joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d8af
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x4defe4
call fcn.004b5257
mov eax, dword [ebp + 8]
xor esi, esi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 7
call fcn.0040daa0
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
push eax
call fcn.0045d689
pop ecx
test al, al
je 0x45d9c5
push dword [0x535300]
lea ecx, [ebp - 0x34]
call fcn.0044bc85
mov byte [ebp - 4], 1
mov edi, 0x4f8b70
push edi
lea ecx, [ebp - 0x34]
call fcn.00444b0f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45d914
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.00444b0f
lea ecx, [ebp - 0x30]
call fcn.0040c7d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.PackageRootFolder
call fcn.0044bc85
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x34]
mov ecx, esp
mov dword [ebp - 0x40], esp
push eax
call fcn.004420c1
mov byte [ebp - 4], 4
push 0x80000001
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00443769
mov byte [ebp - 4], 5
push eax
call fcn.0044b15c
mov ebx, eax
neg ebx
pop ecx
sbb bl, bl
pop ecx
inc bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
call fcn.00443c39
test bl, bl
jne 0x45d9ad
push edi
lea ecx, [ebp - 0x30]
call fcn.00444b0f
push str.MicrosoftEdge.exe
lea ecx, [ebp - 0x30]
call fcn.00444b0f
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45d9d8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.0040d610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
xor al, al
jmp 0x45da0c
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
call fcn.0040c660
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.0040d610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
mov al, 1
call fcn.004b52da
ret
Function at 0x45df99
Capabilities:
Check if file exists

Disassembly:
push 0xc0
mov eax, 0x4df187
call fcn.004b5257
mov edi, 0x50ea0c
push edi
lea ecx, [ebp - 0x48]
call fcn.0042b420
and dword [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.0044632e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x74]
push eax
mov ebx, str.InstallLocation
push ebx
mov esi, 0x4fa388
push esi
push 0x80000002
call fcn.0045db36
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push 0x80000001
call fcn.0045db36
xor ebx, ebx
add esp, 0x20
cmp dword [ebp - 0x5c], ebx
jne 0x45e085
lea eax, [ebp - 0x48]
push eax
push dword [0x535288]
push dword [0x53525c]
call fcn.00450d3b
add esp, 0xc
cmp dword [ebp - 0x34], ebx
je 0x45e085
sub esp, 0x1c
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp - 0x4c], esp
push eax
call fcn.0040c600
mov byte [ebp - 4], 2
push esi
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 1
call fcn.00448d5d
add esp, 0x24
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xcc]
call fcn.00448da2
mov byte [ebp - 4], 4
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x74]
call fcn.00456278
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xcc]
call fcn.00444c87
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x94]
call fcn.00444a91
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042b420
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.004424c1
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
lea ecx, [ebp - 0x74]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.004424c1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
jmp 0x45e125
lea ecx, [ebp - 0x50]
call fcn.0043f2d2
add eax, 0x1c
push str.launcher.exe
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 6
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d3a0
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.0040d590
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45e112
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45e146
lea ecx, [ebp - 0x50]
call fcn.0043cbdb
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x58]
call fcn.004424c1
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x50]
call fcn.0043cc0e
test al, al
je 0x45e0c4
jmp 0x45e17c
push str.Opera
lea ecx, [ebp - 0x4c]
call fcn.0044bc85
mov byte [ebp - 4], 7
lea eax, [ebp - 0x4c]
push 1
push eax
call fcn.0045da12
mov bl, al
neg bl
pop ecx
sbb bl, bl
pop ecx
inc bl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.0040d610
test bl, bl
je 0x45e1b2
xor bl, bl
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.00459427
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040d590
mov al, bl
call fcn.004b52da
ret
mov bl, 1
jmp 0x45e17e
Function at 0x45e1b6
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x4df1c7
call fcn.004b5257
mov esi, dword [ebp + 8]
push esi
push str.Opera.exe
call fcn.00451106
pop ecx
xor ebx, ebx
pop ecx
test al, al
je 0x45e1fe
cmp dword [esi + 0x14], ebx
je 0x45e1fe
cmp dword [esi + 0x18], 8
jb 0x45e1e8
mov esi, dword [esi + 4]
jmp 0x45e1eb
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e1fe
mov al, 1
call fcn.004b52da
ret
lea ecx, [ebp - 0x5c]
call fcn.0044632e
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x5c]
push eax
mov edi, str.InstallLocation
push edi
mov esi, str.Opera
push esi
push 0x80000002
call fcn.0045db36
lea eax, [ebp - 0x5c]
push eax
push edi
push esi
push 0x80000001
call fcn.0045db36
add esp, 0x20
push 0x50ea0c
lea ecx, [ebp - 0x2c]
call fcn.0042b420
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004424c1
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.004424c1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
jmp 0x45e2d4
lea ecx, [ebp - 0x40]
call fcn.0043f2d2
add eax, 0x1c
push str.launcher.exe
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d3a0
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.0040d590
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45e2c1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45e2f8
lea ecx, [ebp - 0x40]
call fcn.0043cbdb
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x38]
call fcn.004424c1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x40]
call fcn.0043cc0e
test al, al
je 0x45e279
mov byte [ebp - 0x2d], bl
jmp 0x45e2fc
mov byte [ebp - 0x2d], 1
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00459427
mov al, byte [ebp - 0x2d]
jmp 0x45e1f8
Function at 0x45e31e
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x4df1c7
call fcn.004b5257
mov esi, dword [ebp + 8]
push esi
push str.firefox.exe
call fcn.00451106
pop ecx
pop ecx
test al, al
jne 0x45e461
lea ecx, [ebp - 0x5c]
call fcn.0044632e
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x5c]
push eax
mov edi, str.InstallLocation
push edi
mov esi, str.Firefox
push esi
push 0x80000002
call fcn.0045db36
lea eax, [ebp - 0x5c]
push eax
push edi
push esi
push 0x80000001
call fcn.0045db36
add esp, 0x20
push 0x50ea0c
lea ecx, [ebp - 0x2c]
call fcn.0042b420
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004424c1
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.004424c1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
jmp 0x45e41a
lea ecx, [ebp - 0x40]
call fcn.0043f2d2
add eax, 0x1c
push str._firefox.exe
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0044c3ea
add esp, 0xc
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d3a0
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.0040d590
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45e407
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45e43e
lea ecx, [ebp - 0x40]
call fcn.0043cbdb
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x38]
call fcn.004424c1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x40]
call fcn.0043cc0e
test al, al
je 0x45e3bf
mov byte [ebp - 0x2d], bl
jmp 0x45e442
mov byte [ebp - 0x2d], 1
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d590
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00459427
mov al, byte [ebp - 0x2d]
jmp 0x45e47b
cmp dword [esi + 0x18], 8
jb 0x45e46c
mov esi, dword [esi + 4]
jmp 0x45e46f
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
call fcn.004b52da
ret

Function at 0x45f50e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
call fcn.0045f4cf
test al, al
jne 0x45f51c
pop ebp
ret
pop ebp
jmp fcn.0045e1b6
Function at 0x460965
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp ebx, esi
je 0x460ae1
cmp dword [ebp + 0xc], esi
je 0x460ae1
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x460ae1
cmp dword [ebp + 0x14], esi
je 0x460ae1
cmp dword [ebp + 0xc], 2
jbe 0x460a35
mov dword [ebp - 8], 4
mov al, byte [ebx]
inc ebx
mov cl, byte [ebx]
sub dword [ebp + 0xc], 3
inc ebx
mov dl, byte [ebx]
inc ebx
mov dword [ebp + 8], ebx
mov bl, al
shr bl, 2
mov byte [ebp - 4], bl
mov bl, cl
and al, 3
shr bl, 4
shl al, 4
add al, bl
and cl, 0xf
mov bl, dl
shr bl, 6
shl cl, 2
add cl, bl
mov ebx, dword [ebp - 8]
and dl, 0x3f
mov byte [ebp - 1], dl
cmp ebx, dword [ebp + 0x14]
ja 0x460a97
movzx edx, byte [ebp - 4]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
inc esi
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
inc ebx
inc esi
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
movzx eax, byte [ebp - 1]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ebx
inc esi
inc ebx
mov byte [esi + edi], al
inc esi
inc ebx
cmp dword [ebp + 0xc], 2
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
ja 0x4609a8
cmp dword [ebp + 0xc], 0
je 0x460ad4
xor al, al
xor cl, cl
cmp dword [ebp + 0xc], 0
mov byte [ebp + 0xa], 0
mov byte [ebp + 9], al
mov byte [ebp + 8], cl
jbe 0x460a69
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ebx
push eax
call fcn.004b4a20
mov al, byte [ebp + 9]
mov cl, byte [ebp + 8]
add esp, 0xc
mov bl, cl
mov dl, al
and cl, 3
shr dl, 4
shl cl, 4
add cl, dl
mov dl, byte [ebp + 0xa]
and al, 0xf
shr dl, 6
shl al, 2
add al, dl
lea edx, [esi + 4]
shr bl, 2
cmp edx, dword [ebp + 0x14]
jbe 0x460a9c
mov eax, 0xffffffff
jmp 0x460ae3
or eax, 0xffffffff
jmp 0x460ae3
movzx edx, bl
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], dl
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + edi], cl
inc esi
cmp dword [ebp + 0xc], 1
jne 0x460ac2
mov byte [esi + edi], 0x3d
jmp 0x460ace
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
inc esi
mov byte [esi + edi], 0x3d
inc esi
cmp esi, dword [ebp + 0x14]
jae 0x460a90
mov byte [esi + edi], 0
mov eax, esi
jmp 0x460ae3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461c1d
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4dfd5c
call fcn.004b5257
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], eax
mov esi, 0x53eda8
test byte [0x53eda4], bl
jne 0x461c77
or dword [0x53eda4], ebx
mov dword [ebp - 4], ebx
push edi
mov ecx, esi
mov dword [0x53edc0], 7
call fcn.0040daa0
push 0x4ef3f8
call fcn.004b7700
pop ecx
mov byte [ebp - 4], 0
cmp byte [0x53eda0], bl
jne 0x461c90
mov ecx, dword [ebp - 0x238]
push esi
call fcn.0040c600
jmp 0x461d4b
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b4620
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x461d39
push edi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x21c], 7
call fcn.0040daa0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x218]
call fcn.00445e05
pop ecx
pop ecx
test al, al
je 0x461d28
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x240]
call fcn.0045910b
pop ecx
pop ecx
test al, al
je 0x461d28
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
call fcn.0040d3a0
mov byte [ebp - 4], 0
push edi
push ebx
lea ecx, [ebp - 0x234]
call fcn.0040d590
mov ecx, dword [ebp - 0x238]
push esi
mov byte [0x53eda0], bl
call fcn.0040c600
mov dword [ebp - 4], edi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp - 0x238]
call fcn.004b52da
ret

Function at 0x461d60
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4dfdbf
call fcn.004b5257
mov eax, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], eax
mov esi, 0x53edcc
test byte [0x53edc8], bl
jne 0x461dba
or dword [0x53edc8], ebx
mov dword [ebp - 4], ebx
push edi
mov ecx, esi
mov dword [0x53ede4], 7
call fcn.0040daa0
push 0x4ef407
call fcn.004b7700
pop ecx
mov byte [ebp - 4], 0
cmp byte [0x53edc4], bl
jne 0x461dd3
mov ecx, dword [ebp - 0x238]
push esi
call fcn.0040c600
jmp 0x461e8e
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b4620
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x461e7c
push edi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x21c], 7
call fcn.0040daa0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x218]
call fcn.00445e05
pop ecx
pop ecx
test al, al
je 0x461e6b
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x240]
call fcn.00458f89
pop ecx
pop ecx
test al, al
je 0x461e6b
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
call fcn.0040d3a0
mov byte [ebp - 4], 0
push edi
push ebx
lea ecx, [ebp - 0x234]
call fcn.0040d590
mov ecx, dword [ebp - 0x238]
push esi
mov byte [0x53edc4], bl
call fcn.0040c600
mov dword [ebp - 4], edi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp - 0x238]
call fcn.004b52da
ret
Function at 0x461fd6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4dfe4c
call fcn.004b51ee
xor esi, esi
cmp dword [ebp + 0x14], esi
je 0x46205a
cmp dword [ebp + 8], esi
je 0x46205a
cmp dword [ebp + 0xc], esi
je 0x46205a
cmp dword [ebp + 0x18], esi
je 0x46205a
lea ecx, [ebp - 0x10]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
push 4
mov dword [ebp - 0x14], esi
pop esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov bl, 1
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x462048
cmp dword [ebp - 0x14], esi
je 0x46204a
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
mov al, bl
jmp 0x46205c
xor al, al
call fcn.004b52c6
ret

Function at 0x462062
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x4dfebb
call fcn.004b51ee
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x4620db
cmp dword [ebp + 8], esi
je 0x4620db
cmp dword [ebp + 0xc], esi
je 0x4620db
lea ecx, [ebp - 0x10]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push dword [ebp + 0x10]
mov bl, 1
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
push dword [ebp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4620c9
cmp dword [ebp - 0x14], 3
je 0x4620cb
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
mov al, bl
jmp 0x4620dd
xor al, al
call fcn.004b52c6
ret

Function at 0x4620e3
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4dfe6f
call fcn.004b51ee
xor esi, esi
cmp dword [ebp + 0x14], esi
je 0x46217d
cmp dword [ebp + 8], esi
je 0x46217d
cmp dword [ebp + 0xc], esi
je 0x46217d
cmp dword [ebp + 0x18], esi
je 0x46217d
lea ecx, [ebp - 0x14]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x14]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46214e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
mov al, bl
jmp 0x46217f
xor al, al
call fcn.004b52c6
ret
Function at 0x462185
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4dfe6f
call fcn.004b51ee
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x462216
cmp dword [ebp + 8], esi
je 0x462216
cmp dword [ebp + 0xc], esi
je 0x462216
lea ecx, [ebp - 0x14]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4621e7
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
mov al, bl
jmp 0x462218
xor al, al
call fcn.004b52c6
ret

Function at 0x46221e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4dfe6f
call fcn.004b51ee
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x4622af
cmp dword [ebp + 8], esi
je 0x4622af
cmp dword [ebp + 0xc], esi
je 0x4622af
lea ecx, [ebp - 0x14]
call fcn.004413bb
mov dword [ebp - 4], esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push str._s_s
push eax
call fcn.00461c09
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462280
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
mov al, bl
jmp 0x4622b1
xor al, al
call fcn.004b52c6
ret

Function at 0x462435
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4dfe4c
call fcn.004b51ee
xor eax, eax
mov ebx, str.software360TotalSecurity
cmp eax, ebx
je 0x4624be
mov edi, str.FullCheck
cmp eax, edi
je 0x4624be
mov esi, str.Options
cmp eax, esi
je 0x4624be
lea ecx, [ebp - 0x10]
call fcn.004413bb
and dword [ebp - 4], 0
push edi
push ebx
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp - 0x14], 0
add esp, 0x10
push 4
pop edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
mov bl, 1
push 0x80000001
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4624ac
cmp dword [ebp - 0x14], edi
je 0x4624ae
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
mov al, bl
jmp 0x4624c0
xor al, al
call fcn.004b52c6
ret
Function at 0x4624c6
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4dfebb
call fcn.004b51ee
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x462559
mov edi, str.FullCheck
cmp eax, edi
je 0x462559
mov ebx, str.Options
cmp eax, ebx
je 0x462559
lea ecx, [ebp - 0x10]
call fcn.004413bb
and dword [ebp - 4], 0
push edi
push esi
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp + 8], 0
add esp, 0x10
lea eax, [ebp + 8]
push eax
push esi
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46253a
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp + 8], 0
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0044209e
call fcn.004b52c6
ret

Function at 0x46255f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4dfede
call fcn.004b51ee
and dword [ebp - 0x10], 0
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x4625dd
mov ebx, str.FullCheck
cmp eax, ebx
je 0x4625dd
mov edi, str.Options
cmp eax, edi
je 0x4625dd
lea ecx, [ebp - 0x14]
call fcn.004413bb
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 0x14]
push str._s_s
push eax
call fcn.00461c09
and dword [ebp - 0x1c], 0
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0044209e
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x4625eb
or dword [ebp - 0x10], eax
jmp 0x4625f0
not eax
and dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.004624c6
pop ecx
call fcn.004b52c6
ret