joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a432
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SOFTWARE360TotalSecurityDeepScan
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43a461
cmp dword [ebp - 4], esi
je 0x43a493
xor eax, eax
cmp dword [ebp + 8], esi
push 4
setne al
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push esi
push str.DisableHRM
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x43a48a
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x43a56b
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
neg eax
sbb eax, eax
neg eax
leave
ret

Function at 0x43a587
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004b4620
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x43a5d2
xor eax, eax
jmp 0x43a601
push str.ntdll.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43a5ce
push str.RtlGetVersion
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43a60d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x43a661
xor eax, eax
inc eax
cmp dword [ebp - 0x110], eax
je 0x43a663
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43a66f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004b46ff
leave
ret
Function at 0x43a6c5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43a721
cmp dword [ebp - 0x114], 6
jne 0x43a71d
xor eax, eax
inc eax
cmp dword [ebp - 0x110], eax
je 0x43a723
xor eax, eax
jmp 0x43a723
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43a72f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43a777
mov al, 1
jmp 0x43a78f
cmp dword [ebp - 0x11c], 6
ja 0x43a773
jne 0x43a78d
xor eax, eax
inc eax
cmp dword [ebp - 0x118], eax
jae 0x43a78f
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43aaed
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp eax, ecx
jne 0x43aafe
xor eax, eax
inc eax
pop ebp
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
pop ebp
ret
Function at 0x43ab33
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14c
push ebx
push esi
xor edx, edx
lea ecx, [eax + 0x21]
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x14c], esi
inc edx
add ecx, 4
cmp edx, 0x10
jl 0x43ab47
push 0x40
lea ecx, [ebp - 0x144]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x43ab7e
mov esi, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
and dword [ebp + 8], 0
mov dword [ebp - 4], esi
mov esi, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 8]
mov edi, ecx
not edi
and edi, dword [ebp - 4]
mov ebx, edx
and ebx, ecx
or edi, ebx
rol esi, 5
add esi, edi
mov edi, dword [ebp + 8]
add esi, dword [ebp + edi*4 - 0x14c]
mov edi, dword [ebp - 0xc]
inc dword [ebp + 8]
lea esi, [esi + edi + 0x5a827999]
mov edi, dword [ebp - 4]
ror ecx, 2
cmp dword [ebp + 8], 0x14
mov dword [ebp - 4], edx
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
jl 0x43abaf
mov dword [ebp + 8], 0x14
mov ebx, dword [ebp - 4]
xor ebx, edx
xor ebx, ecx
rol esi, 5
add esi, ebx
mov ebx, dword [ebp + 8]
add esi, dword [ebp + ebx*4 - 0x14c]
inc dword [ebp + 8]
lea esi, [esi + edi + 0x6ed9eba1]
mov edi, dword [ebp - 4]
ror ecx, 2
cmp dword [ebp + 8], 0x28
mov dword [ebp - 4], edx
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], esi
jl 0x43abfc
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], 0x28
mov edi, edx
or edi, ecx
and edi, dword [ebp - 4]
mov ebx, edx
and ebx, ecx
or edi, ebx
mov ebx, dword [ebp + 8]
add edi, dword [ebp + ebx*4 - 0x14c]
rol esi, 5
add esi, dword [ebp - 0xc]
inc dword [ebp + 8]
lea esi, [edi + esi - 0x70e44324]
mov edi, dword [ebp - 4]
ror ecx, 2
push 0x3c
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edx
pop edi
cmp dword [ebp + 8], edi
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], esi
jl 0x43ac3d
mov dword [ebp + 8], edi
mov edi, dword [ebp - 4]
mov ebx, dword [ebp + 8]
xor edi, edx
xor edi, ecx
add edi, dword [ebp + ebx*4 - 0x14c]
mov ebx, dword [ebp - 4]
rol esi, 5
add esi, dword [ebp - 0xc]
inc dword [ebp + 8]
ror ecx, 2
cmp dword [ebp + 8], 0x50
mov dword [ebp - 4], edx
lea esi, [edi + esi - 0x359d3e2a]
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
jl 0x43ac83
mov edi, dword [eax]
add edi, esi
mov esi, dword [eax + 4]
add esi, ecx
mov ecx, dword [eax + 8]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [eax], edi
pop edi
add ecx, ebx
and dword [eax + 0x1c], 0
mov dword [eax + 4], esi
pop esi
mov dword [eax + 0x10], ecx
pop ebx
leave
ret
Function at 0x43ada9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ae25
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.Path
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004b5d07
pop ecx
test eax, eax
je 0x43ae22
lea ecx, [esi + eax*2]
cmp word [ecx - 2], 0x5c
je 0x43ae22
push 0x5c
pop edx
mov word [ecx], dx
pop esi
leave
ret
xor eax, eax
leave
ret

Function at 0x43aff1
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004b4d90
and dword [ebp - 0x1004], 0
push 0xffc
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.004b4620
and dword [ebp - 4], 0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x43b03a
leave
ret
mov eax, dword [ebp - 4]
shr eax, 2
leave
ret

Function at 0x43b1b1
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
xor esi, esi
cmp dword [0x53dea0], esi
jne 0x43b1f4
cmp dword [0x53de9c], esi
jne 0x43b1fc
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
je 0x43b1ea
push str.GetPhysicallyInstalledSystemMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53de9c], eax
mov dword [0x53dea0], 1
cmp dword [0x53de9c], esi
je 0x43b223
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [0x53de9c]
test eax, eax
je 0x43b223
push esi
push 0x400
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004b6210
jmp 0x43b271
push 0x3c
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x43b24f
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
jmp 0x43b271
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x20]
xor edx, edx
pop edi
pop esi
leave
ret
Function at 0x43b39c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 2
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, ebx
je 0x43b41d
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x43b414
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x43b414
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x43b40d
push ebx
call fcn.004b53ff
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x43b40d
push ebx
push dword [ebp + 8]
push eax
call fcn.004b4a20
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x43b460
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x4f8b70
push dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43b457
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
inc esi
push dword [ebp - 4]
call fcn.004b5322
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43b63b
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x43b661
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x43b668
xor al, al
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ebp
ret

Function at 0x43b66c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
jne 0x43b697
xor eax, eax
jmp 0x43b6f3
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x43b6de
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x43b6e4
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43b6c6
jmp 0x43b6ea
mov edi, dword [ebp - 0x218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b46ff
leave
ret
Function at 0x43b72a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x535694]
test eax, eax
jl 0x43b754
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
jmp 0x43b7f8
and dword [0x535694], 0
push esi
push 0x24
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.004b4620
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004b4620
add esp, 0x18
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x43b7b3
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x43b7f5
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43b7f5
lea ecx, [ebp - 0x144]
push ecx
call eax
cmp word [ebp - 0x144], 9
je 0x43b7eb
cmp word [ebp - 0x144], 6
jne 0x43b7f5
xor eax, eax
inc eax
mov dword [0x535694], eax
jmp 0x43b7f7
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43bad7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x43baf7
xor eax, eax
jmp 0x43bb4a
push esi
push edi
call fcn.004b53ff
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x43bb09
xor eax, eax
jmp 0x43bb49
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43bb40
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x4f8b70
push esi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push esi
call fcn.004b5322
pop ecx
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x43bb4e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x43bb8f
cmp dword [ebp - 0x110], 0
jne 0x43bb8f
xor eax, eax
inc eax
jmp 0x43bb91
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret
Function at 0x43bb9d
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x21c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x218], 5
jne 0x43bc58
cmp dword [ebp - 0x214], 1
jb 0x43bc58
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x4f8fa4
push 0x4f8f74
push 0x80000002
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x224], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x43bc58
lea eax, [ebp - 0x108]
push str.Service_Pack_2
push eax
call fcn.004b6808
pop ecx
pop ecx
test eax, eax
jl 0x43bc58
xor eax, eax
inc eax
jmp 0x43bc5a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43bc66
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jne 0x43bca7
cmp dword [ebp - 0x110], 2
jne 0x43bca7
xor eax, eax
inc eax
jmp 0x43bca9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret

Function at 0x43bcb5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.004b4620
add esp, 0xc
push str.GetNativeSystemInfo
push 0x4f8fb0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43bcee
lea ecx, [ebp - 0x24]
push ecx
call eax
jmp 0x43bcf8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x24], 9
je 0x43bd0a
cmp word [ebp - 0x24], 6
je 0x43bd0a
xor eax, eax
leave
ret
xor eax, eax
inc eax
leave
ret
Function at 0x43bd64
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x24
lea eax, [ebp - 0x14c]
push 0
push eax
call fcn.004b4620
add esp, 0xc
push str.GetNativeSystemInfo
push 0x4f8fb0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43bdb0
lea ecx, [ebp - 0x14c]
push ecx
call eax
jmp 0x43bdbd
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x43be01
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
and dword [ebp - 0x124], 0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x124]
push eax
push str.kernel32.dll
call fcn.0043bad7
add esp, 0xc
pop esi
test eax, eax
jne 0x43be2c
xor al, al
jmp 0x43be67
mov eax, dword [ebp - 0x124]
movzx ecx, word [ebp - 0x124]
shr eax, 0x10
cmp word [ebp - 0x14c], 9
je 0x43be5a
cmp word [ebp - 0x14c], 6
je 0x43be5a
cmp eax, 5
jne 0x43be65
cmp ecx, 2
jmp 0x43be63
cmp eax, 6
jb 0x43be28
jne 0x43be65
test ecx, ecx
je 0x43be28
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b46ff
leave
ret
Function at 0x43c206
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x238], ax
xor esi, esi
lea eax, [ebp - 0x236]
inc esi
push eax
mov byte [ebp - 0x239], 1
mov dword [ebp - 0x240], esi
call fcn.004b4620
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x240]
push eax
push dword [0x5356a0]
mov ebx, 0x80000002
push dword [0x53569c]
mov dword [ebp - 0x244], 0x208
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43c294
cmp dword [ebp - 0x240], esi
jne 0x43c294
cmp dword [ebp - 0x244], eax
jne 0x43c2cb
push edi
push 0xa
pop ecx
push 0x2a
mov esi, str.safemon360bsmon.tpi
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x30]
push eax
push 1
push dword [0x5356a0]
movsw word es:[edi], word [esi]
push dword [0x53569c]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
test eax, eax
je 0x43c2cb
mov byte [ebp - 0x239], 0
push 4
pop esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x240]
push eax
push dword [0x535698]
mov dword [ebp - 0x248], 3
push dword [0x53569c]
mov dword [ebp - 0x240], esi
push ebx
mov dword [ebp - 0x244], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43c321
cmp dword [ebp - 0x240], esi
jne 0x43c321
cmp dword [ebp - 0x248], 1
je 0x43c34f
push esi
lea eax, [ebp - 0x248]
push eax
push esi
push dword [0x535698]
mov dword [ebp - 0x248], 1
push dword [0x53569c]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x43c34f
xor al, al
jmp 0x43c35a
xor eax, eax
cmp byte [ebp - 0x239], al
setne al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b46ff
leave
ret

Function at 0x43c3fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004b4620
push str.SoftMgr360SoftMgrS.dll
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0043beed
lea eax, [ebp - 0x20c]
push eax
call fcn.004b5d07
add esp, 0x1c
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.ImagePath
push str.Software360safe360krnlsvc_softmgrs
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.004b46ff
leave
ret
Function at 0x43c733
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], str.SYSTEMCurrentControlSetServices360AvFlt
call fcn.0043b72a
test al, al
je 0x43c75f
mov dword [ebp - 4], 0x4f8550
push esi
push dword [ebp + 8]
call fcn.0043c690
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push 1
push esi
push dword [ebp - 4]
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c7ff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Start
push dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x43c7ff
mov edi, str.DeleteFlag
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x43c7c1
mov al, 1
jmp 0x43c801
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
push esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43c7ff
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push edi
push dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb al, al
inc al
jmp 0x43c801
xor al, al
pop edi
pop esi
pop ebx
leave
ret