joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f7a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4c2388
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push edi
mov ecx, str.IEXPLORE.EXE
call fcn.0040e590
add esp, 4
test al, al
jne 0x40f7e9
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x40f7f6
mov eax, dword [esi]
jmp 0x40f7f8
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f7d6
cmp dword [edi + 0x18], 8
jb 0x40f80d
mov ecx, dword [esi]
jmp 0x40f80f
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.0040d900
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.00405ad0
cmp dword [esp + 0x20], 8
jb 0x40f844
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00493cb0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret
Function at 0x414aa0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c1ad6
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x2e4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2f4]
push 0x24c
lea eax, [esp + 0x94]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x98], 0
call fcn.00497680
mov ebx, 0x4d689c
mov ecx, ebp
lea esi, [esp + 0x28]
call fcn.00408070
push edi
mov ecx, eax
lea esi, [esp + 0x64]
mov dword [esp + 0x2fc], 0
call fcn.00408120
mov edi, 8
add esp, 0x10
cmp dword [eax + 0x18], edi
jb 0x414b3c
mov eax, dword [eax + 4]
jmp 0x414b3f
add eax, 4
lea ecx, [esp + 0x8c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x18], esi
cmp dword [esp + 0x6c], edi
jb 0x414b67
mov edx, dword [esp + 0x58]
push edx
call fcn.00493cb0
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [esp + 0x2ec], 0xffffffff
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], 0
mov word [esp + 0x58], ax
cmp dword [esp + 0x34], edi
jb 0x414b9d
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00493cb0
add esp, 4
xor edx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, 0xffffffff
jne 0x414bc0
xor al, al
jmp 0x414c74
mov ebx, 0x4d689c
mov ecx, ebp
lea esi, [esp + 0x70]
call fcn.00408070
lea ebx, [esp + 0xb8]
mov ecx, eax
lea esi, [esp + 0x38]
mov dword [esp + 0x2ec], 1
call fcn.00408070
cmp dword [eax + 0x18], edi
jb 0x414bf7
mov eax, dword [eax + 4]
jmp 0x414bfa
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x50], edi
jb 0x414c14
mov eax, dword [esp + 0x3c]
push eax
call fcn.00493cb0
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2ec], 0xffffffff
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], cx
cmp dword [esp + 0x88], edi
jb 0x414c4c
mov edx, dword [esp + 0x74]
push edx
call fcn.00493cb0
add esp, 4
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x8c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414bc0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x2e4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c8]
xor ecx, esp
call fcn.00497941
add esp, 0x2dc
ret
Function at 0x414ca0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x4c4696
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x2a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x2c0]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2d0]
cmp dword [edi + 0x14], 0
mov ebp, dword [esp + 0x2d4]
jne 0x414cf6
xor al, al
jmp 0x414e37
push edi
mov ecx, ebp
call fcn.00414aa0
add esp, 4
mov ebx, 0x4d795c
mov ecx, edi
lea esi, [esp + 0x34]
call fcn.00408070
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x414d20
mov eax, dword [eax + 4]
jmp 0x414d23
add eax, 4
lea ecx, [esp + 0x6c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x4c], esi
jb 0x414d48
mov edx, dword [esp + 0x38]
push edx
call fcn.00493cb0
add esp, 4
xor eax, eax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], 0
mov word [esp + 0x38], ax
cmp ebx, 0xffffffff
je 0x414cef
jmp 0x414d70
cmp word [esp + 0x98], 0x2e
je 0x414e16
test byte [esp + 0x6c], 0x10
je 0x414e16
mov ebx, 0x4d689c
mov ecx, edi
lea esi, [esp + 0x50]
call fcn.00408070
lea ebx, [esp + 0x98]
mov ecx, eax
lea esi, [esp + 0x18]
mov dword [esp + 0x2c8], 0
call fcn.00408070
push ebp
push eax
mov byte [esp + 0x2d0], 1
call fcn.00414ca0
mov esi, 8
add esp, 8
cmp dword [esp + 0x30], esi
jb 0x414de1
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00493cb0
add esp, 4
xor edx, edx
mov dword [esp + 0x2c8], 0xffffffff
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], dx
cmp dword [esp + 0x68], esi
jb 0x414e16
mov eax, dword [esp + 0x54]
push eax
call fcn.00493cb0
add esp, 4
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x6c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414d70
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x2c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a8]
xor ecx, esp
call fcn.00497941
add esp, 0x2b8
ret
Function at 0x414e60
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, dword [esp + 0xc]
push esi
call ebp
test eax, eax
je 0x414e7b
pop esi
mov eax, 1
pop ebp
ret
push ebx
push edi
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 0xffffffff
je 0x414ea8
test al, 0x10
je 0x414ea8
push esi
mov edi, 1
call ebx
test eax, eax
je 0x414eaf
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
push esi
call ebp
test eax, eax
jne 0x414eca
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x414eda
push esi
test edi, edi
jne 0x414ed4
call ebp
test eax, eax
je 0x414eda
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
ret
call ebx
test eax, eax
jne 0x414eca
cmp byte [esp + 0x18], 0
je 0x414efe
cmp byte [esp + 0x1c], 1
jne 0x414ef3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414eca
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret

Function at 0x414f10
Capabilities:
Get file version info

Disassembly:
mov eax, 0x2010
call fcn.004985e0
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x201c]
cmp esi, ebx
je 0x414fcc
push 0x1fff
lea eax, [esp + 0x19]
push ebx
push eax
mov byte [esp + 0x20], bl
call fcn.00497680
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
je 0x414fcc
cmp eax, 0x1fff
ja 0x414fcc
lea edx, [esp + 0x14]
push edx
push eax
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x414fb3
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x4d689c
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x414fb3
mov eax, dword [esp + 8]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp], edx
mov bl, 1
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.00497941
add esp, 0x2010
ret
mov ecx, dword [esp + 0x2014]
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.00497941
add esp, 0x2010
ret
Function at 0x415c00
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push ebx
mov edi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x415cae
mov eax, dword [edi + 0x20c]
test eax, eax
je 0x415c34
push eax
call fcn.00497867
add esp, 4
push esi
call fcn.00498320
add esp, 4
mov dword [edi + 0x20c], eax
test eax, eax
je 0x415cae
push eax
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x415cae
mov eax, dword [edi + 0x20c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push str.VarFileInfoTranslation
push eax
mov dword [esp + 0x28], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x415cae
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04x
push 0x208
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x418b50
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SOFTWARE360TotalSecurityDeepScan
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [esp + 4]
je 0x418b82
cmp eax, esi
je 0x418bb7
push 4
xor ecx, ecx
cmp dword [esp + 0x14], esi
lea edx, [esp + 0xc]
push edx
push 4
setne cl
push esi
push str.DisableHRM
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x418bac
lea esi, [eax + 1]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x418ce0
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [0x4f7194]
test eax, eax
jl 0x418d1b
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00497941
add esp, 0x144
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [esp + 0x30]
push edx
mov dword [0x4f7194], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.00497680
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x418d8b
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x114
call esi
test eax, eax
je 0x418ddd
push str.GetNativeSystemInfo
push 0x4d6874
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418ddd
lea edx, [esp + 4]
push edx
call eax
mov eax, dword [esp + 4]
cmp ax, 9
je 0x418dbd
cmp ax, 6
jne 0x418ddd
mov eax, 1
mov dword [0x4f7194], eax
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00497941
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
xor al, al
call fcn.00497941
add esp, 0x144
ret

Function at 0x419890
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
lea eax, [esp + 0x10]
push eax
push ebp
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x4198b4
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push esi
call fcn.00498320
mov edi, eax
add esp, 4
test edi, edi
jne 0x4198cc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x419907
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4d689c
push edi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
push edi
call fcn.00497867
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret

Function at 0x419920
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x41996e
cmp dword [esp + 8], 0
jne 0x41996e
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00497941
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.00497941
add esp, 0x118
ret
Function at 0x419990
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x224
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x220], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x419a5a
cmp dword [esp + 0x10], 1
jb 0x419a5a
push 0x103
lea ecx, [esp + 0x121]
push 0
push ecx
mov byte [esp + 0x128], 0
call fcn.00497680
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 8]
push ecx
push str.CSDVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x419a5a
lea edx, [esp + 0x11c]
push str.Service_Pack_2
push edx
call fcn.0049d9a9
add esp, 8
test eax, eax
jl 0x419a5a
mov eax, 1
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00497941
add esp, 0x224
ret
mov ecx, dword [esp + 0x220]
xor ecx, esp
xor eax, eax
call fcn.00497941
add esp, 0x224
ret

Function at 0x419a80
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jne 0x419ace
cmp dword [esp + 8], 2
jne 0x419ace
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00497941
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.00497941
add esp, 0x118
ret

Function at 0x419af0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push 0x4d8600
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419b3c
lea ecx, [esp]
push ecx
call eax
jmp 0x419b46
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
je 0x419b5b
cmp ax, 6
je 0x419b5b
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x419b70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [0x4fdbbc]
test eax, eax
jne 0x419bf5
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x104
lea eax, [esp]
cmp word [eax], 0
je 0x419bb5
add eax, 2
sub ecx, 1
jne 0x419ba5
jmp 0x419bd9
test ecx, ecx
je 0x419bd9
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2]
push str._ntdll.dll
mov eax, SysReAllocString
call fcn.00407440
push str.RtlGetVersion
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4fdbbc], eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00497941
add esp, 0x20c
ret

Function at 0x419ca0
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c16eb
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
mov eax, dword [0x4f4de0]
xor eax, esp
push eax
lea eax, [esp + 0x338]
mov dword fs:[0], eax
push 0x11c
xor esi, esi
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00497680
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x419d16
cmp dword [esp + 0x14], 6
jne 0x419d16
cmp dword [esp + 0x18], 1
jae 0x419dc9
push esi
push 0x25
lea edx, [esp + 0x134]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [0x4fc0d8]
mov edx, dword [eax + 0xc]
mov ecx, 0x4fc0d8
call edx
add eax, 0x10
mov dword [esp + 8], eax
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0xc]
push 0x4d7498
push ecx
mov dword [esp + 0x34c], esi
call fcn.004048a0
add esp, 0xc
push 0xd
push str.kernel32.dll
lea ecx, [esp + 0x10]
call fcn.004062f0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0xc]
push eax
push esi
call fcn.00419890
add esp, 0xc
test eax, eax
je 0x419dd0
mov eax, dword [esp + 0xc]
mov ecx, eax
shr ecx, 0x10
cmp ecx, 6
jne 0x419dd0
cmp ax, 1
jb 0x419dd0
lea eax, [esi - 0x10]
mov dword [esp + 0x340], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419dc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x419df9
lea eax, [esi - 0x10]
mov dword [esp + 0x340], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419df7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x338]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.00497941
add esp, 0x33c
ret
Function at 0x419e20
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x419e72
cmp dword [esp + 4], 6
jne 0x419e72
cmp dword [esp + 8], 1
jne 0x419e72
call fcn.00419af0
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00497941
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.00497941
add esp, 0x118
ret

Function at 0x419f90
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x14c
mov eax, dword [0x4f4de0]
xor eax, esp
mov dword [esp + 0x148], eax
xor eax, eax
push str.GetNativeSystemInfo
push 0x4d8600
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419fee
lea ecx, [esp + 4]
push ecx
call eax
jmp 0x419ff9
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push esi
push 0x11c
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00497680
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x11c
call esi
test eax, eax
jne 0x41a036
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], 0x114
call esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 8]
push ecx
push 0x4d6874
mov dword [esp + 0x10], 0
call fcn.00419890
add esp, 0xc
pop esi
test eax, eax
je 0x41a07f
mov ecx, dword [esp]
mov eax, ecx
movzx edx, cx
mov ecx, dword [esp + 4]
shr eax, 0x10
cmp cx, 9
je 0x41a096
cmp cx, 6
je 0x41a096
cmp eax, 5
jne 0x41a0a1
cmp edx, 2
jne 0x41a0a1
xor al, al
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.00497941
add esp, 0x14c
ret
cmp eax, 6
jb 0x41a07f
jne 0x41a0a1
test edx, edx
je 0x41a07f
mov ecx, dword [esp + 0x148]
xor ecx, esp
mov al, 1
call fcn.00497941
add esp, 0x14c
ret
Function at 0x41a0c0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x4e7d18
push 0x498450
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4f4de0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x41a1fa
cmp word [esi], 0
je 0x41a1fa
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a126
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x41a1fa
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a1fa
xor eax, eax
mov word [ebp], ax
push 0x7fe
push eax
lea ecx, [ebp + 2]
push ecx
call fcn.00497680
push esi
push str.__s_
push 0x3ff
lea edx, [ebp]
push edx
call fcn.00408640
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00497680
add esp, 0x28
mov dword [ebp - 0x54], 0x3c
lea ecx, [ebp]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x40], str._disablesp_3
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x50], 0x440
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x41a1d8
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x41a1e6
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41a203
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00497941
add ebp, 0x804
mov esp, ebp
pop ebp
ret
Function at 0x41a3c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push str.SB_State
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 4
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x41a42f
push 4
lea eax, [esp + 0xc]
push eax
push 4
push str.SB_State
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
call esi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push str.SB_Entry_Known
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x41a475
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push str.SB_Entry_Known
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.SB_RightMenu
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x41a4bb
push 4
lea edx, [esp + 0xc]
push edx
push 4
push str.SB_RightMenu
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
call esi
pop edi
pop esi
add esp, 0xc
ret