub esp, 0x440
push ebx
push esi
mov esi, dword [esp + 0x44c]
xor ebx, ebx
cmp esi, ebx
je 0x450aa2
cmp word [esi], bx
je 0x450aa2
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], bx
mov word [esp + 0x244], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x246]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x248]
push 0x26
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [0x52364c]
lea ecx, [esp + 0x244]
lea edx, [esp + 0x3c]
push ecx
push str._sInternet_Exploreriexplore.exe
push 0x103
push edx
call dword [0x52346c]
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.0043f210
add esp, 0x18
test eax, eax
pop edi
jne 0x450a6e
lea ecx, [esp + 0x14]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0x56bc90
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call dword [0x52370c]
lea ecx, [esp + 0x38]
push ebx
push ecx
call fcn.0043f210
add esp, 8
test eax, eax
jne 0x450a6e
mov word [esp + 0x38], bx
lea eax, [esp + 8]
mov dword [esp + 8], ebx
push eax
push 0x52b0e0
push 0x15
push ebx
push 0x52b0b0
call dword [0x523c54]
test eax, eax
jl 0x450aa2
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x450a60
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x450a10
push eax
call dword [0x523804]
mov eax, dword [esp + 0xc]
push 1
push eax
call dword [0x523884]
push esi
call dword [0x52362c]
lea edx, [esp + 0x18]
mov esi, eax
push edx
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], bx
push edx
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x38]
mov word [esp + 0x38], 8
mov dword [esp + 0x40], esi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [0x523630]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
cmp word [esp + 0x38], bx
je 0x4509b6
push 0xa
push ebx
lea edx, [esp + 0x40]
push esi
push edx
push str.open
call dword [0x523784]
push eax
call dword [0x523644]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x440
ret
Function at 0x450f80
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x529f10
push 1
push 0
push 0x529f40
call dword [0x523c54]
test eax, eax
jl 0x45101a
mov ecx, dword [esp]
test ecx, ecx
je 0x45101a
mov eax, dword [esp + 0x10]
push esi
mov dword [esp + 8], 0
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x52b180
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x45100d
mov eax, dword [esp + 8]
test eax, eax
je 0x45100d
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x451470
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x41c]
lea ecx, [esp + 8]
push eax
push 0x5384a4
push 0x103
push ecx
call dword [0x52346c]
lea edx, [esp + 0x18]
push edx
call dword [0x52345c]
add esp, 0x14
cmp word [esp + eax*2 + 6], 0x5c
je 0x4514d4
lea eax, [esp + 8]
push 0x538bc8
push eax
call dword [0x523484]
add esp, 8
lea ecx, [esp + 8]
push ecx
call dword [0x5236cc]
test eax, eax
je 0x4514f1
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
push ebx
mov ebx, dword [0x52364c]
push 0
lea edx, [esp + 0x218]
push 0x24
push edx
push 0
stosw word es:[edi], ax
call ebx
test eax, eax
je 0x451547
lea eax, [esp + 0x214]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [0x52347c]
add esp, 8
test eax, eax
je 0x451547
mov esi, 1
xor eax, eax
lea edx, [esp + 0x214]
push eax
mov ecx, 0x82
lea edi, [esp + 0x218]
push 0x26
push edx
push eax
rep stosd dword es:[edi], eax
call ebx
test eax, eax
pop ebx
je 0x451589
lea eax, [esp + 0x210]
lea ecx, [esp + 8]
push eax
push ecx
call dword [0x523494]
add esp, 8
test eax, eax
jne 0x451589
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x410
ret

Function at 0x4515a0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [0x523704]
test eax, eax
jne 0x4515e7
push 0x5580e4
push esi
call dword [0x5234ec]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 8], 0xfeff
je 0x4515e7
push esi
push 1
lea eax, [esp + 0x10]
push 2
push eax
call dword [0x5234e8]
push esi
call dword [0x5234e4]
add esp, 0x14
pop esi
ret
Function at 0x4515f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x451607
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
push esi
call dword [0x523520]
add esp, 8
test eax, eax
je 0x45161e
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
xor eax, eax
push edi
mov dword [esp + 0xd], eax
push 0x5580f0
mov dword [esp + 0x15], eax
push esi
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], bl
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
call dword [0x5234ec]
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x451669
push edi
push 2
lea ecx, [esp + 0x14]
push 1
push ecx
call dword [0x52351c]
push edi
call dword [0x5234e4]
add esp, 0x14
lea edx, [esp + 0xc]
push 0x5580ec
push edx
call dword [0x5231a4]
test eax, eax
pop edi
jne 0x451689
push esi
call fcn.004ad600
add esp, 4
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x451810
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x451918
cmp word [edi], 0
je 0x451918
push 0x2210
push 8
call dword [0x5231ac]
push eax
call dword [0x5231b4]
test eax, eax
je 0x451918
mov esi, 0x104
mov ecx, eax
sub edi, eax
lea edx, [esi + 0x7ffffefa]
test edx, edx
je 0x45186b
mov dx, word [edi + ecx]
test dx, dx
je 0x45186b
mov word [ecx], dx
add ecx, 2
dec esi
jne 0x45184d
jmp 0x45186f
test esi, esi
jne 0x451872
sub ecx, 2
mov esi, dword [esp + 0x14]
mov word [ecx], 0
test esi, esi
je 0x4518bc
cmp word [esi], 0
je 0x4518bc
lea ecx, [eax + 0x208]
mov edi, 0x1000
sub esi, ecx
lea edx, [edi + 0x7fffeffe]
test edx, edx
je 0x4518b0
mov dx, word [esi + ecx]
test dx, dx
je 0x4518b0
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x451892
jmp 0x4518b4
test edi, edi
jne 0x4518b7
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
push 0
push 4
push eax
push 0x4516d0
push 0
push 0
mov dword [eax + 0x2208], ecx
mov dword [eax + 0x220c], edi
call dword [0x523468]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x451918
test edi, edi
je 0x4518fa
push 0xffffffffffffffff
push esi
call dword [0x523294]
push esi
call dword [0x523298]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x451911
push eax
push esi
call dword [0x523354]
push esi
call dword [0x5233b0]
pop edi
pop esi
ret
Function at 0x451920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], si
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x208
call dword [0x52370c]
test eax, eax
jne 0x4519dc
cmp word [esp + 0x10], si
je 0x4519dc
lea eax, [esp + 0x10]
push eax
call dword [0x52345c]
add esp, 4
cmp word [esp + eax*2 + 0xe], 0x5c
je 0x4519a6
lea ecx, [esp + 0x10]
push 0x538bc8
push ecx
call dword [0x523484]
add esp, 8
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
lea edx, [esp + 0x10]
push str.360ver.dll
push edx
push 0x538c6c
push eax
push ecx
call dword [0x52346c]
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x210
ret
mov eax, esi
pop edi
pop esi
add esp, 0x210
ret

Function at 0x4519f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], si
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x208
call dword [0x52370c]
test eax, eax
jne 0x451aac
cmp word [esp + 0x10], si
je 0x451aac
lea eax, [esp + 0x10]
push eax
call dword [0x52345c]
add esp, 4
cmp word [esp + eax*2 + 0xe], 0x5c
je 0x451a76
lea ecx, [esp + 0x10]
push 0x538bc8
push ecx
call dword [0x523484]
add esp, 8
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
lea edx, [esp + 0x10]
push str.SDVersion.dll
push edx
push 0x538c6c
push eax
push ecx
call dword [0x52346c]
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x210
ret
mov eax, esi
pop edi
pop esi
add esp, 0x210
ret

Function at 0x451ac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], si
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x208
call dword [0x52370c]
test eax, eax
jne 0x451b7c
cmp word [esp + 0x10], si
je 0x451b7c
lea eax, [esp + 0x10]
push eax
call dword [0x52345c]
add esp, 4
cmp word [esp + eax*2 + 0xe], 0x5c
je 0x451b46
lea ecx, [esp + 0x10]
push 0x538bc8
push ecx
call dword [0x523484]
add esp, 8
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
lea edx, [esp + 0x10]
push str.safemon_safemon.dll
push edx
push 0x538c6c
push eax
push ecx
call dword [0x52346c]
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x210
ret
mov eax, esi
pop edi
pop esi
add esp, 0x210
ret
Function at 0x452290
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x18]
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call dword [0x52370c]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret

Function at 0x4522d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
mov edx, dword [esp + 0x224]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x228]
lea ecx, [esp + 8]
dec eax
push ecx
mov ecx, dword [esp + 0x224]
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x224]
push eax
mov eax, dword [esp + 0x224]
push ecx
push edx
push eax
mov dword [esp + 0x1c], 1
call dword [0x52370c]
test eax, eax
pop edi
jne 0x452349
cmp word [esp + 8], ax
je 0x452349
mov eax, 1
add esp, 0x210
ret
xor eax, eax
add esp, 0x210
ret

Function at 0x452360
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push 4
push eax
mov eax, dword [esp + 0xc]
push 4
push ecx
push edx
push eax
call dword [0x523714]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x4533c0
Capabilities:
Capture screenshot

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
jle 0x4534e8
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x4534e8
mov ebx, dword [esp + 0x18]
test ebx, ebx
jle 0x4534e8
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x4534e8
push ebp
mov ebp, dword [esp + 0x24]
push esi
push ebp
call dword [0x5230f4]
mov esi, eax
mov eax, dword [esp + 0x24]
push eax
push ebx
push ebp
call dword [0x5230e0]
push eax
push esi
mov dword [esp + 0x30], eax
call dword [0x5230fc]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push 0xcc0020
push ecx
push edx
push ebp
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x30], eax
push ebp
push edi
push 0
push 0
push esi
call dword [0x5230e4]
cmp edi, ebx
mov dword [esp + 0x34], edi
jge 0x453475
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0xcc0020
push 0
push 0
push esi
push eax
push edi
push 0
push ecx
push esi
call dword [0x5230e4]
mov eax, dword [esp + 0x34]
add eax, edi
add edi, edi
cmp eax, ebx
mov dword [esp + 0x34], eax
jl 0x453447
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
cmp edi, eax
jge 0x4534a3
push 0xcc0020
push 0
push 0
push esi
push ebp
push ebx
push edi
push 0
push esi
call dword [0x5230e4]
mov eax, dword [esp + 0x24]
add edi, ebp
add ebp, ebp
cmp edi, eax
jl 0x453481
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0xcc0020
push 0
push 0
push esi
push edx
mov edx, dword [esp + 0x28]
push ebx
push eax
push ecx
push edx
call dword [0x5230e4]
mov eax, dword [esp + 0x20]
push eax
push esi
call dword [0x5230fc]
mov ecx, dword [esp + 0x28]
push ecx
call dword [0x523100]
push esi
call dword [0x523104]
pop esi
pop ebp
pop edi
pop ebx
ret 0x28