joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4943d3
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0xa0c], ecx
call fcn.00492d63
mov dword [ebp - 0xa10], eax
test eax, eax
je 0x4944be
push 0x202
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.004b47e0
push 0x800
lea eax, [ebp - 0xa08]
push 0
push eax
call fcn.004b47e0
add esp, 0x18
test esi, esi
je 0x49445b
push esi
call fcn.004b5ec7
pop ecx
test eax, eax
je 0x49445b
push esi
push 0x101
lea eax, [ebp - 0x208]
push eax
call fcn.0040b640
jmp 0x49447d
lea eax, [ebp - 0xa14]
push eax
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0xa14], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4944be
push edi
push dword [ebp - 0xa10]
lea eax, [ebp - 0xa08]
push 0x4f9538
push 0x400
push eax
call fcn.0043e544
mov ecx, dword [ebp - 0xa0c]
add esp, 0x14
push ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x208]
push eax
push 4
lea eax, [ebp - 0xa08]
push eax
call fcn.00494209
jmp 0x4944c0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b48bf
leave
ret 0x14

Function at 0x4945b0
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x4e636d
call fcn.004b53ae
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
mov byte [ebp - 0x10], 0xff
mov byte [ebp - 0xf], 0xfe
mov dword [ebp - 0x14], esi
cmp dword [0x536040], eax
je 0x494606
cmp eax, esi
je 0x494606
push esi
lea ecx, [ebp - 0x14]
push ecx
push 2
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0043f1fb
call fcn.004b5486
ret
Function at 0x494d91
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4e863b
call fcn.004b53ae
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.0040c7d0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x18]
sub eax, dword [esi + 0x14]
add esi, 8
sar eax, 3
test eax, eax
jbe 0x494e27
mov edi, str._s_c
push ebx
mov ecx, esi
call fcn.00493457
mov eax, dword [eax]
push 0
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00445817
add esp, 0x10
push ebx
mov ecx, esi
call fcn.00493457
add eax, 4
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x494dfa
push 0
lea ecx, [ebp - 0x10]
call fcn.004452a8
jmp 0x494e17
push ebx
mov ecx, esi
call fcn.00493457
add eax, 4
mov eax, dword [eax]
push 0
push eax
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00445817
add esp, 0x10
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
inc ebx
sar eax, 3
cmp ebx, eax
jb 0x494dc1
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.004452a8
lea eax, [ebp - 0x14]
push eax
push 2
push ebx
push 0x504a10
push 0x80000002
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x494e96
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c8a0
push eax
push 7
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x494e96
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
mov al, bl
call fcn.004b5486
ret
xor bl, bl
jmp 0x494e82

Function at 0x494fbb
Capabilities:
Check if file exists

Disassembly:
push 0x210
mov eax, 0x4e740b
call fcn.004b5417
mov eax, ecx
sub eax, 0xffffff80
push str.360rcbase.dat
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00445250
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x495010
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d610
xor eax, eax
call fcn.004b549a
ret
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004b47e0
push 1
push 0x208
lea eax, [ebp - 0x218]
push eax
push ebx
mov edi, 0x504dec
push edi
mov esi, 0x504dd0
push esi
call fcn.0049291f
add esp, 0x24
test eax, eax
jne 0x495065
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d610
mov eax, ebx
jmp 0x49500a
lea eax, [ebp - 0x218]
push eax
push edi
push esi
call fcn.00492afd
add esp, 0xc
mov ebx, eax
jmp 0x495052
Function at 0x4958b6
Capabilities:
Persist via contextmenuhandlers registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x424
mov eax, 0x4e6651
call fcn.004b5417
xor edi, edi
mov esi, 0x208
push esi
lea eax, [ebp - 0x420]
push edi
push eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x424], edi
call fcn.004b47e0
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004b47e0
add esp, 0x18
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.Directory_shellexContextMenuHandlersSD360
mov ebx, 0x80000000
push ebx
call edi
test eax, eax
jne 0x495937
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x424], 1
lea eax, [ebp - 0x42c]
push eax
push 0x20019
push 0
push str.CLSID086F171D_5ED1_4ED2_B736_CFF3AD6A128E
push ebx
call edi
test eax, eax
jne 0x495963
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x424]
call fcn.0046a40c
test eax, eax
mov eax, dword [ebp - 0x428]
je 0x495979
push str.MenuEx64.dll
jmp 0x49597e
push str.MenuEx.dll
push dword [eax + 0x80]
lea eax, [ebp - 0x218]
push 0x4f9538
push esi
push eax
call fcn.00411380
add esp, 0x14
cmp dword [ebp - 0x424], 2
jne 0x495a1d
and dword [ebp - 0x42c], 0
lea eax, [ebp - 0x42c]
push eax
push 1
push 0
push str.CLSID086F171D_5ED1_4ED2_B736_CFF3AD6A128EInprocServer32
push ebx
call edi
test eax, eax
jne 0x495a04
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0x50ea8c
push dword [ebp - 0x42c]
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004b58df
pop ecx
pop ecx
test eax, eax
je 0x495a2d
lea eax, [ebp - 0x218]
push 1
push eax
call fcn.00493efd
pop ecx
pop ecx
cmp byte [0x53fe3c], 0
jne 0x495acf
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x430], 1
call fcn.004413bb
xor edi, edi
mov dword [ebp - 4], edi
push str.UserProfile
mov esi, str.software360TotalSecurity
push esi
lea eax, [ebp - 0x428]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x424]
push eax
push esi
mov esi, 0x80000002
push esi
mov dword [ebp - 0x424], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x495aa3
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x424], edi
push 4
lea eax, [ebp - 0x430]
push eax
push 4
push str.MenuScan
push dword [ebp - 0x428]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.0044209e
mov al, 1
call fcn.004b549a
ret
Function at 0x495dda
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6768
mov eax, dword fs:[0]
push eax
mov eax, 0x122c
call fcn.004b4f50
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1238], ecx
mov dword [ebp - 0x122c], eax
call fcn.00492d63
mov dword [ebp - 0x1228], eax
xor eax, eax
push 0x40e
mov word [ebp - 0x624], ax
xor ebx, ebx
lea eax, [ebp - 0x622]
push ebx
push eax
call fcn.004b47e0
add esp, 0xc
cmp dword [ebp - 0x1228], ebx
jne 0x495f53
xor eax, eax
push 0x3fe
mov word [ebp - 0xa24], ax
lea eax, [ebp - 0xa22]
push ebx
push eax
mov dword [ebp - 0x1228], ebx
call fcn.004b47e0
lea eax, [ebp - 0x1228]
push eax
push 0x200
lea eax, [ebp - 0xa24]
push eax
push edi
call fcn.004955bc
add esp, 0x1c
test eax, eax
je 0x495f22
lea eax, [ebp - 0xa24]
push eax
lea ecx, [ebp - 0x1234]
call fcn.0044bc85
mov dword [ebp - 4], ebx
mov edi, 0x4f8b70
push edi
lea ecx, [ebp - 0x1234]
call fcn.0046a81e
push esi
lea ecx, [ebp - 0x1230]
call fcn.0044bc85
mov byte [ebp - 4], 1
push edi
lea ecx, [ebp - 0x1230]
call fcn.0046a70c
push dword [ebp - 0x1230]
lea eax, [ebp - 0x624]
push dword [ebp - 0x1234]
push 0x4f9538
push 0x208
push eax
call fcn.0043e544
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1230]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1234]
call fcn.0040d610
cmp dword [ebp - 0x1228], ebx
je 0x496045
push dword [ebp - 0x1228]
mov ecx, dword [ebp - 0x1238]
call fcn.00492d63
mov dword [ebp - 0x1228], eax
lea esi, [ebp - 0x624]
cmp eax, ebx
je 0x496045
xor eax, eax
push 0x7fe
mov word [ebp - 0x1224], ax
lea eax, [ebp - 0x1222]
push ebx
push eax
call fcn.004b47e0
xor eax, eax
push 0x200
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.004b47e0
push 0x202
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.004b47e0
push 0x800
lea eax, [ebp - 0x1224]
push ebx
push eax
call fcn.004b47e0
add esp, 0x30
cmp dword [ebp - 0x122c], ebx
je 0x495fe1
push dword [ebp - 0x122c]
call fcn.004b5ec7
pop ecx
test eax, eax
je 0x495fe1
push dword [ebp - 0x122c]
lea eax, [ebp - 0x214]
push 0x101
push eax
call fcn.0040b640
jmp 0x496003
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x122c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x496045
push esi
push dword [ebp - 0x1228]
lea eax, [ebp - 0x1224]
push 0x4f9538
push 0x400
push eax
call fcn.0043e544
mov ecx, dword [ebp - 0x1238]
add esp, 0x14
push dword [ebp + 0x14]
lea eax, [ebp - 0x214]
push eax
push 2
push 4
lea eax, [ebp - 0x1224]
push eax
call fcn.004935a1
jmp 0x496047
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b48bf
leave
ret 0x10
Function at 0x49621b
Capabilities:
Persist via run registry key

Disassembly:
push 0x1c
mov eax, 0x4e6870
call fcn.004b53ae
call fcn.004952e8
test al, al
je 0x4962d2
lea ecx, [ebp - 0x10]
call fcn.0040c7d0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push eax
call fcn.0046b1c7
mov byte [ebp - 4], 1
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x10]
push str.__s_safemon_s___start
push eax
call fcn.0040e3f0
add esp, 0x14
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040d610
push ebx
push dword [ebp - 0x10]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.QHSafeTray
call fcn.0044bc85
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.0044bc85
mov byte [ebp - 4], 3
push 0x80000002
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.00443769
mov byte [ebp - 4], 4
push eax
call fcn.0043ea28
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
call fcn.004b5486
ret
Function at 0x4962d8
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
push 0x1c
mov eax, 0x4e68b3
call fcn.004b53ae
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x49649f
cmp dword [ebp + 0xc], ebx
je 0x49649f
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x10]
call fcn.0044bc85
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x10]
call fcn.00444b0f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push 0x80000002
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x4963c4
push 0x4f8b70
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00445250
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00445250
add esp, 0x18
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.0040d610
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 0xc]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push ebx
push str.Path
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.0040d610
call fcn.0046a127
test eax, eax
jne 0x4963da
call fcn.0046b02f
test eax, eax
je 0x496493
push str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x10]
call fcn.00428d50
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x10]
call fcn.00444b0f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x102
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
push 0x80000002
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x496493
push 0x4f8b70
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00445250
mov byte [ebp - 4], 4
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00445250
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.0040d610
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx - 0xc]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push ebx
push str.Path
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
call fcn.004b5486
ret
Function at 0x4964a5
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x484
mov eax, 0x4e68ef
call fcn.004b5417
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x490]
push ebx
push eax
call fcn.004b47e0
push 0x10
lea eax, [ebp - 0x44c]
push ebx
push eax
mov dword [ebp - 0x490], esi
call fcn.004b47e0
add esp, 0x18
lea ecx, [ebp - 0x428]
call fcn.0040c7d0
mov dword [ebp - 4], ebx
mov esi, 0x400
push esi
lea ecx, [ebp - 0x428]
call fcn.00444b2e
push 0x50ea8c
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x434], eax
call fcn.0044bc85
mov byte [ebp - 4], 1
lea eax, [ebp - 0x42c]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x496658
mov edi, 0x208
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004b47e0
push edi
lea eax, [ebp - 0x21c]
push ebx
push eax
mov dword [ebp - 0x438], edi
call fcn.004b47e0
add esp, 0x18
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x430]
push eax
push ebx
push str.Path
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49664c
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x430]
dec eax
jne 0x4965d8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0044bc85
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x424]
call fcn.004453ce
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x43c]
call fcn.0040d610
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x434]
push str.safemonQHWatchdog.exe
push dword [ebp - 0x424]
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x496658
push edi
call fcn.0043b8a5
pop ecx
test eax, eax
je 0x496658
push edi
lea eax, [ebp - 0x420]
push str.__s___install
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x490]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x496658
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x424]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.0040d610
call fcn.004b549a
ret
Function at 0x49710f
Capabilities:
Delete file

Disassembly:
push 0x20
mov eax, 0x4e6b61
call fcn.004b53ae
xor ebx, ebx
cmp byte [0x53fe3c], bl
je 0x4971d6
push 0x505508
lea ecx, [ebp - 0x14]
call fcn.0044bc85
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00496f9c
pop ecx
cmp eax, 0xffffffff
pop ecx
sete byte [ebp - 0xd]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
cmp byte [ebp - 0xd], bl
je 0x4971d6
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004625ff
pop ecx
pop ecx
mov dword [ebp - 4], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x50ea8c
call fcn.0044bc85
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.SOFTWARE360TotalSecurityTheme
call fcn.0044bc85
mov byte [ebp - 4], 3
push 0x80000001
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00443769
mov byte [ebp - 4], 4
push eax
call fcn.0046f194
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00443c39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
call fcn.00447055
mov ecx, eax
call fcn.00492bf1
call fcn.004b5486
ret
Function at 0x497605
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x28
mov eax, 0x4e6cc9
call fcn.004b53ae
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov ebx, str.OperaShown
push ebx
call fcn.0044bc85
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov edi, str.SOFTWARE360TotalSecurityIntro
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
mov esi, 0x80000002
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00443769
mov dword [ebp - 4], 2
push eax
call fcn.00493a03
pop ecx
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00443c39
cmp dword [ebp - 0x18], 0
jne 0x4976d9
and dword [ebp - 0x14], 0
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push str.InstallOpera
push str.SOFTWARE360TotalSecurityUserProfile
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x10], 1
call fcn.0045df99
test al, al
jne 0x4976c4
cmp dword [0x53fe64], 0
je 0x4976c4
cmp dword [ebp - 0x14], 0
jne 0x4976c4
mov dword [ebp - 0x10], 1
jmp 0x4976c8
and dword [ebp - 0x10], 0
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.004b5486
ret
Function at 0x4976df
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x4e6d24
call fcn.004b53ae
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.ShowV1
mov dword [ebp - 0x10], esi
call fcn.00446796
mov dword [ebp - 4], esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
mov edi, str.SOFTWARE360TotalSecurityDailyNews
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
mov esi, 0x80000002
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443769
mov dword [ebp - 4], 2
push eax
call fcn.0043e957
mov ebx, eax
neg ebx
sbb bl, bl
pop ecx
pop ecx
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443c39
test bl, bl
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
je 0x4977be
push str.ShowV1
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 1
call fcn.00446796
mov dword [ebp - 4], 3
mov eax, dword [eax]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push eax
push edi
push esi
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
push str.Show
lea ecx, [ebp - 0x14]
call fcn.00446796
push 4
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
push ecx
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push edi
push esi
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d610
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.NewsShown
call fcn.0044bc85
mov dword [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, str.SOFTWARE360TotalSecurityIntro
push edi
call fcn.0044bc85
mov byte [ebp - 4], 6
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443769
mov dword [ebp - 4], 7
push eax
call fcn.00493a03
pop ecx
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443c39
cmp dword [ebp - 0x14], 0
jne 0x497838
xor eax, eax
cmp dword [ebp - 0x10], eax
push 4
sete al
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push str.NewsShown
push edi
push esi
call ebx
call fcn.004b5486
ret
Function at 0x49783e
Capabilities:
Set registry value

Disassembly:
push 0x20
mov eax, 0x4e6d77
call fcn.004b53ae
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, str.DesktopPlusShown
push ebx
call fcn.0044bc85
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov edi, str.SOFTWARE360TotalSecurityIntro
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
mov esi, 0x80000002
push esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00443769
mov dword [ebp - 4], 2
push eax
call fcn.00493a03
pop ecx
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00443c39
cmp dword [ebp - 0x14], 0
jne 0x49797f
cmp byte [0x53fe3c], 0
jne 0x4978e9
push 0x53fe7c
call fcn.0049474a
pop ecx
test eax, eax
jne 0x4978e9
call fcn.0043a034
test eax, eax
jne 0x4978e9
and dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x49797f
push 0x50ea8c
lea ecx, [ebp - 0x10]
call fcn.0044bc85
mov dword [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.first_show_desktoplite
call fcn.0044bc85
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SOFTWARE360desktoplite
call fcn.0044bc85
mov byte [ebp - 4], 5
push 0x80000001
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00443769
mov byte [ebp - 4], 6
push eax
call fcn.0044b15c
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.00443c39
xor eax, eax
cmp dword [ebp - 0x14], eax
push 4
sete al
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d610
call fcn.004b5486
ret