joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bde79
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, 0x1400
mov dword [ebp - 0x20], eax
cmp cx, ax
je 0x4bdf1d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 9
lea ecx, [ebp - 0x18]
movzx eax, ax
push ecx
push 0x59
push eax
mov dword [ebp - 0x1c], eax
call ebx
cmp eax, 1
jle 0x4bdf1d
lea edi, [eax - 1]
lea eax, [ebp - 0x18]
push eax
call fcn.0040bf1b
mov esi, dword [ebp - 0x24]
and dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x4bdee7
mov eax, dword [esi]
jmp 0x4bdee9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
and eax, 0xfc00
cmp cx, ax
je 0x4bdf19
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push dword [ebp - 0x1c]
call ebx
cmp eax, 1
jle 0x4bdf19
lea edi, [eax - 1]
lea eax, [ebp - 0x18]
push eax
call fcn.0040bf1b
mov al, 1
jmp 0x4bdf1f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret

Function at 0x4c057c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
cmp byte [ebp + 8], al
je 0x4c0608
xor ecx, ecx
mov word [ebp - 0x210], cx
lea ecx, [ebp - 0x210]
push ecx
push eax
push 0xffffffffffffffff
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4c05c3
xor al, al
jmp 0x4c06d1
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x248]
call fcn.0040beca
mov eax, esi
push eax
lea eax, [ebp - 0x22c]
call fcn.0040c917
push eax
push ebx
call fcn.00422755
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.0040bad4
push 1
lea esi, [ebp - 0x248]
call fcn.0040bad4
jmp 0x4c0616
push 0x6c
mov ecx, ebx
call fcn.004b869f
pop ecx
test al, al
je 0x4c05bc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov dword [ebp - 0x250], str.Microsoft
mov dword [ebp - 0x24c], 9
call fcn.004b5f09
push eax
push ebx
call fcn.00422755
push 1
xor edi, edi
lea esi, [ebp - 0x22c]
call fcn.0040bad4
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov dword [ebp - 0x250], str.Internet_Explorer
mov dword [ebp - 0x24c], 0x11
call fcn.004b5f09
push eax
push ebx
call fcn.00422755
push 1
lea esi, [ebp - 0x22c]
call fcn.0040bad4
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, ebx
mov dword [ebp - 0x250], str.Quick_Launch
mov dword [ebp - 0x24c], 0xc
call fcn.004b5f09
push eax
push ebx
call fcn.00422755
push 1
lea esi, [ebp - 0x22c]
call fcn.0040bad4
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4c1c6e
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d1c
call fcn.00405ecb
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x2d18], eax
cmp eax, ebx
je 0x4c1dc1
push esi
mov dword [ebp - 0x2d10], ebx
mov dword [ebp - 0x2d0c], ebx
push edi
push dword [ebp - 0x2d0c]
mov eax, 0x200
push 0x667040
lea edi, [ebp - 0x204]
call fcn.004c16b1
pop ecx
pop ecx
push ebx
push ebx
push 3
push ebx
push 3
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d14], eax
cmp eax, 0xffffffff
je 0x4c1da4
xor eax, eax
lea edi, [ebp - 0x2d08]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, 0x2710
push esi
lea eax, [ebp - 0x2cfc]
push ebx
push eax
mov dword [ebp - 0x2d1c], ebx
mov dword [ebp - 0x2d08], ebx
mov dword [ebp - 0x2d04], ebx
call fcn.00402394
add esp, 0xc
push ebx
lea eax, [ebp - 0x2d1c]
push eax
push esi
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push dword [ebp - 0x2d14]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4c1d90
push 0x3e8
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.00402394
mov eax, dword [ebp - 0x2ce4]
add esp, 0xc
lea esi, [ebp - 0x5ec]
lea ecx, [ebp - 0x2cfc]
call fcn.004c3668
mov ecx, dword [ebp - 0x2d18]
mov eax, esi
push eax
push 0x64
pop edx
call fcn.004c15de
test eax, eax
jne 0x4c1d90
mov dword [ebp - 0x2d10], 1
push dword [ebp - 0x2d14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d10], ebx
jne 0x4c1db7
inc dword [ebp - 0x2d0c]
cmp dword [ebp - 0x2d0c], 0x10
jl 0x4c1ca7
mov eax, dword [ebp - 0x2d10]
pop edi
pop esi
jmp 0x4c1dc3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4c203c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x4f8], eax
cmp eax, ebx
je 0x4c21e4
push 0x64
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x4e0]
push eax
push 8
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c21c2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ebp - 0x4e4], ebx
push ebx
jmp 0x4c219b
lea eax, [ebp - 0x4ec]
push eax
push 1
push ebx
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c217d
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4f0]
push eax
push ebx
push 0x66712c
push dword [ebp - 0x4ec]
mov dword [ebp - 0x4f0], 1
mov dword [ebp - 0x4f4], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c2171
push 0x64
lea eax, [ebp - 0xcc]
push ebx
push eax
call fcn.00402394
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0xcc]
call fcn.004c1f3a
add esp, 0x10
test eax, eax
je 0x4c2171
cmp byte [ebp - 0x68], bl
je 0x4c215f
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4c2171
lea eax, [ebp - 0xcc]
push eax
push 0x64
pop edx
lea ecx, [ebp - 0x68]
call fcn.004c15de
push dword [ebp - 0x4ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x4e4]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x4e4]
push dword [ebp - 0x4e0]
mov dword [ebp - 0x4e8], 0x104
call esi
test eax, eax
je 0x4c20b9
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
cmp byte [ebp - 0x68], bl
je 0x4c21e4
mov ecx, dword [ebp - 0x4f8]
lea eax, [ebp - 0x68]
push eax
push 0x64
pop edx
call fcn.004c15de
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
jmp 0x4c21e6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4c23c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x4c24e4
mov esi, 0x400
push esi
lea eax, [ebp - 0x50c]
push 0
push eax
mov dword [ebp - 0x514], 1
mov dword [ebp - 0x510], esi
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x514]
push eax
push 0x667160
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4c24e4
lea eax, [ebp - 0x50c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c2448
sub eax, edx
cmp eax, 0x40
jne 0x4c24e4
lea eax, [ebp - 0x50c]
push eax
push 0x80
push 0x20
pop edx
lea ecx, [ebp - 0x8c]
call fcn.004c170d
lea eax, [ebp - 0x4ec]
push eax
mov edx, 0x80
lea ecx, [ebp - 0x10c]
call fcn.004c15de
push esi
lea eax, [ebp - 0x50c]
push 0
push eax
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x50c]
push esi
push eax
lea ecx, [ebp - 0x8c]
call fcn.004c1749
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4c24e4
lea eax, [ebp - 0x8c]
push eax
mov edx, 0x104
mov ecx, ebx
call fcn.004c15de
neg eax
sbb eax, eax
inc eax
jmp 0x4c24e6
xor eax, eax
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret

Function at 0x4c2618
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x4c2649
cmp byte [ebp + 0xc], 0
je 0x4c2649
push 0xea60
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
pop ebx
leave
ret

Function at 0x4c3034
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 8]
or dword [ebp + 8], 0xffffffff
push esi
push edi
mov dword [ebp - 8], 8
cmp dword [ebp - 8], 0xffffffff
lea eax, [ebp + 8]
ja 0x4c305e
lea eax, [ebp - 8]
mov edi, dword [eax]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x4c3091
test byte [ebp - 0xc], 1
je 0x4c3081
and dword [ebp - 0xc], 0xfffffffe
lea esi, [ebp - 0xbc]
call fcn.004b94fd
sub dword [ebp - 8], edi
add ebx, edi
cmp dword [ebp - 8], 0
ja 0x4c3052
pop edi
pop esi
pop ebx
leave
ret
call fcn.004bc45d
int3

Function at 0x4c3eb8
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x4c63b9
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and dword [ebp - 4], 0
cmp dword [0x6c6288], 0xffffffff
push ebx
push esi
push edi
jne 0x4c63f4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0xffffffffffffffff
mov esi, eax
push esi
push 0x6c6288
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 0xffffffff
je 0x4c63f4
push esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, 0x100
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00402394
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push dword [0x6c6288]
call ebx
push esi
call fcn.004013b3
pop ecx
push 0x40
pop ecx
mov edi, eax
lea esi, [ebp - 0x108]
push eax
rep movsd dword es:[edi], dword [esi]
push dword [0x6c6288]
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ca351
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push ebx
push dword [ebp + 0x18]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4ca3d8
mov eax, 0x101c01
mov dword [ebp - 4], 0x100c43
cmp dword [ebp + 0xc], esi
je 0x4ca38f
mov eax, 0x1fffff
mov dword [ebp - 4], eax
push edi
push 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push ebx
push dword [ebp + 8]
push dword [ebx]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x4ca3bc
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4ca3d7
push 1
push 0
push dword [ebp - 4]
lea eax, [ebx + 4]
push eax
push dword [ebp + 8]
push dword [eax]
call esi
push eax
call edi
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4cefdb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [ebp - 0x10], edi
call fcn.00411377
cmp dword [eax + 0x24], 1
je 0x4ceffd
mov al, 1
jmp 0x4cf0e2
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov eax, dword [eax]
push 0x100002
lea ecx, [ebp - 8]
push ecx
push eax
push dword [esi + 8]
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x4cf049
xor al, al
jmp 0x4cf0e2
mov eax, dword [esi]
mov eax, dword [eax]
push edi
push edi
push 0x100002
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [esi + 0xc]
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4cf042
mov eax, dword [esi]
mov ecx, dword [eax]
push 0x40
mov eax, 0x1000
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
cmp ebx, edi
je 0x4cf042
push 0x2c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.00402394
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4cf042
cmp dword [ebp - 0x10], 0x10
jne 0x4cf042
push ebx
push esi
call fcn.004cf0e7
test al, al
je 0x4cf042
call fcn.004cf433
test al, al
je 0x4cf042
mov eax, dword [esi]
mov edi, dword [eax]
push ebx
call fcn.004cef53
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cf433
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
mov eax, dword [esi]
push ebx
push edi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
jne 0x4cf507
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi + 8]
call edi
mov ebx, 0x102
jmp 0x4cf4ff
cmp eax, 0x80
je 0x4cf507
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x4cf507
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [ebp - 0x210]
push ecx
push 0x200
lea ecx, [ebp - 0x208]
push ecx
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x4cf4c0
mov byte [ebp - 0x209], 0
jmp 0x4cf4e2
cmp dword [ebp - 0x210], 0x200
jne 0x4cf4b7
mov eax, dword [esi]
push dword [eax + 4]
mov byte [ebp - 0x209], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
jne 0x4cf507
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x4cf507
cmp byte [ebp - 0x209], 0
jne 0x4cf517
push 0xffffffffffffffff
push dword [esi + 8]
call edi
cmp eax, ebx
jne 0x4cf47a
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
mov al, 1
jmp 0x4cf509

Function at 0x4d2982
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push ebx
push edi
push 0xd
xor ebx, ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4d29e2
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d29e2
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, ebx
je 0x4d29dc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4d29dc
and dword [esi + 0x10], ebx
cmp dword [esi + 0x14], 8
jb 0x4d29c4
mov ecx, dword [esi]
jmp 0x4d29c6
mov ecx, esi
push eax
xor edx, edx
push esi
mov word [ecx], dx
call fcn.0040d6fd
xor ebx, ebx
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x4d6df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x208
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], ebx
push ebx
push eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call fcn.00402394
mov dword [ebp - 0x220], esi
add esp, 0xc
lea esi, [ebp - 0x21c]
mov dword [ebp - 0x214], 1
call fcn.004107f6
mov eax, esi
push eax
push 0x20019
push ebx
push str.Software360360se6Chrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d6ec2
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push str.old_version
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d6ec2
lea eax, [ebp - 0x210]
push str.6.0.0.0
push eax
call fcn.004d2b68
pop ecx
pop ecx
test eax, eax
js 0x4d6ec2
lea eax, [ebp - 0x210]
push str.7.0.0.0
push eax
call fcn.004d2b68
pop ecx
pop ecx
test eax, eax
jns 0x4d6ec2
mov bl, 1
lea esi, [ebp - 0x21c]
call fcn.004107f6
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret

Function at 0x4d6edd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x208
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], ebx
push ebx
push eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call fcn.00402394
mov dword [ebp - 0x220], esi
add esp, 0xc
lea esi, [ebp - 0x21c]
mov dword [ebp - 0x214], 1
call fcn.004107f6
mov eax, esi
push eax
push 0x20019
push ebx
push str.Software360360se6Chrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d6f98
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push str.old_version
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d6f98
lea eax, [ebp - 0x210]
push str.7.0.0.0
push eax
call fcn.004d2b68
pop ecx
pop ecx
test eax, eax
js 0x4d6f98
mov bl, 1
lea esi, [ebp - 0x21c]
call fcn.004107f6
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00403fc1
leave
ret
Function at 0x4d7307
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
mov esi, 0x31306573
mov ebx, 0x4d0
cmp dword [ebp + 0xc], eax
jle 0x4d7331
cmp dword [ebp + 0xc], ebx
jb 0x4d7331
cmp dword [edi], esi
jne 0x4d7331
cmp dword [edi + 4], ebx
jne 0x4d7331
inc eax
and dword [ebp - 4], 0
test eax, eax
jne 0x4d7370
push ebx
call fcn.004013b3
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
test edi, edi
je 0x4d73bd
push ebx
push 0
push edi
call fcn.00402394
mov dword [edi], esi
mov esi, dword [ebp + 8]
mov dword [edi + 4], ebx
add esi, 0x4c
add esp, 0xc
add edi, 8
mov ecx, 0x126
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], ebx
push dword [ebp + 0x10]
lea eax, [edi + 0x60]
push 0x64f918
push 0x104
push eax
call fcn.004692b5
add esp, 0x10
test edi, edi
je 0x4d73ae
cmp dword [ebp + 0xc], 0
jle 0x4d73ae
push dword [ebp + 0xc]
push edi
push 3
push str.UIPersistData
push str.Software360360se6default
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 4], 0
je 0x4d73bd
push dword [ebp - 4]
call fcn.00404e46
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4d8369
Capabilities:
Get graphical window text

Disassembly:
push ecx
xor eax, eax
push ebx
mov dword [ecx], eax
push edi
cmp dword [esi + 0x7c], eax
je 0x4d841f
cmp dword [esi + 0x8c], eax
jne 0x4d841f
lea edi, [esi + 0x90]
push edi
mov ecx, str.EDIT
call fcn.00441a22
test eax, eax
jne 0x4d83ca
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004013b3
mov edi, eax
pop ecx
test edi, edi
je 0x4d841f
push ebx
push edi
push dword [esi + 0x24]
jmp 0x4d8407
push edi
mov ecx, str.msctls_hotkey32
call fcn.00441a22
test eax, eax
jne 0x4d841f
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004013b3
mov edi, eax
pop ecx
test edi, edi
je 0x4d841f
push ebx
push edi
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
push edi
push dword [esi + 0x24]
call dword [eax]
push edi
call fcn.00404e46
pop ecx
cmp dword [esi + 0x88], 0
je 0x4d8431
push 0
mov eax, esi
call fcn.004d86d9
pop edi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4d867c
Capabilities:
Hide graphical window

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d86a5
cmp dword [esi + 0x7c], 0
je 0x4d869a
mov ecx, dword [esi + 0x7c]
push dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 8]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4e07af
Capabilities:
Delete file
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push 0x270
mov eax, 0x60671c
call fcn.005f766b
call fcn.004e0fd5
push eax
lea eax, [ebp - 0x27c]
call fcn.004243de
push 0x66d9c0
lea ecx, [ebp - 0x27c]
call fcn.0046a779
pop ecx
or dword [ebp - 0x274], 0xffffffff
mov ebx, dword [ebp - 0x27c]
lea eax, [ebx - 0x10]
call fcn.0040ae97
add eax, 0x10
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x278]
call fcn.00462e6b
mov ecx, eax
lea esi, [ebp - 0x270]
call fcn.00408141
mov eax, 0x66d9cc
test eax, 0xffff0000
jne 0x4e0830
movzx eax, ax
push eax
mov eax, esi
push eax
call fcn.004d2f7e
jmp 0x4e083d
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004e149e
mov esi, dword [ebp - 0x270]
push dword [esi - 0xc]
push esi
lea eax, [ebp - 0x278]
call fcn.00449618
lea eax, [esi - 0x10]
call fcn.0040ace0
and dword [ebp - 4], 0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x4e09c8
push 4
pop edi
mov ecx, 0x6654f0
lea eax, [ebp - 0x240]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4e08b2
test dx, dx
je 0x4e08ae
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4e08b2
add eax, edi
add ecx, edi
test dx, dx
jne 0x4e088e
xor eax, eax
jmp 0x4e08b7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4e09a1
mov ecx, 0x6654f4
lea eax, [ebp - 0x240]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4e08ee
test dx, dx
je 0x4e08ea
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4e08ee
add eax, edi
add ecx, edi
test dx, dx
jne 0x4e08ca
xor eax, eax
jmp 0x4e08f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4e09a1
test byte [ebp - 0x26c], 0x10
jne 0x4e09a1
lea eax, [ebp - 0x240]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e0911
sub eax, edx
sar eax, 1
cmp eax, 5
jl 0x4e09a1
push edi
push str..srx
lea eax, [ebp + eax*2 - 0x248]
push eax
call fcn.0043d3af
add esp, 0xc
test eax, eax
jne 0x4e09a1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x240]
call fcn.00441a22
test eax, eax
je 0x4e09a1
lea eax, [ebx - 0x10]
call fcn.0040ae97
add eax, 0x10
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004e1461
mov esi, dword [ebp - 0x270]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x4e0992
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
call fcn.0040ace0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e0883
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x274], 0xffffffff
or dword [ebp - 4], 0xffffffff
jmp 0x4e09fa
mov eax, dword [ebp - 0x278]
add eax, 0xfffffff0
call fcn.0040ace0
lea eax, [ebx - 0x10]
call fcn.0040ace0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040ace0
call fcn.005f76a4
ret 4