joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x1c
mov eax, 0x4bcc62
call fcn.004603b7
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea ecx, [ebp]
call fcn.00401130
xor esi, esi
push str.SmartCloudInfo.ini
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.00401f50
push esi
push 0x4df450
lea ecx, [ebp]
call fcn.00411649
cmp eax, 0xffffffff
lea ecx, [ebp]
je 0x4119b1
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401f10
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov byte [ebp - 4], 1
mov word [ebp + 0x1c], si
call fcn.0045fa70
add esp, 0xc
push esi
push 0x1c
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x1c]
push str.VirtualStore_
push eax
call fcn.0045fd1a
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
jae 0x411966
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0045fd1a
pop ecx
pop ecx
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4119a3
push str.copy_inifile_to_VirtualStore
call fcn.00430859
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
pop ecx
jae 0x411997
lea eax, [ebp + 4]
lea ecx, [ebp + 0x1c]
push ecx
push eax
call fcn.0042cb3f
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401330
lea ecx, [ebp]
push esi
push 1
call fcn.00401330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x228
leave
ret
push esi
mov esi, ecx
call fcn.00410fba
mov ecx, esi
call fcn.0041128a
mov ecx, esi
call fcn.00411184
mov ecx, esi
pop esi
jmp 0x4118b0
Function at 0x41202c
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x1c
mov eax, 0x4bcc62
call fcn.004603b7
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea ecx, [ebp]
call fcn.00401130
xor esi, esi
push str.SmartCloudInfo.ini
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.00401f50
push esi
push 0x4df450
lea ecx, [ebp]
call fcn.00411649
cmp eax, 0xffffffff
lea ecx, [ebp]
je 0x4119b1
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401f10
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov byte [ebp - 4], 1
mov word [ebp + 0x1c], si
call fcn.0045fa70
add esp, 0xc
push esi
push 0x1c
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x1c]
push str.VirtualStore_
push eax
call fcn.0045fd1a
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
jae 0x411966
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0045fd1a
pop ecx
pop ecx
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4119a3
push str.copy_inifile_to_VirtualStore
call fcn.00430859
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
pop ecx
jae 0x411997
lea eax, [ebp + 4]
lea ecx, [ebp + 0x1c]
push ecx
push eax
call fcn.0042cb3f
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401330
lea ecx, [ebp]
push esi
push 1
call fcn.00401330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x228
leave
ret
push esi
mov esi, ecx
call fcn.00410fba
mov ecx, esi
call fcn.0041128a
mov ecx, esi
call fcn.00411184
mov ecx, esi
pop esi
jmp 0x4118b0
Function at 0x416789
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x1c
mov eax, 0x4bd54b
call fcn.004603b7
xor esi, esi
push esi
push 0x10
lea eax, [ebp + 0x38]
push eax
push esi
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.00401130
push esi
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], esi
mov dword [ebp + 0x34], 7
call fcn.004016b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044ed87
push str..lnk
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00401f50
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x416807
lea eax, [ebp + 4]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0044ee15
cmp eax, esi
je 0x416877
lea ecx, [ebp - 0x28]
call fcn.0044eb2f
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.0044ed4a
test eax, eax
jne 0x416873
mov eax, dword [ebp - 0x28]
push 0x10
lea ecx, [ebp - 0x28]
call dword [eax + 0x38]
test eax, eax
jne 0x416873
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044f0e9
push dword [eax]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.00401300
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00404ff6
cmp dword [ebp + 0x30], esi
je 0x416873
lea eax, [ebp + 0x1c]
push eax
mov ecx, ebx
call fcn.00416734
cmp edi, esi
jne 0x416815
mov ecx, ebx
call fcn.004336e4
xor edi, edi
test eax, eax
jne 0x4168cb
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044edad
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401330
push esi
push 1
lea ecx, [ebp]
call fcn.00401330
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x244
leave
ret
inc edi
jmp 0x416884
Function at 0x4168ce
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x1c
mov eax, 0x4bd503
call fcn.004603b7
push 7
pop edi
mov ebx, ecx
xor esi, esi
push esi
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], edi
call fcn.004016b0
push 0x206
lea eax, [ebp + 0x3a]
push esi
push eax
mov dword [ebp - 4], esi
mov word [ebp + 0x38], si
call fcn.0045fa70
add esp, 0xc
push esi
push 0x1a
lea eax, [ebp + 0x38]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x416960
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401330
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x244
leave
ret
lea eax, [ebp + 0x38]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.0045fd1a
pop ecx
pop ecx
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00401300
push esi
lea ecx, [ebp]
mov dword [ebp + 0x18], edi
call fcn.004016b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044ed87
push str..lnk
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.00401f50
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x4169b1
lea eax, [ebp + 0x20]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0044ee15
cmp eax, esi
je 0x416a21
lea ecx, [ebp - 0x28]
call fcn.0044eb2f
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.0044ed4a
test eax, eax
jne 0x416a1d
mov eax, dword [ebp - 0x28]
push 0x10
lea ecx, [ebp - 0x28]
call dword [eax + 0x38]
test eax, eax
jne 0x416a1d
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044f0e9
push dword [eax]
lea ecx, [ebp]
mov byte [ebp - 4], 3
call fcn.00401300
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00404ff6
cmp dword [ebp + 0x14], esi
je 0x416a1d
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.00416734
cmp edi, esi
jne 0x4169bf
mov ecx, ebx
call fcn.004336e4
xor edi, edi
test eax, eax
jne 0x416a57
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044edad
push esi
push 1
lea ecx, [ebp]
call fcn.00401330
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401330
mov eax, edi
jmp 0x41693d
inc edi
jmp 0x416a2e
Function at 0x416a5a
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x1c
mov eax, 0x4bd54b
call fcn.004603b7
xor esi, esi
push esi
push 0x17
lea eax, [ebp + 0x38]
push eax
push esi
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.00401130
push esi
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], esi
mov dword [ebp + 0x34], 7
call fcn.004016b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044ed87
push str..lnk
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00401f50
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x416ad8
lea eax, [ebp + 4]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0044ee15
cmp eax, esi
je 0x416b48
lea ecx, [ebp - 0x28]
call fcn.0044eb2f
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.0044ed4a
test eax, eax
jne 0x416b44
mov eax, dword [ebp - 0x28]
push 0x10
lea ecx, [ebp - 0x28]
call dword [eax + 0x38]
test eax, eax
jne 0x416b44
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044f0e9
push dword [eax]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.00401300
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00404ff6
cmp dword [ebp + 0x30], esi
je 0x416b44
lea eax, [ebp + 0x1c]
push eax
mov ecx, ebx
call fcn.00416734
cmp edi, esi
jne 0x416ae6
mov ecx, ebx
call fcn.004336e4
xor edi, edi
test eax, eax
jne 0x416b9c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044edad
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401330
push esi
push 1
lea ecx, [ebp]
call fcn.00401330
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x244
leave
ret
inc edi
jmp 0x416b55
Function at 0x416de6
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x1c
mov eax, 0x4bd54b
call fcn.004603b7
xor esi, esi
push esi
push 0x1a
lea eax, [ebp + 0x38]
push eax
push esi
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x416e43
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x244
leave
ret
lea eax, [ebp + 0x38]
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
push eax
call fcn.0045fd1a
pop ecx
pop ecx
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.00401130
push esi
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], esi
mov dword [ebp + 0x34], 7
call fcn.004016b0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044ed87
push str..lnk
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00401f50
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x416e9b
lea eax, [ebp + 4]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0044ee15
cmp eax, esi
je 0x416f0b
lea ecx, [ebp - 0x28]
call fcn.0044eb2f
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.0044ed4a
test eax, eax
jne 0x416f07
mov eax, dword [ebp - 0x28]
push 0x10
lea ecx, [ebp - 0x28]
call dword [eax + 0x38]
test eax, eax
jne 0x416f07
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0044f0e9
push dword [eax]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.00401300
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00404ff6
cmp dword [ebp + 0x30], esi
je 0x416f07
lea eax, [ebp + 0x1c]
push eax
mov ecx, ebx
call fcn.00416734
cmp edi, esi
jne 0x416ea9
mov ecx, ebx
call fcn.004336e4
xor edi, edi
test eax, eax
jne 0x416f41
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044edad
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401330
push esi
push 1
lea ecx, [ebp]
call fcn.00401330
mov eax, edi
jmp 0x416e20
inc edi
jmp 0x416f18
Function at 0x41a1ab
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x412]
push ebx
push eax
mov word [ebp - 0x414], bx
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x414]
push str.SCConfig.exe
push eax
call fcn.0045fd1a
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
jne 0x41a32c
push edi
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd44
mov ebx, str.SCPower32.exe
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0045fd1a
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x41a2b1
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6e0
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x20c]
push str.Back_
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0045fd1a
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042d0a3
test eax, eax
lea eax, [ebp - 0x20c]
push eax
je 0x41a2e3
call esi
test eax, eax
je 0x41a32c
lea eax, [ebp - 0x20c]
push str._RecoverInstallFile
push eax
call fcn.0042c7fd
pop ecx
pop ecx
jmp 0x41a32c
call esi
test eax, eax
je 0x41a32c
and word [ebp - 0x61c], 0
push edi
lea eax, [ebp - 0x61a]
push 0
push eax
call fcn.0045fa70
push str._RecoverInstallFile
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push str.__s___s
push eax
call fcn.00460936
lea eax, [ebp - 0x61c]
push eax
call fcn.0042d648
add esp, 0x20
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
leave
ret

Function at 0x41a881
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x41a8ea
push esi
push 0x10020
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x41a8be
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x41a8e9
push ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
xor eax, eax
test ebx, ebx
setne al
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x41a8ef
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a970
push esi
lea eax, [ebp - 4]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloudInput
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41a970
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x104
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41a966
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], esi
je 0x41a970
push dword [ebp - 8]
call edi
pop edi
pop esi
leave
ret 8
Function at 0x41a976
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x40
mov eax, 0x4bdaf6
call fcn.004603b7
mov eax, dword [ebp + 0x218]
mov ebx, dword [ebp + 0x214]
xor esi, esi
push 0x206
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 2]
push esi
push eax
mov word [ebp], si
call fcn.0045fa70
push str.SmartCloud
lea eax, [ebp]
push 0x4c3d68
push eax
call fcn.00460936
add esp, 0x18
lea ecx, [ebp - 0x4c]
call fcn.004070ea
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], esi
call fcn.004070c1
test eax, eax
je 0x41aa61
lea eax, [ebp - 0x14]
push eax
mov edi, 0xf013f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41aaca
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push esi
push esi
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x41aa37
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41aaca
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x28], 0x104
push esi
push esi
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
jmp 0x41aac8
lea eax, [ebp - 0x10]
push eax
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41aaca
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push esi
push esi
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x41aaa0
push dword [ebp - 0x10]
jmp 0x41aa2c
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0x104
push esi
push esi
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00406fe4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x20c
leave
ret 8
Function at 0x41aafb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, 0xf003f
push esi
xor edi, edi
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ab67
push edi
lea eax, [ebp - 8]
push eax
push edi
push esi
push edi
push edi
push edi
push str.SmartCloudInput
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ab67
push 0x104
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], edi
je 0x41ab67
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret 8

Function at 0x41ab6d
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x4bdb26
call fcn.004603b7
lea ecx, [ebp - 0x40]
call fcn.004070ea
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.004070c1
test eax, eax
je 0x41ac06
lea eax, [ebp - 0x10]
push eax
mov edi, 0xf013f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41ac6d
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloud
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x41abdf
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41ac6d
push 0x104
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
jmp 0x41ac6b
lea eax, [ebp - 0x14]
push eax
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41ac6d
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push esi
push esi
push esi
push str.SmartCloud
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x41ac46
push dword [ebp - 0x14]
jmp 0x41abd4
push 0x104
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406fe4
call fcn.0046048f
ret 8
Function at 0x41ac81
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x38
mov eax, 0x4bdb49
call fcn.004603b7
mov eax, dword [ebp + 0x218]
mov ebx, dword [ebp + 0x214]
xor esi, esi
push 0x206
mov dword [ebp - 0x18], eax
lea eax, [ebp + 2]
push esi
push eax
mov word [ebp], si
call fcn.0045fa70
push str.SmartCloud
lea eax, [ebp]
push str._sService
push eax
call fcn.00460936
add esp, 0x18
lea ecx, [ebp - 0x44]
call fcn.004070ea
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], esi
call fcn.004070c1
test eax, eax
je 0x41ad67
lea eax, [ebp - 0x14]
push eax
mov edi, 0xf013f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41adcb
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push esi
push esi
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x41ad42
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41adcb
push 0x104
push dword [ebp - 0x18]
push 1
push esi
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
jmp 0x41adc9
lea eax, [ebp - 0x10]
push eax
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41adcb
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push esi
push esi
push esi
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x41ada6
push dword [ebp - 0x10]
jmp 0x41ad37
push 0x104
push dword [ebp - 0x18]
push 1
push esi
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00406fe4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x20c
leave
ret 8