joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1810
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x4b1916
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
cmp ecx, 0x5c
je 0x4b1845
mov edx, dword [ebp + 8]
movzx eax, word [edx + 4]
cmp eax, 0x5c
jne 0x4b1858
mov ecx, dword [ebp + 8]
push ecx
call fcn.00417680
jmp 0x4b1918
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.system32
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call fcn.00417680
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4b190e
push 0x514758
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x514758
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.00417680
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
jmp 0x4b1918
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x4b1930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov byte [ebp - 5], 0
lea ecx, [ebp - 0xc]
call fcn.00418350
push 0x104
lea ecx, [ebp - 0xc]
call fcn.00416ee0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b19f9
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
call fcn.00418620
cmp dword [ebp - 0x10], 0
jl 0x4b19f9
push str._system32Sensapi.dll
lea ecx, [ebp - 0xc]
call fcn.0040e800
lea ecx, [ebp - 0xc]
call fcn.0044ea20
push eax
call fcn.00417680
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b19f5
push str.IsNetworkAlive
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b19e2
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4b19e2
cmp dword [ebp - 0x1c], 1
jne 0x4b19e2
mov byte [ebp - 5], 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x14], 0
jmp 0x4b19f9
mov byte [ebp - 5], 1
mov cl, byte [ebp - 5]
mov byte [ebp - 0x21], cl
lea ecx, [ebp - 0xc]
call fcn.004335b0
mov al, byte [ebp - 0x21]
mov esp, ebp
pop ebp
ret
Function at 0x4b1a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4b1a5c
xor eax, eax
jmp 0x4b1aa8
push 0x512064
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x4b1a76
xor eax, eax
jmp 0x4b1aa8
push str.RtlGetVersion
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4b1aa6
mov eax, dword [ebp - 0x214]
jmp 0x4b1aa8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x4b1ac0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x4b1b28
cmp dword [ebp - 0x118], 1
jne 0x4b1b28
mov dword [ebp - 0x124], 1
jmp 0x4b1b32
mov dword [ebp - 0x124], 0
mov al, byte [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x4b7890
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4b789e
xor eax, eax
jmp 0x4b78d3
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b78d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b78d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x4b78d3
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b7980
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x4b79a1
or eax, 0xffffffff
jmp 0x4b7b2c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push eax
lea ecx, [ebp - 8]
call fcn.00419d50
lea ecx, [ebp - 8]
call fcn.004b8db0
movzx eax, al
test eax, eax
jne 0x4b79df
mov dword [ebp - 0x248], 0xffffffff
lea ecx, [ebp - 8]
call fcn.004b8d50
mov eax, dword [ebp - 0x248]
jmp 0x4b7b2c
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea ecx, [ebp - 0x23c]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
push edx
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4b7a3f
mov dword [ebp - 0x24c], 0xffffffff
lea ecx, [ebp - 8]
call fcn.004b8d50
mov eax, dword [ebp - 0x24c]
jmp 0x4b7b2c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.0040f510
lea ecx, [ebp - 4]
call fcn.00416e70
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x244]
call fcn.0040f510
lea ecx, [ebp - 0x244]
call fcn.00491d30
lea ecx, [ebp - 0x244]
call fcn.00416e70
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x244]
push eax
call fcn.0046fd10
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4b7ac4
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x250], edx
lea ecx, [ebp - 0x244]
call fcn.004335b0
lea ecx, [ebp - 4]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004b8d50
mov eax, dword [ebp - 0x250]
jmp 0x4b7b2c
push 0x22c
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x244]
call fcn.004335b0
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b7a53
mov dword [ebp - 0x254], 0xffffffff
lea ecx, [ebp - 4]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004b8d50
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4b7c10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov eax, dword [0x5389c8]
and eax, 1
jne 0x4b7c5a
mov ecx, dword [0x5389c8]
or ecx, 1
mov dword [0x5389c8], ecx
mov ecx, 0x5389a8
call fcn.004dcce0
push 0x50b580
call fcn.004ec85c
add esp, 4
mov ecx, 0x5389a8
call fcn.004da840
movzx edx, al
test edx, edx
jne 0x4b7c8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x5389a4]
sub ecx, eax
cmp ecx, 0x1388
ja 0x4b7c8b
cmp dword [ebp + 0x10], 1
jne 0x4b7d81
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4b7d81
mov ecx, 0x5389a8
call fcn.0044c190
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea edx, [ebp - 0x23c]
push edx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4b7d77
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x244]
call fcn.0040f510
lea ecx, [ebp - 0x244]
call fcn.00491d30
lea ecx, [ebp - 0x244]
call fcn.00416e70
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x244]
push ecx
mov ecx, 0x5389a8
call fcn.004b8e20
mov ecx, eax
call fcn.0043c620
push 0x22c
push 0
lea edx, [ebp - 0x240]
push edx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x244]
call fcn.004335b0
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b7ced
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.0040f510
lea ecx, [ebp - 4]
call fcn.00416e70
lea ecx, [ebp - 0x254]
push ecx
mov ecx, 0x5389a8
call fcn.00458210
push eax
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x24c]
push eax
mov ecx, 0x5389a8
call fcn.004b8ee0
mov ecx, eax
call fcn.0047f760
movzx ecx, al
test ecx, ecx
je 0x4b7e01
lea edx, [ebp - 4]
push edx
mov ecx, 0x5389a8
call fcn.004b8e20
mov ecx, eax
call fcn.0043c600
test eax, eax
je 0x4b7e01
lea eax, [ebp - 4]
push eax
mov ecx, 0x5389a8
call fcn.004b8e20
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0049ff80
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x258], ecx
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x4b8030
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 5
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4b8077
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004abfc0
mov eax, dword [ebp - 4]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, 1
jmp 0x4b8079
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b85b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4b8604
push 0x52022c
mov ecx, dword [ebp + 8]
call fcn.0040f510
mov eax, dword [ebp + 8]
jmp 0x4b86a7
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x214]
call fcn.0040f510
push 0x50d6f8
push 1
lea ecx, [ebp - 0x214]
call fcn.0047ef80
sub eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00434540
mov ecx, eax
call fcn.0041d430
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x215], al
lea ecx, [ebp - 0x21c]
call fcn.004335b0
movzx ecx, byte [ebp - 0x215]
test ecx, ecx
je 0x4b867a
push str.explorer.exe
lea ecx, [ebp - 0x214]
call fcn.0040e870
jmp 0x4b868a
push 0x519600
lea ecx, [ebp - 0x214]
call fcn.0040e870
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x214]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4b8710
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
cmp dword [ebp + 8], 0
je 0x4b8722
cmp dword [ebp + 0xc], 0
jne 0x4b8729
xor eax, eax
jmp 0x4b88b1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0040f510
lea ecx, [ebp - 8]
call fcn.00418600
movzx ecx, al
test ecx, ecx
je 0x4b875b
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x78]
jmp 0x4b88b1
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea edx, [ebp - 4]
push edx
push 0xf00ff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4b88a0
cmp dword [ebp - 4], 0
je 0x4b88a0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004b8500
add esp, 8
test eax, eax
je 0x4b8896
cmp dword [ebp - 0x10], 0
je 0x4b8896
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x14], 0
push 1
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4b87e7
mov edx, dword [ebp - 0x14]
or edx, 0x400
mov dword [ebp - 0x14], edx
jmp 0x4b87ee
mov dword [ebp - 0x74], 0
push 0x44
push 0
lea eax, [ebp - 0x70]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x68], str.winsta0default
push 0x10
push 0
lea ecx, [ebp - 0x28]
push ecx
call fcn.004ebd80
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x18]
call fcn.0040f510
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x70]
push ecx
push 0
mov edx, dword [ebp - 0x74]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.00417210
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x74], 0
je 0x4b886a
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0xc], 0
je 0x4b8884
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.004335b0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x7c], edx
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x7c]
mov esp, ebp
pop ebp
ret
Function at 0x4ba430
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00418370
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00418370
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 5
jne 0x4ba473
mov dword [ebp - 8], 0
jmp 0x4ba489
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, 0xffffff00
add ecx, 0x200
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0xc], eax
lea ecx, [ebp + 0xc]
call fcn.004335b0
lea ecx, [ebp + 0x10]
call fcn.004335b0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ba4b0
Capabilities:
Check os version
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 5
je 0x4ba4f9
movzx eax, byte [0x5389d0]
test eax, eax
jne 0x4ba4f9
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba4f2
push str.RegDeleteKeyExW
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5389cc], eax
mov byte [0x5389d0], 1
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.0044ea20
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esp, ebp
pop ebp
ret
Function at 0x4bd810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
or edx, 1
push edx
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.0044ea20
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bd886
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.0044ea20
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x4bd888
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4bdbf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
or edx, 0x20006
push edx
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.0044ea20
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4bdc71
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.0044ea20
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
jmp 0x4bdc73
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4c3450
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10a0
call fcn.004ec880
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x898], 0x400
mov ecx, 0x20
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
lea edi, [ebp - 0x888]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x890], 1
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x89c], 0x800
lea edx, [ebp - 0x89c]
push edx
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x890]
push ecx
push 0
lea edx, [ebp - 0x888]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0
jne 0x4c35ba
push 0x5c
lea eax, [ebp - 0x808]
push eax
call fcn.00421480
add esp, 8
mov dword [ebp - 0x8a0], eax
mov ecx, dword [ebp - 0x8a0]
add ecx, 2
mov dword [ebp - 0x8a0], ecx
xor edx, edx
mov eax, dword [ebp - 0x8a0]
mov word [eax], dx
xor ecx, ecx
mov word [ebp - 0x10a0], cx
push 0x7fe
push 0
lea edx, [ebp - 0x109e]
push edx
call fcn.004ebd80
add esp, 0xc
movzx eax, word [ebp - 0x808]
cmp eax, 0x25
jne 0x4c356b
push 0x400
lea ecx, [ebp - 0x10a0]
push ecx
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4c3583
lea eax, [ebp - 0x808]
push eax
push 0x400
lea ecx, [ebp - 0x10a0]
push ecx
call fcn.0040ee20
push str.SoftMgr_somkernl.dll
lea edx, [ebp - 0x10a0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x10a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c35ba
lea ecx, [ebp - 0x10a0]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040f510
mov eax, dword [ebp + 8]
jmp 0x4c3626
lea edx, [ebp - 0x894]
push edx
call fcn.00493b60
mov ecx, eax
call fcn.00493be0
lea ecx, [ebp - 0x894]
call fcn.0047ef80
test eax, eax
je 0x4c360b
push 0x519f04
lea ecx, [ebp - 0x894]
call fcn.0040e800
lea eax, [ebp - 0x894]
push eax
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x894]
call fcn.004335b0
mov eax, dword [ebp + 8]
jmp 0x4c3626
push 0x52022c
mov ecx, dword [ebp + 8]
call fcn.0040f510
lea ecx, [ebp - 0x894]
call fcn.004335b0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x4c36d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x224]
call fcn.00418350
xor eax, eax
mov word [ebp - 0x220], ax
push 0x208
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 8], 0x209
mov dword [ebp - 4], 1
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 4]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c3811
xor edx, edx
mov word [ebp - 0x438], dx
push 0x206
push 0
lea eax, [ebp - 0x436]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x50d914
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x438]
push edx
call fcn.004abb60
add esp, 0xc
movzx eax, al
cmp eax, 1
jne 0x4c3811
mov ecx, dword [ebp - 0x22c]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x22c]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x228]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x228]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._d._d._d._d
lea eax, [ebp - 0x224]
push eax
call fcn.00418ae0
add esp, 0x18
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x224]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x4c3840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x224]
call fcn.00418350
xor eax, eax
mov word [ebp - 0x220], ax
push 0x208
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 8], 0x209
mov dword [ebp - 4], 1
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 4]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c38c5
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x224]
call fcn.0040f550
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x224]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret