joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e2d8
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x523b0f
call fcn.004fc6ce
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42e3b4
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 0x14], ebx
je 0x42e3b4
cmp byte [edi + 0xb0], bl
jne 0x42e3b4
push 0x590f51
push 0x24
call fcn.004f5c13
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x42e32a
call fcn.00404eb3
jmp 0x42e32c
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x42e3b4
push 0x64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0xffffffffffffffff
push ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.00404f8d
mov eax, dword [ebp + 0xc]
push ebx
push ebx
push esi
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 4]
push 0x42e531
push ebx
mov dword [esi + 0x20], eax
push ebx
mov byte [edi + 0xb0], 1
mov byte [ebp + 0xb], bl
call fcn.004f5629
add esp, 0x18
cmp eax, ebx
je 0x42e398
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x4e20
push 0x64
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [ebp + 0xb], 1
jmp 0x42e3af
push ebx
push 1
mov ecx, esi
mov byte [edi + 0xb0], bl
call fcn.004051a5
push esi
call fcn.004f1890
pop ecx
mov al, byte [ebp + 0xb]
jmp 0x42e3b6
xor al, al
call fcn.004fc7a6
ret 8

Function at 0x42e3be
Capabilities:
Parse url

Disassembly:
push 0x64
mov eax, 0x520442
call fcn.004fc737
mov eax, dword [ebp + 8]
push 0x3c
pop esi
push esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x70]
push 0
push eax
mov edi, ecx
xor bl, bl
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
mov dword [ebp - 0x70], esi
call fcn.0042cfe1
and dword [ebp - 4], 0
mov eax, dword [0x590e04]
mov edi, dword [ebp - 0x18]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
push edi
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0041adfb
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], edi
jae 0x42e42d
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov edi, dword [ebp - 0x30]
test eax, eax
je 0x42e470
or eax, 0xffffffff
lea esi, [ebp - 0x30]
call fcn.0041ae23
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x48], 0x10
jb 0x42e45c
mov eax, dword [eax + 0x34]
jmp 0x42e45f
add eax, 0x34
push eax
push edi
call fcn.004f9c60
mov ebx, eax
neg ebx
pop ecx
sbb bl, bl
pop ecx
inc bl
lea eax, [edi - 0x10]
call fcn.00405521
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004051a5
mov al, bl
call fcn.004fc7ba
ret 4
Function at 0x437060
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x51f843
call fcn.004fc6ce
and dword [ebp - 0x10], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov ebx, str.FullCheck
mov edi, str.Options
cmp eax, esi
je 0x4370e9
cmp eax, ebx
je 0x4370e9
cmp eax, edi
je 0x4370e9
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.0042ee4a
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x1c], 0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00405521
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x4370f7
or dword [ebp - 0x10], eax
jmp 0x4370fc
not eax
and dword [ebp - 0x10], eax
push SysReAllocString
push dword [ebp - 0x10]
push edi
push ebx
call fcn.00439dda
add esp, 0x10
call fcn.004fc7a6
ret

Function at 0x4371c5
Capabilities:
Encode data using xor

Disassembly:
push 0x6c
mov eax, 0x520589
call fcn.004fc737
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], edi
cmp dword [ebx + 0x14], edi
jne 0x4371f2
call fcn.00404eb3
mov eax, esi
jmp 0x4372d4
cmp eax, edi
jne 0x4371fb
mov eax, str.Experience
push eax
lea ecx, [ebp - 0x74]
call fcn.0040531c
lea esi, [ebp - 0x4c]
call fcn.00436af4
push edi
push 1
lea ecx, [ebp - 0x74]
call fcn.004051a5
push 0xf
pop esi
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], esi
call fcn.0040526c
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], edi
call fcn.00436b15
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
call fcn.0040526c
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x14]
lea edi, [eax - 1]
mov eax, ebx
call fcn.004036e5
movsx eax, byte [eax]
mov esi, dword [ebp - 0x34]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x58], eax
test esi, esi
jbe 0x437290
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
call fcn.004036e5
mov cl, byte [ebp - 0x58]
add cl, byte [ebp - 0x4c]
lea edi, [ebp - 0x2c]
xor cl, byte [eax]
mov byte [ebp - 0x50], cl
push dword [ebp - 0x50]
push 1
call fcn.00403748
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jb 0x437265
mov eax, dword [ebx + 0x14]
lea edi, [eax - 1]
mov eax, ebx
call fcn.004036e5
mov al, byte [eax]
mov byte [ebp - 0x50], al
push dword [ebp - 0x50]
lea edi, [ebp - 0x2c]
push 1
call fcn.00403748
mov ecx, dword [ebp - 0x54]
mov eax, edi
push eax
call fcn.00404e8a
push 0
push 1
mov ecx, edi
call fcn.004051a5
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004051a5
mov eax, dword [ebp - 0x54]
call fcn.004fc7ba
ret
Function at 0x4372da
Capabilities:
Encode data using xor

Disassembly:
push 0x70
mov eax, 0x52ac2a
call fcn.004fc737
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ebx
cmp dword [esi + 0x14], ebx
jne 0x43730b
mov esi, edi
call fcn.00404eb3
mov eax, edi
jmp 0x4373dc
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.0040526c
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x14]
lea edi, [eax - 1]
mov eax, esi
call fcn.004036e5
movsx eax, byte [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 0x14]
dec eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], ebx
cmp eax, ebx
jbe 0x43736c
mov edi, dword [ebp - 0x4c]
mov eax, esi
call fcn.004036e5
mov cl, byte [ebp - 0x60]
add cl, byte [ebp - 0x4c]
lea edi, [ebp - 0x48]
xor cl, byte [eax]
mov byte [ebp - 0x5c], cl
push dword [ebp - 0x5c]
push 1
call fcn.00403748
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x54]
jb 0x43733f
mov eax, dword [ebp - 0x50]
cmp eax, ebx
jne 0x437378
mov eax, str.Experience
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040531c
lea esi, [ebp - 0x50]
call fcn.00436af4
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.004051a5
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.0040526c
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00436c07
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x2c]
push eax
call fcn.00404e8a
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004051a5
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004051a5
mov eax, dword [ebp - 0x58]
call fcn.004fc7ba
ret
Function at 0x4373e2
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x52680d
call fcn.004fc737
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x23c], ebx
test byte [0x5957a4], 1
push 7
mov dword [ebp - 0x240], edi
pop esi
jne 0x437433
or dword [0x5957a4], 1
xor eax, eax
push 0x534b78
mov dword [0x5957a0], esi
mov dword [0x59579c], ebx
mov word [0x59578c], ax
call fcn.004f447f
pop ecx
cmp byte [0x594d70], 1
jne 0x43744f
push 0x595788
mov esi, edi
call fcn.0042a58e
mov eax, edi
jmp 0x43752c
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004f18b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x595788
test eax, eax
je 0x437517
xor eax, eax
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], ebx
push dword [ebp - 0x21c]
call fcn.004104ad
pop ecx
pop ecx
test al, al
je 0x437505
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0041056c
pop ecx
pop ecx
test al, al
jne 0x4374f0
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0041073d
pop ecx
pop ecx
jmp 0x4374f2
mov al, 1
cmp al, bl
je 0x437505
push 0xffffffffffffffff
push ebx
push edi
lea eax, [ebp - 0x238]
call fcn.00404b74
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x238]
call fcn.00404e29
mov esi, dword [ebp - 0x240]
push edi
mov byte [0x594d70], 1
call fcn.0042a58e
mov eax, esi
call fcn.004fc7ba
ret

Function at 0x437532
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x52680d
call fcn.004fc737
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x23c], esi
test byte [0x59577c], 1
push 7
mov dword [ebp - 0x240], edi
pop ebx
jne 0x437583
or dword [0x59577c], 1
xor eax, eax
push 0x534b89
mov dword [0x595778], ebx
mov dword [0x595774], esi
mov word [0x595764], ax
call fcn.004f447f
pop ecx
cmp byte [0x594d71], 1
jne 0x43759f
push 0x595760
mov esi, edi
call fcn.0042a58e
mov eax, edi
jmp 0x43765c
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.004f18b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x595760
test eax, eax
je 0x437647
xor eax, eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], esi
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], esi
push dword [ebp - 0x21c]
call fcn.004104ad
pop ecx
pop ecx
test al, al
je 0x437635
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0041073d
pop ecx
pop ecx
test al, al
je 0x437635
push 0xffffffffffffffff
push esi
push edi
lea eax, [ebp - 0x238]
call fcn.00404b74
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0x238]
call fcn.00404e29
mov esi, dword [ebp - 0x240]
push edi
mov byte [0x594d71], 1
call fcn.0042a58e
mov eax, esi
call fcn.004fc7ba
ret
Function at 0x4377ff
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x51f820
call fcn.004fc6ce
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov byte [0x594d78], 1
mov byte [ebp - 0xd], 0
cmp eax, esi
je 0x43788f
mov ebx, str.FullCheck
cmp eax, ebx
je 0x43788f
mov edi, str.ShowOptions
cmp eax, edi
je 0x43788f
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.0042ee4a
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x20], 0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 0x1c], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esi - 0x10]
call fcn.00405521
mov eax, dword [ebp - 0x18]
shr eax, 3
test al, 1
je 0x4378ca
mov eax, 0x593e48
call fcn.0044a435
test al, al
jne 0x4378ca
push str.zh_CN
push dword [0x594588]
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
je 0x4378ca
call fcn.0040ca95
test al, al
je 0x4378ca
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov byte [0x594d79], al
call fcn.004fc7a6
ret
Function at 0x437937
Capabilities:
Get geographical location

Disassembly:
push 0x538
mov eax, 0x530cad
call fcn.004fc76d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push 0x40f
mov dword [ebp - 0x508], eax
lea eax, [ebp - 0x42b]
push ebx
push eax
mov byte [ebp - 0x42c], bl
call fcn.004f18b0
add esp, 0xc
push SysReAllocString
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x549080
push str.UserProfile
mov dword [ebp - 0x504], 0x410
call fcn.00439cb4
add esp, 0x14
test al, al
je 0x437a05
mov eax, dword [ebp - 0x504]
cmp eax, ebx
je 0x437a05
dec eax
push eax
lea eax, [ebp - 0x42c]
push eax
lea esi, [ebp - 0x464]
call fcn.00429200
push ebx
mov edx, esi
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], ebx
call fcn.004372da
pop ecx
mov byte [ebp - 4], 1
push ebx
cmp dword [ebp - 0x434], ebx
jne 0x437a0d
push 1
lea ecx, [ebp - 0x448]
call fcn.004051a5
push ebx
push 1
mov ecx, esi
call fcn.004051a5
xor al, al
call fcn.004fc7c9
ret
push ebx
lea eax, [ebp - 0x544]
mov byte [ebp - 0x4fd], bl
call fcn.004b6cbe
lea eax, [ebp - 0x4fc]
push eax
mov byte [ebp - 4], 5
call fcn.004b775e
mov byte [ebp - 4], 6
cmp dword [ebp - 0x430], 0x10
mov eax, dword [ebp - 0x444]
jae 0x437a48
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040531c
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 7
call fcn.004b77c2
cmp al, 1
sete byte [ebp - 0x4fe]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 6
call fcn.004051a5
cmp byte [ebp - 0x4fe], bl
je 0x437b51
lea eax, [ebp - 0x544]
push eax
mov edi, str.account
lea eax, [ebp - 0x52c]
call fcn.0043b514
pop ecx
mov ecx, dword [ebp - 0x510]
push 0xffffffffffffffff
push ebx
push eax
mov byte [ebp - 4], 8
call fcn.00404f8d
push ebx
push esi
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 6
call fcn.004051a5
lea eax, [ebp - 0x544]
push eax
mov edi, str.country_code
lea eax, [ebp - 0x52c]
call fcn.0043b514
pop ecx
mov ecx, dword [ebp - 0x50c]
push 0xffffffffffffffff
push ebx
push eax
mov byte [ebp - 4], 9
call fcn.00404f8d
push ebx
push esi
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 6
call fcn.004051a5
lea eax, [ebp - 0x544]
push eax
mov edi, str.token
lea eax, [ebp - 0x52c]
call fcn.0043b514
pop ecx
mov ecx, dword [ebp - 0x508]
push 0xffffffffffffffff
push ebx
push eax
mov byte [ebp - 4], 0xa
call fcn.00404f8d
push ebx
push esi
lea ecx, [ebp - 0x52c]
call fcn.004051a5
mov byte [ebp - 0x4fd], 1
lea eax, [ebp - 0x4fc]
call fcn.0040b686
lea esi, [ebp - 0x544]
mov byte [ebp - 4], 2
call fcn.004b5d4a
jmp 0x437b75
push ebx
push 1
lea ecx, [ebp - 0x448]
call fcn.004051a5
push ebx
push 1
lea ecx, [ebp - 0x464]
call fcn.004051a5
mov al, byte [ebp - 0x4fd]
jmp 0x437a07
Function at 0x439b2b
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x5322e9
call fcn.004fc737
xor ebx, ebx
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x68], edi
mov esi, edx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00439a6d
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], ebx
je 0x439bf5
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x439b7c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439bf5
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x439b93
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x64]
call fcn.0043f6d8
pop ecx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x439bad
lea eax, [ebp - 0x44]
mov edi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
call fcn.0041cfb3
test eax, eax
setne al
mov byte [esi], al
mov esi, dword [ebp - 0x68]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042a58e
push ebx
push 1
lea esi, [ebp - 0x64]
call fcn.00404e29
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00404e29
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00404e29
mov eax, dword [ebp - 0x68]
jmp 0x439c17
mov byte [esi], 1
mov esi, edi
call fcn.00404e70
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00404e29
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00404e29
mov eax, edi
call fcn.004fc7ba
ret

Function at 0x439c1d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x5207f5
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x439cac
xor edi, edi
cmp dword [ebp + 8], edi
je 0x439cac
cmp dword [ebp + 0xc], edi
je 0x439cac
cmp dword [ebp + 0x14], edi
je 0x439cac
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.0042ee4a
add esp, 0xc
push 4
pop esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x10]
push edi
push dword [ebp + 0x14]
mov bl, 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x439c9e
cmp dword [ebp - 0x14], esi
je 0x439ca0
xor bl, bl
lea eax, [edi - 0x10]
call fcn.00405521
mov al, bl
jmp 0x439cae
xor al, al
call fcn.004fc7a6
ret
Function at 0x439cb4
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x51f048
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x439d38
cmp dword [ebp + 8], eax
je 0x439d38
cmp dword [ebp + 0xc], eax
je 0x439d38
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.0042ee4a
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0xc
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push dword [ebp + 0x10]
mov bl, 1
push eax
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x439d2a
cmp dword [ebp - 0x14], 3
je 0x439d2c
xor bl, bl
lea eax, [esi - 0x10]
call fcn.00405521
mov al, bl
jmp 0x439d3a
xor al, al
call fcn.004fc7a6
ret

Function at 0x439d40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x51f025
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x439dd2
cmp dword [ebp + 8], eax
je 0x439dd2
cmp dword [ebp + 0xc], eax
je 0x439dd2
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.0042ee4a
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x10], 0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov bl, 1
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x18], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x439dc4
cmp dword [ebp - 0x10], 0xb
je 0x439dc6
cmp dword [ebp - 0x10], 4
je 0x439dc6
xor bl, bl
lea eax, [esi - 0x10]
call fcn.00405521
mov al, bl
jmp 0x439dd4
xor al, al
call fcn.004fc7a6
ret

Function at 0x439dda
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x439e81
xor edi, edi
cmp dword [ebp + 8], edi
je 0x439e81
cmp dword [ebp + 0xc], edi
je 0x439e81
cmp dword [ebp + 0x14], edi
je 0x439e81
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.0042ee4a
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x14]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x439e55
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [esi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x439e83
xor al, al
call fcn.004fc7a6
ret
Function at 0x439e89
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x439f28
xor edi, edi
cmp dword [ebp + 8], edi
je 0x439f28
cmp dword [ebp + 0xc], edi
je 0x439f28
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.0042ee4a
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, SysReAllocString
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x439efe
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
push dword [ebp + 0x14]
mov edi, dword [ebp - 0x14]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [edi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x439f2a
xor al, al
call fcn.004fc7a6
ret

Function at 0x439f30
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x51ef15
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x439fce
xor edi, edi
cmp dword [ebp + 8], edi
je 0x439fce
cmp dword [ebp + 0xc], edi
je 0x439fce
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push str._s_s
mov dword [ebp - 4], edi
call fcn.0042ee4a
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x18]
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x439fa2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
push dword [ebp + 0xc]
push esi
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [esi - 0x10]
inc bl
call fcn.00405521
mov al, bl
jmp 0x439fd0
xor al, al
call fcn.004fc7a6
ret

Function at 0x439fd9
Capabilities:
Delete registry value

Disassembly:
push 4
mov eax, 0x5234de
call fcn.004fc6ce
xor eax, eax
mov esi, str.software360TotalSecurity
cmp eax, esi
je 0x43a049
cmp dword [ebp + 8], eax
je 0x43a049
cmp dword [ebp + 0xc], eax
je 0x43a049
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push str._s_s
lea eax, [ebp - 0x10]
call fcn.0042ee4a
mov esi, dword [ebp - 0x10]
add esp, 0xc
push dword [ebp + 0xc]
mov bl, 1
push esi
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x43a03d
xor bl, bl
lea eax, [esi - 0x10]
call fcn.00405521
mov al, bl
jmp 0x43a04b
xor al, al
call fcn.004fc7a6
ret