joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cd80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x220], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0x14]
push esi
xor edi, edi
or eax, 0x2001f
push eax
push edi
push edx
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0xc]
mov esi, eax
cmp esi, edi
jne 0x42cdf6
xor eax, eax
cmp ecx, edi
je 0x42cde4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov esi, eax
mov dword [esp + 0xc], ecx
cmp eax, edi
je 0x42ce04
cmp ecx, edi
je 0x42cea2
push ecx
jmp 0x42ce9c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x42ce6c
lea esp, [esp]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.0042cd80
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0x42cebb
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
push edx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x42ce30
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x42ce7f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebx]
push eax
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x42cea2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x42cea4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret 4
Function at 0x42e640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x469790
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x485d30]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x418]
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x42e6c2
call fcn.0042c4f0
mov edi, eax
jmp 0x42e7a4
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x42e6db
call fcn.0042c4f0
jmp 0x42e79b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x42e6f6
call fcn.0042c4f0
jmp 0x42e79b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x18], edi
cmp eax, edi
jae 0x42e72c
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x42e71a
lea ecx, [ebp]
call fcn.0042cd20
lea ecx, [ebp - 0x20]
call fcn.0042ccc0
mov eax, 0x8007000e
jmp 0x42e7b6
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.0042d540
mov dword [ebp - 4], 1
jmp 0x42e758
mov eax, dword [ebp]
test eax, eax
jne 0x42e766
mov edi, 0x8007000e
jmp 0x42e79d
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x42e77f
call fcn.0042c4f0
jmp 0x42e79b
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.0042e410
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x42e7b4
lea ecx, [ebp]
call fcn.0042cd20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0044e20c
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42ee30
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 8]
call fcn.00419e60
mov esi, dword [esp + 4]
cmp dword [esi - 8], 0
jl 0x42ee8e
push 0x46ed8c
push esi
call fcn.0044f8d8
add esp, 8
test eax, eax
je 0x42ee8e
sub eax, esi
sar eax, 1
js 0x42ee8e
lea eax, [esi - 0xc]
cmp eax, dword [0x484060]
je 0x42ee86
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42ee86
push esi
call fcn.0044ee34
add esp, 4
mov eax, 1
pop esi
pop ecx
ret
lea ecx, [esi - 0xc]
cmp ecx, dword [0x484060]
je 0x42eeb0
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42eeb0
push esi
call fcn.0044ee34
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
Function at 0x42eec0
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4697f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0
xor ebp, ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ef46
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x42ef41
cmp eax, 0x50
je 0x42ef41
cmp eax, 0xb7
je 0x42ef41
lea ecx, [esp + 0x2c]
call fcn.00415c20
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
mov ebp, 1
push str.wftest.tf
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00419f80
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 2
push 0x120116
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42efd1
mov eax, str.wftest
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ef86
push 0
sub eax, edx
lea edx, [esp + 0x18]
push edx
mov esi, eax
push esi
push str.wftest
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42efbf
cmp esi, dword [esp + 0x14]
jne 0x42efbf
mov dword [esp + 0x18], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebp, ebp
je 0x42efe2
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00401d20
add esp, 4
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x42f011
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x42f011
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x2c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x42f03a
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x42f03a
mov edx, dword [esp + 0x2c]
add edx, 0xfffffff4
push edx
call fcn.0044ee34
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x42f990
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esi
push 6
mov esi, ecx
call fcn.00430710
mov ecx, esi
call fcn.00430600
mov ebp, eax
test ebp, ebp
je 0x42fa6f
push ebx
push edi
mov ecx, ebp
call fcn.00432e30
mov ecx, eax
call fcn.00415630
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x42f9ef
mov eax, dword [esi + 4]
push 0
push 0x3ff
push eax
call fcn.00421da0
mov ecx, dword [esi + 4]
add esp, 0xc
push 0x3ff
push ecx
call ebx
push 0
push eax
call edi
mov ecx, ebp
call fcn.004330f0
test eax, eax
jne 0x42fa0c
mov ecx, ebp
call fcn.00432ee0
mov ecx, eax
call fcn.00421240
test eax, eax
je 0x42fa3f
mov edx, dword [esi + 4]
push 0
push 0x3fe
push edx
call fcn.00421da0
mov eax, dword [esi + 4]
add esp, 0xc
push 0x3fe
push eax
call ebx
push 0
push eax
call edi
mov ecx, dword [esi + 4]
push 0x416
push ecx
call ebx
push 5
push eax
call edi
mov ecx, ebp
call fcn.00432ee0
mov ecx, eax
call fcn.00421190
cmp dword [eax], 0
pop edi
pop ebx
jne 0x42fa66
mov ecx, ebp
call fcn.00432ee0
mov ecx, eax
call fcn.004211b0
test eax, eax
je 0x42fa6f
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov ecx, esi
pop esi
pop ebp
jmp fcn.00430bb0
Function at 0x431810
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x469ab8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004306f0
mov ecx, ebx
mov edi, eax
call fcn.00430600
mov esi, eax
test edi, edi
je 0x4318bb
test esi, esi
je 0x4318bb
mov ecx, esi
call fcn.00432ee0
mov ecx, esi
call fcn.00432ec0
mov esi, eax
test esi, esi
je 0x4318bb
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push esi
call ecx
test eax, eax
jne 0x4318bb
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
push esi
call eax
test eax, eax
jne 0x4318bb
mov ecx, edi
call fcn.004158d0
test eax, eax
jne 0x4318bb
mov ecx, edi
call fcn.00415970
test eax, eax
je 0x4318bb
mov ecx, dword [0x484064]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.004198a0
test eax, eax
jne 0x4318d0
lea ecx, [esp + 0x10]
call fcn.00415c20
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4318b2
push 5
mov ecx, ebx
call fcn.00430630
lea ecx, [esp + 0x10]
call fcn.00415c20
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x431eb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x469b48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004308a0
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
or eax, 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0xc], 4
mov dword [esi + 0x4c], vtable.IExtractCallback.0
lea ecx, [esi + 0x58]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.CSetupProgressDialog.2.0
mov dword [esi + 0x10], vtable.CSetupProgressDialog.1.0
mov dword [esi + 0x4c], vtable.CSetupProgressDialog.0
call fcn.00426580
mov eax, dword [0x484064]
mov dword [esi + 0x338], eax
mov ecx, dword [0x484064]
lea edx, [esi + 0x344]
mov dword [esi + 0x33c], ecx
push edx
mov dword [esi + 0x340], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x35c], ebx
mov dword [esi + 0x360], 0x50
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4332b0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4332c6
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4332cc
mov eax, 1
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x4332f1
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4332f8
push esi
call edi
test eax, eax
je 0x4332f8
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x433350
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x804
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push esi
mov esi, dword [eax]
mov eax, dword [esi - 8]
test eax, eax
jne 0x43338f
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0044e20c
add esp, 0x804
ret 4
cmp eax, 0x104
jge 0x433375
push 0x800
lea eax, [esp + 8]
push 0
push eax
call fcn.0044e220
add esp, 0xc
push 0x471c18
push esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.0044e20c
add esp, 0x804
ret 4

Function at 0x435360
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x43537b
pop edi
mov eax, 1
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435373
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x43539d
push esi
call edi
test eax, eax
jne 0x435373
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
xor eax, eax
pop esi
ret

Function at 0x4353c0
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.00435360
add esp, 4
cmp dword [esp + 0x10], 0
je 0x4353e4
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, 1
ret
Function at 0x435a40
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x469ff6
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x880], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x898]
mov dword fs:[0], eax
mov esi, dword [esp + 0x8a8]
xor ebx, ebx
mov dword [esp + 0x18], esi
cmp esi, ebx
jne 0x435a93
xor eax, eax
jmp 0x435c61
cmp word [esi], bx
je 0x435a8c
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x435aa0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jge 0x435a8c
push 0x410
lea eax, [esp + 0x488]
push ebx
push eax
call fcn.0044e220
add esp, 0xc
push 0x477514
push esi
lea ecx, [esp + 0x48c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x435afb
test al, 1
je 0x435afb
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x5c
mov word [esp + 0x478], dx
mov dword [esp + 0x47c], ebx
mov dword [esp + 0x480], ebx
lea eax, [esp + 0x484]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x8a4], ebx
call fcn.004355b0
cmp eax, ebx
je 0x435c41
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
cmp dword [esp + 0x480], ebx
je 0x435b99
mov ecx, dword [esp + 0x20]
shr ecx, 4
and ecx, 1
je 0x435b99
cmp word [esp + 0x4c], 0x2e
jne 0x435b99
mov ax, word [esp + 0x4e]
cmp ax, bx
je 0x435b74
cmp ax, 0x2e
jne 0x435b99
cmp word [esp + 0x50], bx
jne 0x435b99
mov eax, dword [esp + 0x47c]
cmp eax, ebx
je 0x435c41
lea edx, [esp + 0x20]
push edx
push eax
call ebp
mov dword [esp + 0x480], eax
mov esi, eax
jmp 0x435c35
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.004358c0
mov byte [esp + 0x8a0], 1
cmp dword [esp + 0x480], ebx
je 0x435bd2
mov eax, dword [esp + 0x20]
shr eax, 4
and eax, 1
cmp eax, ebx
je 0x435bd2
mov edi, dword [esp + 0x14]
push edi
call fcn.00435a40
jmp 0x435bdc
mov edi, dword [esp + 0x14]
push edi
call fcn.00435360
mov eax, dword [esp + 0x480]
add esp, 4
cmp eax, ebx
jne 0x435bee
xor esi, esi
jmp 0x435c0c
cmp dword [esp + 0x480], ebx
jne 0x435bfb
xor esi, esi
jmp 0x435c0c
lea ecx, [esp + 0x20]
push ecx
push eax
call ebp
mov dword [esp + 0x480], eax
mov esi, eax
lea edx, [edi - 0xc]
mov byte [esp + 0x8a0], bl
cmp edx, dword [0x484060]
je 0x435c35
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x435c35
push edi
call fcn.0044ee34
add esp, 4
cmp esi, ebx
mov esi, dword [esp + 0x18]
jne 0x435b40
lea ecx, [esp + 0x20]
call fcn.00435580
push esi
call fcn.00401d20
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00435580
mov eax, 1
mov ecx, dword [esp + 0x898]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x880]
xor ecx, esp
call fcn.0044e20c
add esp, 0x890
ret
Function at 0x4368a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46a046
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea eax, [esp + 0xb]
push eax
lea edx, [esp + 0xf]
lea ecx, [esi + 4]
push edx
mov dword [esi], vtable.CUninstaller.0
call fcn.00435d00
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov ecx, dword [0x484064]
mov dword [esp + 0x18], eax
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [esi + 0x44], eax
call fcn.00426450
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x436990
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x46a07b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x2bc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2cc]
mov esi, ecx
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x436a39
cmp dword [esi + 0x30], 0
je 0x436a39
push 0x2a0
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0044e220
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx - 8]
lea eax, [edi + eax*2]
add esp, 0xc
cmp word [eax], 0x5c
jne 0x436a07
add eax, 2
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
lea ecx, [esp + 0x18]
push ecx
push eax
push ebx
call edx
test eax, eax
je 0x436a39
cmp dword [esp + 0x2ac], 0
jne 0x436a2d
cmp dword [esp + 0x2a8], 0
je 0x436a39
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x436a5b
movzx ecx, word [esi + 0x38]
movzx edx, word [esi + 0x3c]
shl ecx, 0x10
or ecx, edx
push ecx
push edi
push 0x343f
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [esi + 0x38]
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 0xffffffff
je 0x436a8f
test al, 0x10
je 0x436a8f
push edi
mov ebx, 1
call fcn.00401d20
add esp, 4
test eax, eax
je 0x436a96
mov eax, ebx
jmp 0x436b35
push edi
call ebp
test eax, eax
jne 0x436ab1
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x436acb
push edi
test ebx, ebx
jne 0x436ab8
call ebp
test eax, eax
je 0x436acb
mov eax, 1
jmp 0x436b35
call fcn.00401d20
add esp, 4
test eax, eax
je 0x436acb
mov eax, 1
jmp 0x436b35
push edi
lea ecx, [esp + 0x18]
call fcn.00419e60
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x48]
mov dword [esp + 0x2c8], 0
call fcn.0041c000
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
mov dword [esp + 0x2c4], 0xffffffff
cmp ecx, dword [0x484060]
je 0x436b1e
lea edi, [eax - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x436b1e
push edi
call fcn.0044ee34
add esp, 4
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x44], 1
test ecx, ecx
je 0x436b33
push 1
call fcn.00433300
xor eax, eax
mov ecx, dword [esp + 0x2bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a4]
xor ecx, esp
call fcn.0044e20c
add esp, 0x2b4
ret 4
Function at 0x437140
Capabilities:
Check if file exists

Disassembly:
call fcn.00404550
test eax, eax
je 0x43714f
mov eax, 1
ret
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x437192
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437192
push esi
call fcn.0044e0f0
add esp, 4
test eax, eax
je 0x437192
push esi
call fcn.004045d0
add esp, 4
test eax, eax
jne 0x437192
push 1
call fcn.0044dda0
push eax
push esi
call fcn.0044dfb0
add esp, 0xc
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x4371a0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.00437140
add esp, 4
test eax, eax
jne 0x4371b4
pop esi
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push esi
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret

Function at 0x438780
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46a2ab
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x82c]
push 0x800
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0044e220
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x438897
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.00419e60
lea ecx, [esp + 0xc]
mov dword [esp + 0x824], 0
call fcn.0041de20
push 0x22
lea ecx, [esp + 0x10]
call fcn.0041def0
lea ecx, [esp + 0xc]
call fcn.0041de80
push 0x22
lea ecx, [esp + 0x10]
call fcn.0041df50
mov esi, dword [esp + 0xc]
push 0x471f14
push esi
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43889b
lea ecx, [esi - 0xc]
cmp ecx, dword [0x484060]
je 0x438897
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x438897
push esi
call fcn.0044ee34
add esp, 4
xor eax, eax
jmp 0x4388ce
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.00417fb0
lea eax, [esi - 0xc]
cmp eax, dword [0x484060]
je 0x4388c9
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4388c9
push esi
call fcn.0044ee34
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044e20c
add esp, 0x81c
ret 4