joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447a2c
Capabilities:
Check os version
Get common file path

Disassembly:
push 0x334
mov eax, 0x4dc271
call fcn.004b5257
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0x334]
push edi
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
mov dword [ebp - 0x334], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor esi, esi
inc esi
test eax, eax
je 0x447a86
cmp dword [ebp - 0x330], 6
jne 0x447a86
cmp dword [ebp - 0x32c], esi
jb 0x447a86
mov eax, esi
call fcn.004b52da
ret
push edi
push 0x25
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x338]
call fcn.0040c7d0
mov dword [ebp - 4], edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x338]
push 0x4f9eb0
push eax
call fcn.0040e3f0
add esp, 0xc
push 0x4f9e94
lea ecx, [ebp - 0x338]
call fcn.00444b0f
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x33c]
push eax
push dword [ebp - 0x338]
mov dword [ebp - 0x33c], edi
call fcn.0043bad7
add esp, 0xc
test eax, eax
je 0x447b22
mov eax, dword [ebp - 0x33c]
shr eax, 0x10
cmp ax, 6
jne 0x447b22
cmp word [ebp - 0x33c], si
jb 0x447b22
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.0040d610
jmp 0x447a7e
xor esi, esi
jmp 0x447b0e

Function at 0x44a3a4
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x41c], esi
call fcn.00444bb6
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x44a4d0
push dword [ebp + 8]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x418], eax
cmp eax, ebx
je 0x44a4d0
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x424], ebx
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 4
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x418]
call sub.PSAPI.DLL_EnumProcessModules
mov esi, 0x104
test eax, eax
je 0x44a466
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x418]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x44a466
lea eax, [ebp - 0x20c]
jmp 0x44a4b1
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call fcn.0043da65
test eax, eax
je 0x44a4bd
xor eax, eax
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.004b4620
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043e5cf
add esp, 0x18
lea eax, [ebp - 0x414]
mov ecx, dword [ebp - 0x41c]
push eax
call fcn.0040c660
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x41c]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp eax, dword [esi + 0x14]
pop esi
sbb eax, eax
xor ecx, ebp
neg eax
pop ebx
call fcn.004b46ff
leave
ret
Function at 0x44a4e7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.00444bb6
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a51c
xor eax, eax
jmp 0x44a57e
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x44a562
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x44a568
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x44a54a
jmp 0x44a56e
mov ebx, dword [ebp - 0x218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
call fcn.0044a3a4
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b46ff
leave
ret

Function at 0x44a58d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4dc6c9
call fcn.004b5257
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor esi, esi
lea eax, [ebp - 0x216]
push ebx
inc esi
push eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], 0x104
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, edi
cmp eax, ebx
je 0x44a61a
push 0x50ea0c
call fcn.0042b420
jmp 0x44a635
cmp dword [ebp - 0x220], esi
je 0x44a629
push 0x50ea0c
jmp 0x44a630
lea eax, [ebp - 0x218]
push eax
call fcn.0042b420
mov dword [ebp - 4], ebx
mov dword [ebp - 0x21c], esi
mov eax, edi
call fcn.004b52da
ret
Function at 0x44a646
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x260
mov eax, 0x4dc602
call fcn.004b5257
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], ebx
call fcn.0040c5e0
mov dword [ebp - 4], ebx
xor esi, esi
inc esi
push ebx
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x220], 7
call fcn.0040daa0
mov dword [ebp - 4], esi
push edi
lea ecx, [ebp - 0x238]
call fcn.0040c660
push str._shellopencommand
lea ecx, [ebp - 0x238]
call fcn.00447c32
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x258], ebx
jae 0x44a6d3
lea eax, [ebp - 0x234]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x258]
push ecx
push eax
push 0x80000000
call edi
mov esi, 0x208
test eax, eax
jne 0x44a77a
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x260], ebx
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
push ebx
push dword [ebp - 0x258]
mov dword [ebp - 0x25c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 0x14], cx
cmp eax, ebx
jne 0x44a76e
cmp dword [ebp - 0x260], 1
jne 0x44a76e
mov eax, dword [ebp - 0x25c]
and eax, 0xfffffffe
cmp eax, esi
jae 0x44a76e
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x21c]
push eax
call fcn.0040c660
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043a906
test al, al
je 0x44a8a1
mov eax, dword [ebp - 0x264]
cmp dword [eax + 0x18], 8
jb 0x44a798
mov eax, dword [eax + 4]
jmp 0x44a79b
add eax, 4
push str.C:Windows_system32LaunchWinApp.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
je 0x44a8a1
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
push 0x80000000
call edi
test eax, eax
jne 0x44a8a1
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x25c], ebx
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push str.FriendlyTypeName
push dword [ebp - 0x258]
mov dword [ebp - 0x260], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 0x14], cx
cmp eax, ebx
jne 0x44a895
cmp dword [ebp - 0x25c], 1
jne 0x44a895
mov eax, dword [ebp - 0x260]
and eax, 0xfffffffe
cmp eax, esi
jae 0x44a895
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.0042b420
mov byte [ebp - 4], 2
cmp dword [ebp - 0x23c], 8
mov eax, dword [ebp - 0x250]
jae 0x44a861
lea eax, [ebp - 0x250]
push dword [0x53530c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44a883
push dword [0x53530c]
mov ecx, dword [ebp - 0x264]
call fcn.0040c660
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x254]
call fcn.0040d590
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.0040d590
mov eax, dword [ebp - 0x264]
call fcn.004b52da
ret
Function at 0x44a8be
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x4dc64c
call fcn.004b5257
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x22c], esi
mov ecx, ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x220], esi
call fcn.0040c5e0
mov dword [ebp - 4], esi
lea eax, [ebp - 0x220]
push eax
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [ebp - 0x22c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44a9a4
mov edi, 0x208
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
mov dword [ebp - 0x228], esi
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push str.Progid
push dword [ebp - 0x220]
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a998
cmp dword [ebp - 0x228], 1
jne 0x44a998
mov eax, dword [ebp - 0x224]
and eax, 0xfffffffe
cmp eax, edi
jae 0x44a998
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.0040c660
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.004b52da
ret

Function at 0x44a9ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], 1
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push str.clid
push dword [0x535260]
mov dword [ebp - 0x214], 0x208
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x44aa28
xor al, al
jmp 0x44aa38
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0040c660
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b46ff
leave
ret
Function at 0x44aa45
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x830], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004b4620
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004b4620
add esp, 0x18
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x82c]
push eax
push dword [0x535284]
lea edi, [esi + 2]
push dword [0x535258]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x80000001
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x828], edi
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x82c]
push eax
push dword [0x535284]
push dword [0x535258]
push 0x80000002
call esi
push edi
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004b4620
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x44ab2f
lea eax, [ebp - 0x20c]
jmp 0x44ab42
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x44aba6
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
call fcn.0040b640
push edi
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004b4620
add esp, 0xc
push str.......chrome.exe
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x44aba6
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
je 0x44aba6
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x61c]
push eax
call fcn.0040c660
mov al, 1
jmp 0x44aba8
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b46ff
leave
ret

Function at 0x44abb6
Capabilities:
Check if file exists

Disassembly:
push 0x430
mov eax, 0x4dc67f
call fcn.004b5257
xor edi, edi
push edi
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x424], 7
call fcn.0040daa0
mov dword [ebp - 4], edi
lea eax, [ebp - 0x43c]
push eax
call fcn.0044aa45
pop ecx
test al, al
jne 0x44ac0d
xor bl, bl
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040d590
mov al, bl
call fcn.004b52da
ret
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b4620
push dword [0x5352a4]
lea eax, [ebp - 0x218]
push str.....User_DataDefaultExtensions_s
push 0x104
push eax
call fcn.0043e544
xor eax, eax
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.004b4620
mov eax, dword [ebp - 0x438]
add esp, 0x28
cmp dword [ebp - 0x424], 8
jae 0x44ac74
lea eax, [ebp - 0x438]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x44abf1
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44aca9
mov bl, 1
jmp 0x44abf3
push 1
push dword [0x5352a4]
push str.Chrome
push str.Google
call fcn.0043e702
add esp, 0x10
mov bl, al
jmp 0x44abf3
Function at 0x44af36
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4dc6c9
call fcn.004b5257
mov ebx, dword [ebp + 8]
and dword [ebp - 0x21c], 0
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push 0
inc esi
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], esi
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office
push 0x80000001
mov dword [ebp - 0x224], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, ebx
test eax, eax
jne 0x44afbc
lea eax, [ebp - 0x218]
push eax
call fcn.0042b420
jmp 0x44afc6
push 0x50ea0c
call fcn.0042b420
and dword [ebp - 4], 0
mov dword [ebp - 0x21c], esi
mov eax, ebx
call fcn.004b52da
ret
Function at 0x44ba58
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x420
mov eax, 0x4dc7ad
call fcn.004b528d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x428], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1_
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x418], eax
cmp eax, ebx
jne 0x44bab7
call dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
xor eax, eax
inc eax
call fcn.004b52e9
ret
call esi
push 4
lea eax, [ebp + 0xc]
push eax
push 2
push dword [ebp - 0x418]
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
call edi
push 4
lea eax, [ebp + 0xc]
push eax
push 5
push dword [ebp - 0x418]
call edi
push 4
lea eax, [ebp + 0xc]
push eax
push 6
push dword [ebp - 0x418]
call edi
push 4
lea eax, [ebp + 0xc]
push eax
push 8
push dword [ebp - 0x418]
call edi
call esi
push ebx
push 0x80080000
push ebx
push ebx
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
cmp edi, ebx
jne 0x44bb3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x44baae
call esi
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x42c], 4
call esi
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
call esi
mov dword [ebp - 0x420], ebx
mov eax, dword [ebp - 0x424]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x44bbfe
mov byte [ebp - 0x414], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x413]
push eax
call fcn.004b4620
add esp, 0xc
mov dword [ebp - 0x41c], ebx
mov esi, 0x400
push esi
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x44bbfe
mov ecx, dword [ebp - 0x428]
cmp ecx, ebx
je 0x44bbfe
cmp dword [ebp - 0x41c], ebx
je 0x44bbfe
lea eax, [ebp - 0x414]
push eax
call fcn.004208c0
cmp dword [ebp - 0x41c], ebx
jne 0x44bba7
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x420], ebx
je 0x44bc1e
xor eax, eax
jmp 0x44bab1
or dword [ebp - 4], 0xffffffff
jmp 0x44baae
Function at 0x44dfc9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4dcb0a
call fcn.004b5257
mov edi, dword [ebp + 8]
and dword [ebp - 0x220], 0
mov esi, 0x208
push esi
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x228], edi
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
mov dword [ebp - 0x21c], esi
push str.Path
xor esi, esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
inc esi
push 0x80000002
mov dword [ebp - 0x224], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44e07d
mov edx, dword [ebp - 0x21c]
shr edx, 1
dec edx
cmp edx, 0x104
jae 0x44e07d
lea eax, [edx + edx]
lea ecx, [ebp + eax - 0x218]
cmp word [ecx], 0x5c
je 0x44e075
cmp edx, 0x103
jae 0x44e07d
push 0x5c
pop edx
mov word [ecx], dx
xor ecx, ecx
mov word [ebp + eax - 0x216], cx
lea eax, [ebp - 0x218]
jmp 0x44e082
mov eax, 0x50ea0c
push eax
mov ecx, edi
call fcn.0044bc85
and dword [ebp - 4], 0
mov dword [ebp - 0x220], esi
mov eax, edi
call fcn.004b52da
ret

Function at 0x44e2ad
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4dcb9d
call fcn.004b5257
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [0x535080]
mov dword [ebp - 0x220], 1
push dword [0x53507c]
mov dword [ebp - 0x224], 0x104
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44e38a
cmp dword [ebp - 0x220], 1
jne 0x44e38a
lea eax, [ebp - 0x228]
push eax
call fcn.0044dfc9
and dword [ebp - 4], 0
mov dword [esp], str.safemonwebprotection_firefox
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.0040d610
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0043f457
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d610
mov al, bl
jmp 0x44e38c
xor al, al
call fcn.004b52da
ret
Function at 0x44e392
Capabilities:
Check if file exists
Query environment variable
Read .ini file

Disassembly:
push 0x420
mov eax, 0x4dcbdb
call fcn.004b5257
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x428], eax
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004b4620
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x424]
call fcn.0044bc85
and dword [ebp - 4], 0
xor eax, eax
push edi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.004b4620
add esp, 0xc
push str.MozillaFirefox
lea ecx, [ebp - 0x424]
call fcn.00444b0f
push str.profiles.ini
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00445250
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [eax]
mov ebx, dword [ebx]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push 0x50ea0c
push str.Path
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x42c]
call fcn.0040d610
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x424]
push 0x4fa698
push eax
call fcn.00445817
add esp, 0xc
push dword [ebp - 0x424]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44e4c6
mov ecx, dword [ebp - 0x428]
lea eax, [ebp - 0x424]
push eax
call fcn.004453ce
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.0040d610
mov al, bl
call fcn.004b52da
ret
xor bl, bl
jmp 0x44e4af
Function at 0x44e4ca
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x2cc
mov eax, 0x4dcc2f
call fcn.004b5257
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x24c
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x25c]
push ebx
push eax
mov dword [ebp - 0x260], ebx
call fcn.004b4620
mov edi, 0x4f8b70
push edi
push dword [ebp - 0x268]
lea eax, [ebp - 0x284]
push eax
call fcn.0044c3ea
mov dword [ebp - 4], ebx
push esi
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.00448c6e
add esp, 0x24
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x44e53a
mov eax, dword [eax + 4]
jmp 0x44e53d
add eax, 4
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], bl
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x2d8]
call fcn.0040d590
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp - 0x284]
call fcn.0040d590
cmp dword [ebp - 0x264], 0xffffffff
jne 0x44e585
xor al, al
jmp 0x44e61a
push edi
push dword [ebp - 0x268]
lea eax, [ebp - 0x2a0]
push eax
call fcn.0044c3ea
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x234]
push ecx
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.0044c3ea
add esp, 0x18
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x44e5c5
mov eax, dword [eax + 4]
jmp 0x44e5c8
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 2
push ebx
push esi
lea ecx, [ebp - 0x2bc]
call fcn.0040d590
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp - 0x2a0]
call fcn.0040d590
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44e585
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
call fcn.004b52da
ret
Function at 0x44e620
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x2b0
mov eax, 0x4dcc78
call fcn.004b5257
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x268], eax
cmp dword [esi + 0x14], edi
jne 0x44e649
xor al, al
jmp 0x44e740
push eax
push esi
call fcn.0044e4ca
push str..
lea eax, [ebp - 0x284]
push esi
push eax
call fcn.0044c3ea
add esp, 0x14
mov dword [ebp - 4], edi
cmp dword [eax + 0x18], 8
jb 0x44e673
mov eax, dword [eax + 4]
jmp 0x44e676
add eax, 4
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x264], eax
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x284]
call fcn.0040d590
cmp dword [ebp - 0x264], 0xffffffff
je 0x44e642
cmp word [ebp - 0x234], 0x2e
je 0x44e717
test byte [ebp - 0x260], 0x10
je 0x44e717
push 0x4f8b70
lea eax, [ebp - 0x2a0]
push esi
push eax
call fcn.0044c3ea
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x234]
push ecx
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.0044c3ea
mov byte [ebp - 4], 2
push dword [ebp - 0x268]
push eax
call fcn.0044e620
add esp, 0x20
mov byte [ebp - 4], bl
push edi
push ebx
lea ecx, [ebp - 0x2bc]
call fcn.0040d590
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x2a0]
call fcn.0040d590
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44e6a7
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
call fcn.004b52da
ret