joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f130
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb071
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, edx
xor edi, edi
lea eax, [ebp - 0x18]
push eax
push edi
push 1
mov dword [ebp - 4], edi
push esi
mov dword [ebp - 0x1c], edi
push ebx
mov dword [ebp - 0x18], edi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edx, dword [0x54d210]
mov eax, dword [edx + 0xc]
mov ecx, 0x54d210
call eax
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x18]
mov ecx, 1
mov dword [ebp - 0x1c], ecx
cmp eax, edi
je 0x40f23c
lea edx, [ebp - 0x34]
push edx
mov edi, eax
mov dword [ebp - 4], ecx
call fcn.00417bd0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
jne 0x40f1c6
call fcn.004cb4f7
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
push ecx
push edx
push 1
push esi
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub eax, edx
jne 0x40f1ea
call fcn.004cb4f7
mov edx, dword [ebp - 0x28]
xor ebx, ebx
cmp edx, ebx
jne 0x40f1f4
xor eax, eax
jmp 0x40f209
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f200
sub eax, esi
mov edi, eax
mov eax, dword [ebp + 8]
push edx
call fcn.004185d0
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x40f224
push eax
call fcn.004cb380
add esp, 4
mov ecx, dword [ebp - 0x34]
push ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.004cb380
add esp, 4
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 8]
push 0x514d70
push 0x5157b0
push edx
call fcn.00417250
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
xor ebp, ebp
xor ebx, ebx
cmp dword [esp + 0x14], ebp
mov dword [esp + 8], ebp
jle 0x40f9e0
push edi
inc ebx
and ebx, 0x800000ff
jns 0x40f917
dec ebx
or ebx, 0xffffff00
inc ebx
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
cmp ebx, eax
jb 0x40f926
call fcn.004cb4f7
mov eax, dword [esi + 0xc]
movzx ecx, byte [eax + ebx]
add ebp, ecx
and ebp, 0x800000ff
jns 0x40f93f
dec ebp
or ebp, 0xffffff00
inc ebp
mov edx, dword [esi + 0x10]
sub edx, eax
cmp ebp, edx
jb 0x40f94d
call fcn.004cb4f7
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
sub ecx, eax
lea edi, [eax + ebp]
cmp ebx, ecx
jb 0x40f961
call fcn.004cb4f7
mov eax, dword [esi + 0xc]
add eax, ebx
cmp eax, edi
je 0x40f972
mov dl, byte [edi]
mov cl, byte [eax]
mov byte [eax], dl
mov byte [edi], cl
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
cmp ebx, eax
jb 0x40f981
call fcn.004cb4f7
mov edi, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
sub ecx, edi
cmp ebp, ecx
jb 0x40f992
call fcn.004cb4f7
mov eax, dword [esi + 0xc]
movzx ecx, byte [edi + ebx]
movzx edx, byte [eax + ebp]
add edx, ecx
mov edi, edx
and edi, 0x800000ff
jns 0x40f9b1
dec edi
or edi, 0xffffff00
inc edi
mov edx, dword [esi + 0x10]
sub edx, eax
cmp edi, edx
jb 0x40f9bf
call fcn.004cb4f7
mov eax, dword [esi + 0xc]
mov cl, byte [edi + eax]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
xor byte [eax + edi], cl
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
jl 0x40f906
pop edi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x40fa20
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x14
push ebp
push edi
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
mov dword [ebx], ebp
push eax
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40fa87
lea ecx, [esp + 0x10]
push ecx
push edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40fac5
mov eax, dword [esp + 0x10]
mov dword [esi], eax
add eax, 8
push 0x54cfe0
push eax
call fcn.004cc21d
add esp, 8
mov dword [ebx], eax
test eax, eax
jne 0x40fa8f
push edi
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop ebp
add esp, 0x14
ret
mov edx, dword [esi]
add edx, 8
push edx
push 0
push eax
call fcn.004d7710
mov ecx, dword [esi]
mov edx, dword [ebx]
add esp, 0xc
push 0
lea eax, [esp + 0x10]
push eax
push ecx
push edx
push edi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esi]
sete al
mov ebp, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop ebp
add esp, 0x14
ret
Function at 0x40fb50
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x428
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x424], eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
mov eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push str.smart_preheat
push str.Software360360se6Chrome
xor edi, edi
push SysReAllocString
mov dword [esp + 0x20], edi
call esi
test eax, eax
jne 0x40fc59
cmp dword [esp + 8], 1
jne 0x40fc59
push 0x410
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004d7710
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push SysReAllocString
mov dword [esp + 0x28], 0x410
mov dword [esp + 0x2c], 1
call esi
test eax, eax
jne 0x40fc59
push str.....Smartpreheat.dll
lea ecx, [esp + 0x20]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fc59
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x40fc59
push str.SmartPreheat
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40fc59
push esi
call eax
lea eax, [edi + 1]
pop edi
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.004cb38b
add esp, 0x428
ret
mov ecx, dword [esp + 0x42c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004cb38b
add esp, 0x428
ret
Function at 0x40fc80
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x428
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x424], eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
mov eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push str.smart_preheat
push str.Software360chromechrome
xor edi, edi
push SysReAllocString
mov dword [esp + 0x20], edi
call esi
test eax, eax
jne 0x40fd89
cmp dword [esp + 8], 1
jne 0x40fd89
push 0x410
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004d7710
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push str.UninstallString
push str.Software360chromeupdateclientstate27D39816_7A3D_406c_9ABC_97FB55674016
push SysReAllocString
mov dword [esp + 0x28], 0x410
mov dword [esp + 0x2c], 1
call esi
test eax, eax
jne 0x40fd89
push str....._smart_preheat.dll
lea ecx, [esp + 0x20]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fd89
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x40fd89
push str.SmartPreheat
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40fd89
push esi
call eax
lea eax, [edi + 1]
pop edi
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.004cb38b
add esp, 0x428
ret
mov ecx, dword [esp + 0x42c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004cb38b
add esp, 0x428
ret

Function at 0x40fdb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 4
push ebx
push 4
push ebp
mov edi, eax
push edi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 5
jne 0x40fec0
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40febe
xor eax, eax
push 0x54cfe0
mov dword [esp + 0x1c], eax
push 0x41d
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0x720
mov dword [esp + 0x20], 0x41d
call fcn.004cc21d
mov esi, eax
add esp, 8
test esi, esi
je 0x40feb3
push 0x104
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [esi + 4]
push eax
mov dword [esi], SysStringLen
call edi
push 0x104
push ebp
lea ecx, [esi + 0x20c]
push ecx
call edi
push 4
push ebx
lea edx, [esi + 0x418]
push 4
push edx
mov dword [esi + 0x414], 4
call fcn.004cb558
mov edx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push 0x7d0
push 2
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x4a
push edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov edi, dword [esp + 0xc]
push esi
call fcn.004cc1ec
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x411540
Capabilities:
Check if file exists
Create directory
Read .ini file

Disassembly:
sub esp, 0x29c
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x298], eax
mov eax, dword [esp + 0x2a0]
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
lea edi, [eax + 0x14c]
mov eax, dword [edi]
push eax
call esi
test eax, eax
je 0x4116c1
mov eax, dword [edi]
push eax
push 0x515bbc
call fcn.00401f50
mov edx, str.MultiTip
mov ecx, eax
call fcn.00401fd0
mov edx, dword [edi]
add esp, 8
push 3
lea ecx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call fcn.00418470
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
sete bl
cmp eax, ecx
je 0x4115ce
push eax
call fcn.004cc15e
add esp, 4
test bl, bl
je 0x4116c1
mov edx, dword [edi]
push edx
push 0x515bc8
call fcn.00401f50
mov edx, str.MultiTip
mov ecx, eax
call fcn.00401fd0
push 0x208
lea eax, [esp + 0xa4]
push 0
push eax
call fcn.004d7710
lea ecx, [esp + 0x24]
push str.DataUserSettings.ini
push ecx
call fcn.0045b533
mov edx, dword [eax]
add esp, 0x1c
push edx
push 0x104
lea eax, [esp + 0xa0]
push eax
push 0x514b40
push str.DownloadPath
push str.SoftDown
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41165a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x98]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411664
sub eax, edx
sar eax, 1
je 0x4116bd
movzx ecx, word [esp + 0x98]
push ecx
push str._c:360Downloadsmessage
call fcn.00404c10
mov edx, dword [edi]
add esp, 8
push edx
push 0x515c6c
call fcn.00401f50
mov edx, str.MultiTip
mov ecx, eax
call fcn.00401fd0
mov eax, dword [edi]
add esp, 8
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edi, dword [edi]
push edi
call esi
test eax, eax
jne 0x4116c1
xor eax, eax
jmp 0x4116c6
mov eax, 1
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cb38b
add esp, 0x29c
ret 4
Function at 0x412e50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
mov ebx, ecx
mov esi, edx
call fcn.004d7710
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x2f
push 0
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x412f1a
add eax, 2
push eax
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [esp + 8], 0
lea eax, [esp + 8]
je 0x412ed1
cmp word [eax], 0x3f
je 0x412ec9
add eax, 2
cmp word [eax], 0
jne 0x412eb8
jmp 0x412ed1
mov ecx, 0x23
mov word [eax], cx
test esi, esi
je 0x412f1a
lea edx, [esp + 8]
push edx
push esi
call fcn.00475f6f
add esp, 8
test eax, eax
je 0x412f1a
cmp dword [ebx + 0x1cc], 0
je 0x412efa
push ebx
lea ecx, [esp + 0xc]
call fcn.00415af0
lea esi, [esp + 8]
call fcn.004158b0
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004cb38b
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004cb38b
add esp, 0x214
ret
Function at 0x413c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
cmp dword [esi + 0x1b4], 0
push ebx
push ebp
push edi
jne 0x413d3b
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 4]
push eax
push esi
call fcn.00414580
test eax, eax
je 0x413c71
cmp dword [esi + 0x168], 0
je 0x413c68
push str.beforepopedtoday
push 0x51641c
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x10]
push 5
push eax
push ecx
mov ecx, esi
call fcn.00415960
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0x10]
call fcn.004141a0
test eax, eax
je 0x413caa
cmp dword [esi + 0x168], 0
je 0x413ca1
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
push 0x516424
push 0x516438
push 5
push edx
push eax
mov ecx, esi
call fcn.00415960
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0x10]
call fcn.00414390
test eax, eax
je 0x413ce3
cmp dword [esi + 0x168], 0
je 0x413cda
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
push 0x51643c
push 0x51645c
push 5
push ecx
push edx
mov ecx, esi
call fcn.00415960
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esi + 0x1bc], 0
jne 0x413d3b
lea eax, [esi + 0xc]
push eax
mov ecx, 0x516460
call fcn.004047b0
test eax, eax
je 0x413d3b
cmp dword [esi + 0x1ac], 0
je 0x413d3b
mov edi, dword [esi + 0x1b0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edi, edi, 0x3e8
mov dword [esp + 0x10], edi
call ebx
mov edx, dword [esi]
mov ecx, dword [esi + 8]
mov ebp, eax
mov eax, dword [esi + 0xc]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00414a70
mov dword [esp + 0xc], eax
test eax, eax
je 0x413d4b
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x10]
call ebx
sub eax, ebp
cmp eax, edi
ja 0x413dcd
call ebx
add edi, ebp
sub edi, eax
call ebx
sub eax, ebp
push eax
cmp edi, 0x927c0
jb 0x413d86
push 0x516484
call fcn.00401f50
mov edx, str.script_MessagePopup
mov ecx, eax
call fcn.00401fd0
add esp, 8
push 0x927c0
jmp 0x413da1
push edi
push 0x5164b8
call fcn.00401f50
mov edx, str.script_MessagePopup
mov ecx, eax
call fcn.00401fd0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00414a70
mov dword [esp + 0xc], eax
test eax, eax
je 0x413d47
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
cmp dword [esp + 0xc], 0
jne 0x413d3b
cmp dword [esi + 0x168], 0
je 0x413c68
push str.refuse_popupmgr
push 0x5157ac
jmp 0x413c57
Function at 0x414010
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f6ae0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x38]
push eax
push str.SOFTWARE360SoftMgrmessage
push 0x50f944
lea edi, [esp + 0x20]
call fcn.00404c10
push 0
call fcn.004cbb5a
mov esi, dword [esp + 0x24]
mov dword [esp + 0x28], eax
push ebp
lea ebx, [esp + 0x2c]
mov eax, esi
call fcn.0040fdb0
mov edx, dword [0x54d210]
mov eax, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov eax, dword [edx + 0xc]
add esp, 0x14
mov ecx, 0x54d210
mov dword [esp + 0x3c], 0
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
push ebp
mov ebx, 1
push str._s_tc
lea edi, [esp + 0x40]
mov byte [esp + 0x34], bl
call fcn.00404c10
mov edi, dword [esp + 0x40]
add esp, 8
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x414100
add dword [esp + 0x3c], ebx
jmp 0x414104
mov dword [esp + 0x3c], ebx
push edi
lea ebx, [esp + 0x40]
mov eax, esi
call fcn.0040fdb0
add esp, 4
cmp dword [esp + 0x40], 0
je 0x41413d
mov ecx, dword [esp + 0x34]
cmp dword [ecx + 0x1b4], 0
jne 0x41413d
push str.lstm
lea ebx, [esp + 0x1c]
mov eax, str.SOFTWARE360SoftMgrmessage
call fcn.0040fdb0
add esp, 4
lea eax, [edi - 0x10]
mov byte [esp + 0x2c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41415e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414182
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x4141a0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f6ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push str.SOFTWARE360SoftMgrmessage
xor ebx, ebx
push 0x50f944
lea edi, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.00404c10
mov edi, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
push str.nomorestip
push edi
mov ebp, 4
mov dword [esp + 0x2c], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push SysReAllocString
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
call ebx
test eax, eax
jne 0x41427b
cmp dword [esp + 0x18], 1
mov dword [esp + 0x38], 0xffffffff
sete al
or edx, 0xffffffff
mov esi, eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414265
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea eax, [edi - 0x10]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41429f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x54d210]
mov eax, dword [edx + 0xc]
mov ecx, 0x54d210
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push str.SOFTWARE360Safe_softmgrmessage
push 0x50f944
lea edi, [esp + 0x20]
mov dword [esp + 0x44], 1
call fcn.00404c10
mov esi, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push str.nomorestip
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], ebp
call ebx
test eax, eax
jne 0x41434f
xor ecx, ecx
cmp dword [esp + 0x1c], 1
mov dword [esp + 0x38], 0xffffffff
sete cl
add esi, 0xfffffff0
lea edx, [esi + 0xc]
or eax, 0xffffffff
mov edi, ecx
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x414339
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
add esi, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414373
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x414390
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f6ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push str.SOFTWARE360SoftMgrmessage
xor ebx, ebx
push 0x50f944
lea edi, [esp + 0x20]
mov dword [esp + 0x44], ebx
call fcn.00404c10
mov edi, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
push str.recent_nomorestip
push edi
mov ebp, 4
mov dword [esp + 0x2c], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push SysReAllocString
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
call ebx
test eax, eax
jne 0x41448c
push eax
call fcn.004cbb5a
mov ecx, dword [esp + 0x1c]
xor esi, esi
add esp, 4
sub eax, ecx
sbb edx, esi
test edx, edx
jg 0x414484
jl 0x414447
cmp eax, 0x127500
jae 0x414484
lea eax, [edi - 0x10]
mov dword [esp + 0x38], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41446b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea eax, [edi - 0x10]
jmp 0x414545
lea eax, [edi - 0x10]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4144b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x54d210]
mov eax, dword [edx + 0xc]
mov ecx, 0x54d210
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push str.SOFTWARE360Safe_softmgrmessage
push 0x50f944
lea edi, [esp + 0x20]
mov dword [esp + 0x44], 1
call fcn.00404c10
mov esi, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push str.recent_nomorestip
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], ebp
call ebx
test eax, eax
jne 0x414542
push eax
call fcn.004cbb5a
mov ecx, dword [esp + 0x20]
xor edi, edi
add esp, 4
sub eax, ecx
sbb edx, edi
test edx, edx
jg 0x414542
jl 0x41453a
cmp eax, 0x127500
jae 0x414542
lea eax, [esi - 0x10]
jmp 0x41444a
lea eax, [esi - 0x10]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414566
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret