joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x478082
cmp word [edi], 0
je 0x478082
lea eax, [ebp + 8]
push esi
push eax
call fcn.00474040
mov eax, dword [eax]
add esp, 4
push eax
mov ecx, 0x594218
call fcn.004399f0
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47804c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
pop esi
je 0x478065
push edi
mov ecx, 0x594218
call fcn.004f3740
test eax, eax
setne al
test al, al
jne 0x478084
push 5
push 0
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg al
pop edi
pop ebp
ret
xor al, al
pop edi
pop ebp
ret

Function at 0x482b60
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x482ba0
mov eax, dword [esi + 0xc]
push 0x7d0
push eax
mov byte [esi + 0x10], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x482b8f
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
push edi
mov edi, dword [esi]
test edi, edi
je 0x482bbd
mov ecx, edi
call fcn.00482ad0
push edi
call fcn.0051d230
add esp, 4
mov dword [esi], 0
cmp dword [esi + 4], 0
pop edi
je 0x482bcb
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x489670
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x20]
mov dword [ebp - 8], 0
cmp dword [eax - 0xc], 0
jne 0x489690
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
push esi
push 0x80
push 4
push esi
push 3
push SysReAllocString
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4896c3
call fcn.00414c40
test eax, eax
je 0x4896c8
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, eax
mov dword [ebp - 4], esi
push edi
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 8], 0
jne 0x48970f
cmp eax, 0x64
jb 0x48970f
push 0
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041a9b0
test eax, eax
jne 0x48970f
push 0x64
lea edi, [ebx + 0x24]
push edi
lea ecx, [ebp - 4]
call fcn.0041a920
test eax, eax
jne 0x48970f
mov edi, dword [edi]
cmp edi, 1
je 0x48972d
cmp edi, 2
je 0x48972d
mov ecx, ebx
call fcn.004841f0
movzx edi, al
test esi, esi
je 0x489724
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x489738
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x497f29
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0xc]
push ecx
push 0x20
push edx
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x497f22
cmp dword [ebp + 0xc], 0x20
jne 0x497f22
mov eax, esi
pop esi
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x498a10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x599458
call edx
add eax, 0x10
mov dword [esi], eax
xor eax, eax
push eax
push 0x80
push 3
push eax
lea edi, [esi + 4]
mov dword [edi + 4], eax
mov dword [edi], eax
mov byte [edi + 8], al
push 1
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x498a72
pop edi
mov dword [esi + 0x10], 0x6b
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x498ac3
mov ecx, dword [ebp + 8]
push ecx
mov ecx, esi
call fcn.00459660
mov edx, dword [ebp - 4]
push edx
mov ecx, edi
call fcn.00497d20
mov eax, dword [edi]
mov edi, dword [ebp - 4]
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x498abc
cmp dword [ebp - 8], edi
je 0x498aca
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0x6d
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49f760
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x49f8f8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x49f8f8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x49f8f8
cmp dword [ebp + 0x14], 0
je 0x49f8f8
push esi
xor esi, esi
cmp edx, 2
jbe 0x49f83c
mov dword [ebp + 8], 4
mov al, byte [edi]
mov cl, byte [edi + 1]
sub dword [ebp + 0xc], 3
mov bl, al
inc edi
mov dl, byte [edi + 1]
shr bl, 2
and al, 3
mov byte [ebp - 4], bl
mov bl, cl
shl al, 4
inc edi
shr bl, 4
add al, bl
and cl, 0xf
mov byte [ebp - 3], al
add cl, cl
mov al, dl
shr al, 6
add cl, cl
add cl, al
mov eax, dword [ebp + 8]
and dl, 0x3f
inc edi
mov byte [ebp - 1], dl
cmp eax, dword [ebp + 0x14]
ja 0x49f8e1
movzx edx, byte [ebp - 4]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0x10]
mov byte [esi + ebx], dl
movzx edx, byte [ebp - 3]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + ebx], dl
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ecx, byte [ebp - 1]
inc esi
inc eax
mov byte [esi + ebx], dl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
inc esi
inc eax
mov byte [esi + ebx], dl
inc eax
inc esi
cmp dword [ebp + 0xc], 2
mov dword [ebp + 8], eax
ja 0x49f7a4
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x49f8dc
xor al, al
xor cl, cl
mov byte [ebp + 0xa], 0
mov byte [ebp + 9], al
mov byte [ebp + 8], cl
test edx, edx
jbe 0x49f86a
push edx
lea eax, [ebp + 8]
push edi
push eax
call fcn.0051f280
mov al, byte [ebp + 9]
mov cl, byte [ebp + 8]
add esp, 0xc
mov dl, cl
shr dl, 2
mov byte [ebp - 4], dl
mov dl, al
and cl, 3
shr dl, 4
and al, 0xf
shl cl, 4
add cl, dl
mov dl, byte [ebp + 0xa]
add al, al
shr dl, 6
add al, al
add al, dl
lea edx, [esi + 4]
cmp edx, dword [ebp + 0x14]
jbe 0x49f8a1
pop esi
pop edi
mov eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, byte [ebp - 4]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], dl
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + ebx], dl
inc esi
cmp dword [ebp + 0xc], 1
jne 0x49f8ca
mov byte [esi + ebx], 0x3d
jmp 0x49f8d6
movzx eax, al
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], cl
inc esi
mov byte [esi + ebx], 0x3d
inc esi
cmp esi, dword [ebp + 0x14]
jb 0x49f8eb
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + ebx], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x14], 0
push ebx
push esi
push edi
je 0x4a1ba8
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a1ba8
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a1ba8
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4a1ba8
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push eax
lea ecx, [ebp - 4]
push str._s_s
push ecx
call fcn.004a19c0
mov eax, dword [ebp + 0x10]
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push esi
mov bl, 1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4a1b95
cmp dword [ebp - 8], 4
je 0x4a1b97
xor bl, bl
lea ecx, [ebp - 4]
call fcn.00443d90
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
test ebx, ebx
je 0x4a1c61
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a1c61
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4a1c61
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push edi
add eax, 0x10
push ebx
mov dword [ebp + 0x18], eax
lea eax, [ebp + 0x18]
push str._s_s
push eax
call fcn.004a19c0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
add esp, 0x10
push ecx
mov ecx, dword [ebp + 0x1c]
push edx
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [ebp + 0x18]
push esi
push ecx
mov bl, 1
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4a1c3a
cmp dword [ebp - 4], 3
je 0x4a1c3c
xor bl, bl
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a1c58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
test ebx, ebx
je 0x4a1d25
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a1d25
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4a1d25
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push edi
add eax, 0x10
push ebx
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push str._s_s
push eax
call fcn.004a19c0
mov edx, dword [ebp + 0x10]
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [ebp + 0x14]
push esi
push ecx
mov bl, 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4a1cfe
mov eax, dword [ebp - 4]
cmp eax, 0xb
je 0x4a1d00
cmp eax, 4
je 0x4a1d00
xor bl, bl
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a1d1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4a1dd1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a1dd1
cmp dword [ebp + 0xc], 0
je 0x4a1dd1
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4a1dd1
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push ebx
add eax, 0x10
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp + 0x14]
push ecx
push edi
xor ebx, ebx
push esi
mov dword [ebp + 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4a1da4
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x14], ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push ecx
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea ecx, [ebp - 4]
sete bl
call fcn.00443d90
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
test esi, esi
je 0x4a1e9b
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a1e9b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4a1e9b
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push edi
add eax, 0x10
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
mov edi, dword [ebp + 0x1c]
add esp, 0x10
lea ecx, [ebp + 0x18]
push ecx
push esi
push edi
mov dword [ebp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4a1e5b
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
push eax
push ecx
push 3
push ebx
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [esi - 0x10]
sete bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a1e92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a1eb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
test esi, esi
je 0x4a1f69
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a1f69
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4a1f69
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push edi
add eax, 0x10
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
mov edi, dword [ebp + 0x1c]
add esp, 0x10
lea ecx, [ebp + 0x18]
push ecx
push esi
push edi
mov dword [ebp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4a1f2b
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x18], 0
mov esi, dword [ebp - 4]
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push ebx
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [esi - 0x10]
sete bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a1f60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1f80
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
push ebx
push esi
push edi
je 0x4a1ff2
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4a1ff2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a1ff2
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4a1ff2
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push eax
lea ecx, [ebp - 4]
push str._s_s
push ecx
call fcn.004a19c0
mov edx, dword [ebp - 4]
add esp, 0x10
push edi
push edx
push esi
mov bl, 1
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x4a1fe1
xor bl, bl
lea ecx, [ebp - 4]
call fcn.00443d90
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a26d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4a278a
xor edx, edx
cmp edx, str.FullCheck
je 0x4a278a
xor eax, eax
cmp eax, str.Options
je 0x4a278a
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.FullCheck
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp + 8]
push edx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4a2766
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], 0
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Options
push edx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret

Function at 0x4a29e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4a2a4d
xor ecx, ecx
cmp ecx, str.FullCheck
je 0x4a2a4d
xor edx, edx
cmp edx, str.Options
je 0x4a2a4d
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
call edx
push str.FullCheck
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
mov ecx, dword [ebp - 4]
add esp, 0x10
push str.Options
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov esp, ebp
pop ebp
ret
Function at 0x4a2bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0xc
cmp eax, str.software360TotalSecurity
je 0x4a2c67
xor ecx, ecx
cmp ecx, str.FullCheck
je 0x4a2c67
xor edx, edx
cmp edx, str.ShowOptions
je 0x4a2c67
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
push ebx
mov ecx, 0x599458
call edx
push str.FullCheck
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s_s
push eax
call fcn.004a19c0
mov edx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push str.ShowOptions
push ecx
push SysReAllocString
mov bl, 1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4a2c56
cmp dword [ebp - 8], 4
je 0x4a2c58
xor bl, bl
lea ecx, [ebp - 4]
call fcn.00443d90
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4a2cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
xor ecx, ecx
mov dword [ebp - 8], eax
cmp ecx, str.software360TotalSecurity
je 0x4a2d61
xor edx, edx
cmp edx, str.Experience
je 0x4a2d61
cmp ecx, str.UsageCount
je 0x4a2d61
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.Experience
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push str.UsageCount
push edx
push SysReAllocString
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [ebp - 4]
call fcn.00443d90
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4a2e80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xc], esi
cmp ecx, str.software360TotalSecurity
je 0x4a2fbe
xor edx, edx
cmp edx, str.UserProfile
je 0x4a2fbe
cmp ecx, str.DeviceStatus
je 0x4a2fbe
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
push ebx
mov ecx, 0x599458
call eax
push str.UserProfile
push str.software360TotalSecurity
lea ecx, [ebp - 4]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp - 4], eax
call fcn.004a19c0
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push str.DeviceStatus
push edx
push SysReAllocString
mov bl, 1
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4a2f1e
cmp dword [ebp - 8], 4
je 0x4a2f20
xor bl, bl
lea ecx, [ebp - 4]
call fcn.00443d90
test bl, bl
pop ebx
je 0x4a2fbc
mov eax, dword [ebp - 0xc]
cmp eax, 2
jbe 0x4a2fbe
mov eax, dword [0x599458]
mov edx, dword [eax + 0xc]
mov ecx, 0x599458
mov dword [ebp - 0x10], esi
call edx
push str.UserProfile
add eax, 0x10
push str.software360TotalSecurity
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.004a19c0
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4a2f98
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 8]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.DeviceStatus
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 8]
call fcn.00443d90
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a2fe0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
mov esi, str.Lic2
jne 0x4a2ff4
mov esi, 0x566140
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4a3056
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x4a3056
test esi, esi
je 0x4a3056
mov edx, dword [0x599458]
mov eax, dword [edx + 0xc]
mov ecx, 0x599458
call eax
push str.UserProfile
push str.software360TotalSecurity
lea ecx, [ebp + 8]
add eax, 0x10
push str._s_s
push ecx
mov dword [ebp + 8], eax
call fcn.004a19c0
mov edx, dword [ebp + 8]
add esp, 0x10
push esi
push edx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea ecx, [ebp + 8]
pop esi
pop ebp
jmp fcn.00443d90
pop esi
pop ebp
ret