joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aaff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.0044ea20
push eax
call fcn.00451ea0
add esp, 8
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00439180
mov ecx, eax
call fcn.0045fb70
lea ecx, [ebp - 8]
call fcn.00426390
movzx ecx, al
test ecx, ecx
je 0x4ab04f
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.0044ea20
push eax
lea ecx, [ebp - 8]
call fcn.00439180
mov ecx, eax
call fcn.004ab2a0
mov dword [ebp - 0xc], 0
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push str.360Preview
push str.Software360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
call fcn.004a01e0
mov ecx, eax
call fcn.004a1140
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ab0a1
push 0
push 0
push 0x518cd8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 0x40]
call eax
lea ecx, [ebp - 8]
call fcn.0049a2d0
mov esp, ebp
pop ebp
ret

Function at 0x4ab900
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ab925
mov eax, 1
jmp 0x4ab9fc
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4ab968
mov edx, dword [ebp - 0xc]
and edx, 0x10
je 0x4ab968
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4ab966
mov eax, 1
jmp 0x4ab9fc
jmp 0x4ab97d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ab97d
mov eax, 1
jmp 0x4ab9fc
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ab9c6
cmp dword [ebp - 4], 0
jne 0x4ab9ab
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ab9ab
mov eax, 1
jmp 0x4ab9fc
cmp dword [ebp - 4], 0
je 0x4ab9c6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4ab9c6
mov eax, 1
jmp 0x4ab9fc
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x4ab9fa
movzx eax, byte [ebp + 0x10]
cmp eax, 1
jne 0x4ab9ec
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ab9ec
mov eax, 1
jmp 0x4ab9fc
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4aba00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x4aba20
xor eax, eax
jmp 0x4abb45
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4aba31
xor eax, eax
jmp 0x4abb45
mov edx, dword [ebp + 8]
push edx
call fcn.004ebfed
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x104
jl 0x4aba50
xor eax, eax
jmp 0x4abb45
push str..
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040f510
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004185a0
add esp, 0xc
lea ecx, [ebp - 0x264]
call fcn.004335b0
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4abab8
mov dword [ebp - 0x268], 0
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp - 0x268]
jmp 0x4abb45
movzx eax, word [ebp - 0x234]
cmp eax, 0x2e
je 0x4abafb
mov ecx, dword [ebp - 0x260]
and ecx, 0x10
je 0x4abae5
movzx edx, byte [ebp + 0xc]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.004aba00
add esp, 8
jmp 0x4abafb
push 1
movzx ecx, byte [ebp + 0xc]
push ecx
lea edx, [ebp - 0x234]
push edx
call fcn.004ab900
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4abab8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
movzx eax, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ab900
add esp, 0xc
mov dword [ebp - 0x26c], 1
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4abb60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.004ec880
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x4abb84
xor al, al
jmp 0x4abc43
mov byte [ebp - 0x2010], 0
push 0x1fff
push 0
lea eax, [ebp - 0x200f]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4abbc7
cmp dword [ebp - 0xc], 0x1fff
jbe 0x4abbcb
xor al, al
jmp 0x4abc43
mov byte [ebp - 1], 0
lea eax, [ebp - 0x2010]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4abc40
mov dword [ebp - 0x2014], 0
mov dword [ebp - 0x2018], 0
lea eax, [ebp - 0x2018]
push eax
lea ecx, [ebp - 0x2014]
push ecx
push 0x50d6f8
lea edx, [ebp - 0x2010]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4abc40
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2014]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2014]
mov edx, dword [ecx + 0xc]
mov dword [eax], edx
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4abc60
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 1
mov ax, word [ebp + 8]
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
and ecx, 0xffffffdf
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
cmp edx, 0x41
jl 0x4abc9c
movzx eax, word [ebp - 4]
cmp eax, 0x5a
jle 0x4abca3
xor eax, eax
jmp 0x4abe2a
mov ecx, dword [0x518ebc]
mov dword [ebp - 0x34], ecx
mov edx, dword [0x518ec0]
mov dword [ebp - 0x30], edx
mov ax, word [ebp - 4]
mov word [ebp - 0x34], ax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
sub eax, 2
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
ja case.default.0x4abce2
mov ecx, dword [ebp - 0x60]
jmp dword [ecx*4 + 0x4abe38]
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
jmp 0x4abe2a
jmp 0x4abd04
mov eax, dword [ebp - 0x40]
jmp 0x4abe2a
mov edx, dword [0x518eb4]
mov dword [ebp - 0x2c], edx
mov ax, word [0x518eb8]
mov word [ebp - 0x28], ax
mov cx, word [ebp - 4]
mov word [ebp - 0x2c], cx
mov edx, dword [str..X:]
mov dword [ebp - 0x54], edx
mov eax, dword [0x518ea8]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x518eac]
mov dword [ebp - 0x4c], ecx
mov dx, word [0x518eb0]
mov word [ebp - 0x48], dx
mov ax, word [ebp - 4]
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x10], 0
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4abd7d
mov eax, dword [ebp - 0x40]
jmp 0x4abe2a
mov dword [ebp - 0xc], 0x227
push 0x538e3c
mov edx, dword [ebp - 0xc]
push edx
call fcn.004ef666
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x44]
push eax
push 0xc
lea ecx, [ebp - 0x24]
push ecx
push 0x2d1400
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4abe0b
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x1c], 7
je 0x4abe04
mov ecx, dword [ebp - 0x44]
cmp dword [ecx + 0x1c], 4
jne 0x4abe0b
mov dword [ebp - 0x40], 0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.004ec873
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4abcfa
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 1
mov ax, word [ebp + 8]
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
and ecx, 0xffffffdf
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
cmp edx, 0x41
jl 0x4abc9c
movzx eax, word [ebp - 4]
cmp eax, 0x5a
jle 0x4abca3
xor eax, eax
jmp 0x4abe2a
mov ecx, dword [0x518ebc]
mov dword [ebp - 0x34], ecx
mov edx, dword [0x518ec0]
mov dword [ebp - 0x30], edx
mov ax, word [ebp - 4]
mov word [ebp - 0x34], ax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
sub eax, 2
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
ja case.default.0x4abce2
mov ecx, dword [ebp - 0x60]
jmp dword [ecx*4 + 0x4abe38]
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
jmp 0x4abe2a
jmp 0x4abd04
mov eax, dword [ebp - 0x40]
jmp 0x4abe2a
mov edx, dword [0x518eb4]
mov dword [ebp - 0x2c], edx
mov ax, word [0x518eb8]
mov word [ebp - 0x28], ax
mov cx, word [ebp - 4]
mov word [ebp - 0x2c], cx
mov edx, dword [str..X:]
mov dword [ebp - 0x54], edx
mov eax, dword [0x518ea8]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x518eac]
mov dword [ebp - 0x4c], ecx
mov dx, word [0x518eb0]
mov word [ebp - 0x48], dx
mov ax, word [ebp - 4]
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x10], 0
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4abd7d
mov eax, dword [ebp - 0x40]
jmp 0x4abe2a
mov dword [ebp - 0xc], 0x227
push 0x538e3c
mov edx, dword [ebp - 0xc]
push edx
call fcn.004ef666
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x44]
push eax
push 0xc
lea ecx, [ebp - 0x24]
push ecx
push 0x2d1400
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4abe0b
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x1c], 7
je 0x4abe04
mov ecx, dword [ebp - 0x44]
cmp dword [ecx + 0x1c], 4
jne 0x4abe0b
mov dword [ebp - 0x40], 0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
push eax
call fcn.004ec873
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4ad700
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xbc
call fcn.004106e0
mov eax, dword [ebp - 0x30]
cmp dword [eax], 2
je 0x4ad81f
mov ecx, dword [ebp - 0x30]
cmp dword [ecx], 1
jne 0x4ad81f
lea ecx, [ebp - 0x24]
call fcn.0044c430
push 0
push 0
push 0x80
push 3
push 7
push SysReAllocString
mov ecx, dword [ebp - 0x30]
add ecx, 4
call fcn.0044ea20
push eax
lea ecx, [ebp - 0x24]
call fcn.004ad8f0
test eax, eax
je 0x4ad786
mov ecx, dword [ebp - 0x30]
add ecx, 0xbc
call fcn.00410730
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x24]
call fcn.004ad9b0
mov eax, dword [ebp - 0x2c]
jmp 0x4ad83f
lea ecx, [ebp - 0x20]
call fcn.004adb50
push 4
push 2
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.0044ea20
push eax
lea ecx, [ebp - 0x20]
call fcn.004ad9d0
test eax, eax
jne 0x4ad80f
lea ecx, [ebp - 0x20]
call fcn.004534d0
cmp eax, 0x64
jbe 0x4ad80f
lea ecx, [ebp - 0x20]
call fcn.0044ea20
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4ad80f
lea ecx, [ebp - 0x20]
call fcn.004534d0
sub eax, 0x64
push eax
mov edx, dword [ebp - 0x28]
add edx, 0x64
push edx
mov ecx, dword [ebp - 0x30]
call fcn.004ad390
test eax, eax
je 0x4ad7f5
mov eax, dword [ebp - 0x30]
mov dword [eax], 2
jmp 0x4ad80f
lea ecx, [ebp - 0x20]
call fcn.004adbe0
mov ecx, dword [ebp - 0x30]
add ecx, 4
call fcn.0044ea20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x20]
call fcn.004adba0
lea ecx, [ebp - 0x24]
call fcn.004ad9b0
mov ecx, dword [ebp - 0x30]
cmp dword [ecx], 2
je 0x4ad839
mov ecx, dword [ebp - 0x30]
add ecx, 0xbc
call fcn.00410730
xor eax, eax
jmp 0x4ad83f
mov eax, dword [ebp - 0x30]
add eax, 0x6c
mov esp, ebp
pop ebp
ret

Function at 0x4ad950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x4ad959
xor ecx, ecx
jne 0x4ad959
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ad992
call fcn.00410f30
jmp 0x4ad9a8
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x4ad9a6
push 0x26
call fcn.00410e80
add esp, 4
jmp 0x4ad9a8
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4ad9d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x4ad9d9
xor ecx, ecx
jne 0x4ad9d9
xor edx, edx
jne 0x4ad9e1
xor eax, eax
jne 0x4ad9e1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
ja 0x4ada22
jb 0x4ada17
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jae 0x4ada22
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
jne 0x4ada55
call fcn.00410f30
jmp 0x4adaee
cmp dword [ebp + 0xc], 0
jne 0x4ada6f
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
sbb ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x4ada78
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x14], eax
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x4adaec
call fcn.00410f30
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
jmp 0x4adaee
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4af360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
je 0x4af386
cmp dword [ebp + 8], 0
je 0x4af386
cmp dword [ebp + 0xc], 0
je 0x4af386
cmp dword [ebp + 0x10], 0
je 0x4af386
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x4af38a
xor al, al
jmp 0x4af3f8
lea ecx, [ebp - 0xc]
call fcn.00418350
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push str._s_s
lea eax, [ebp - 0xc]
push eax
call fcn.004953a0
add esp, 0x10
mov byte [ebp - 1], 1
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xc]
call fcn.0044ea20
push eax
mov edx, dword [ebp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4af3e3
cmp dword [ebp - 8], 3
je 0x4af3e7
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0xc]
call fcn.004335b0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x4af4b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x4af4c8
cmp dword [ebp + 8], 0
je 0x4af4c8
cmp dword [ebp + 0xc], 0
jne 0x4af4cf
xor al, al
jmp 0x4af554
lea ecx, [ebp - 8]
call fcn.00418350
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push str._s_s
lea edx, [ebp - 8]
push edx
call fcn.004953a0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4af51e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 3
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 9], al
lea ecx, [ebp - 8]
call fcn.004335b0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4af5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x4af5ce
cmp dword [ebp + 8], 0
je 0x4af5ce
cmp dword [ebp + 0xc], 0
je 0x4af5ce
cmp dword [ebp + 0x18], 0
jne 0x4af5d5
xor al, al
jmp 0x4af658
lea ecx, [ebp - 8]
call fcn.00418350
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push str._s_s
lea edx, [ebp - 8]
push edx
call fcn.004953a0
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4af624
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 9], al
lea ecx, [ebp - 8]
call fcn.004335b0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4af660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x14], 0
je 0x4af67e
cmp dword [ebp + 8], 0
je 0x4af67e
cmp dword [ebp + 0xc], 0
je 0x4af67e
cmp dword [ebp + 0x18], 0
jne 0x4af682
xor al, al
jmp 0x4af6f7
lea ecx, [ebp - 0x10]
call fcn.00418350
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push str._s_s
lea edx, [ebp - 0x10]
push edx
call fcn.004953a0
add esp, 0x10
mov byte [ebp - 1], 1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.0044ea20
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4af6e2
cmp dword [ebp - 8], 4
je 0x4af6e6
mov byte [ebp - 1], 0
mov dl, byte [ebp - 1]
mov byte [ebp - 0x11], dl
lea ecx, [ebp - 0x10]
call fcn.004335b0
mov al, byte [ebp - 0x11]
mov esp, ebp
pop ebp
ret
Function at 0x4b0420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x538964]
and eax, 1
jne 0x4b0463
mov ecx, dword [0x538964]
or ecx, 1
mov dword [0x538964], ecx
mov ecx, 0x538960
call fcn.00418350
push 0x50b570
call fcn.004ec85c
add esp, 4
mov ecx, 0x538960
call fcn.00418600
movzx edx, al
test edx, edx
je 0x4b052f
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x214]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4b052f
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
push str.Path
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
push edx
mov ecx, 0x538960
call fcn.0040f550
push 0x538960
mov ecx, dword [ebp + 8]
call fcn.00418370
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x4b0810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x14]
push eax
push 0x4b07d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b0868
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret