joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b60f
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4645c0]
mov esi, ecx
push 0x411
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x160]
call fcn.0043ee5c
mov ebx, 0x423
push ebx
push dword [esi + 4]
call edi
push 0xfffffffffffffffc
push eax
call dword [0x4645c4]
push ebx
mov dword [esi + 0xa8], eax
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x78]
call fcn.0040f066
mov ebx, dword [0x464580]
push 0
mov ebp, 0xd00
push 0x2e3
push ebp
push dword [esi + 4]
call ebx
push 0x422
mov dword [esi + 0xa4], eax
push dword [esi + 4]
call edi
push 0xfffffffffffffffc
push eax
call dword [0x4645c4]
push 0x422
mov dword [esi + 0xdc], eax
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0xac]
call fcn.0040f066
push 0
push 0x2e4
push ebp
push dword [esi + 4]
call ebx
push 0x3f3
mov dword [esi + 0xd8], eax
push dword [esi + 4]
call edi
push 0xfffffffffffffffc
push eax
call dword [0x4645c4]
push 0x3f3
mov dword [esi + 0x110], eax
push dword [esi + 4]
mov dword [esp + 0x18], eax
call edi
push eax
lea ecx, [esi + 0xe0]
call fcn.0040f066
push 0
push 0x2f5
push ebp
push dword [esi + 4]
call ebx
push 5
mov dword [esi + 0x10c], eax
push dword [esi + 0xe4]
call dword [0x464588]
mov eax, dword [esp + 0x10]
push 0x3f8
mov dword [esi + 0x144], eax
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x114]
call fcn.0040f066
push 0
push 0x306
push ebp
push dword [esi + 4]
call ebx
push 0x3f4
mov dword [esi + 0x140], eax
push dword [esi + 4]
call edi
lea ebx, [esi + 0x17c]
push eax
mov ecx, ebx
call fcn.0043cb41
push 0x3f6
push dword [esi + 4]
call edi
push eax
mov ecx, ebx
call fcn.0043cb41
push 0x3f7
push dword [esi + 4]
call edi
push eax
mov ecx, ebx
call fcn.0043cb41
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x42b983
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [0x464588]
xor ebx, ebx
lea esi, [ebp + 4]
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x42b99f
xor eax, eax
jmp 0x42b9a7
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jge 0x42b9ea
push ebx
mov ecx, esi
call fcn.0042ba3f
mov ecx, dword [esp + 0x14]
push ebx
cmp ecx, dword [eax]
mov ecx, esi
jne 0x42b9d7
call fcn.0042ba3f
mov eax, dword [eax]
push 5
add eax, 4
push dword [eax]
call edi
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x14], eax
jmp 0x42b9e7
call fcn.0042ba3f
mov eax, dword [eax]
push 0
add eax, 4
push dword [eax]
call edi
inc ebx
jmp 0x42b994
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x42c771
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
je 0x42c7b6
mov edi, dword [ebp + 0xc]
push str.user32.dll
mov dword [edi], esi
call dword [0x464238]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x42c7b6
push str.PrivateExtractIconsW
push eax
call dword [0x46423c]
mov ebx, eax
cmp ebx, esi
jne 0x42c7bd
push dword [ebp - 8]
call dword [0x464240]
xor eax, eax
jmp 0x42c883
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
push dword [ebp + 8]
call ebx
cmp eax, esi
je 0x42c808
push esi
push 1
lea eax, [ebp - 4]
push esi
push eax
push 0x20
push 0x20
push esi
push dword [ebp + 8]
call ebx
cmp eax, 1
jne 0x42c7f1
mov eax, dword [ebp - 4]
mov dword [edi], eax
jmp 0x42c873
push 1
lea eax, [ebp - 4]
push esi
push eax
push esi
push dword [ebp + 8]
call dword [0x464404]
test eax, eax
je 0x42c873
jmp 0x42c7e7
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x29
push esi
call dword [0x464408]
test eax, eax
jl 0x42c870
lea eax, [ebp - 0x210]
push str.shell32.dll
push eax
call dword [0x46444c]
test eax, eax
je 0x42c870
push esi
push 1
lea eax, [ebp - 4]
push esi
push eax
push 0x20
push 0x20
lea eax, [ebp - 0x210]
push 2
push eax
call ebx
cmp eax, 1
jne 0x42c870
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
push dword [ebp - 8]
call dword [0x464240]
xor eax, eax
cmp dword [edi], esi
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42ed51
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
mov esi, 0x104
push edi
lea eax, [ebp - 0x208]
push esi
push eax
push 0
call dword [0x464234]
test eax, eax
je 0x42ef04
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0040dea2
mov edi, dword [0x464334]
lea eax, [ebp - 0x208]
push 0x5c
push eax
call edi
and word [eax + 2], 0
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push str.efiproc.dll
push esi
push eax
call fcn.0040dee4
mov ebx, dword [0x464440]
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
jne 0x42ee10
lea eax, [ebp - 0x208]
push 0x5c
push eax
call edi
and word [eax], 0
lea eax, [ebp - 0x208]
push 0x5c
push eax
call edi
and word [eax + 2], 0
add esp, 0x10
lea eax, [ebp - 0x208]
push str.efiproc.dll
push esi
push eax
call fcn.0040dee4
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
je 0x42ef04
lea eax, [ebp - 0x618]
push esi
push eax
call dword [0x4641d0]
test eax, eax
je 0x42ef04
push str.Driversefimon.sys
lea eax, [ebp - 0x618]
push esi
push eax
call fcn.0040dee4
lea eax, [ebp - 0x410]
push 0x5c
push eax
call edi
and word [eax + 2], 0
pop ecx
pop ecx
lea eax, [ebp - 0x410]
push str.efimon.sys
push esi
push eax
call fcn.0040dee4
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
jne 0x42eeaa
lea eax, [ebp - 0x410]
push 0x5c
push eax
call edi
and word [eax], 0
lea eax, [ebp - 0x410]
push 0x5c
push eax
call edi
and word [eax + 2], 0
add esp, 0x10
lea eax, [ebp - 0x410]
push str.efimon.sys
push esi
push eax
call fcn.0040dee4
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
je 0x42ef04
lea eax, [ebp - 0x618]
push 0
push eax
lea eax, [ebp - 0x410]
push eax
call dword [0x46410c]
lea eax, [ebp - 0x208]
push eax
call dword [0x464238]
mov esi, eax
test esi, esi
je 0x42ef04
push str.EfiLoadBitmap
push esi
call dword [0x46423c]
test eax, eax
je 0x42eefd
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
add esp, 0x1c
push esi
call dword [0x464240]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ef2e
Capabilities:
Check if file exists
Create service
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
xor esi, esi
push 1
push esi
mov ebx, 0x80000002
push str.SYSTEM
mov edi, ecx
push ebx
call dword [0x464018]
test eax, eax
jne 0x42ef6c
push dword [ebp - 0xc]
call dword [0x464004]
push dword [ebp - 0xc]
call dword [0x464020]
mov eax, dword [edi + 0x1c]
cmp dword [eax - 8], esi
je 0x42f025
mov eax, dword [edi + 0x18]
cmp dword [eax - 8], esi
je 0x42f025
mov eax, dword [edi + 0x20]
cmp dword [eax - 8], esi
je 0x42f025
push dword [edi + 0x18]
lea eax, [ebp - 0x21c]
push str.SYSTEMCurrentControlSetServices_s
push 0x208
push eax
call fcn.004147ef
add esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0xf003f
push esi
push esi
lea eax, [ebp - 0x21c]
push esi
push eax
push ebx
call dword [0x464008]
cmp eax, esi
jne 0x42efff
mov ebx, dword [ebp - 8]
push str.DeleteFlag
push ebx
mov dword [ebp - 4], ebx
call dword [0x46401c]
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push str.Start
push ebx
mov dword [ebp - 8], esi
call dword [0x46400c]
mov ecx, edi
call fcn.0042ea3f
test eax, eax
jne 0x42f082
push dword [edi + 0x1c]
call dword [0x464440]
test eax, eax
jne 0x42f02c
cmp dword [ebp - 4], esi
je 0x42f025
push dword [ebp - 4]
call dword [0x464020]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0xf003f
push esi
push esi
call dword [0x46402c]
mov ebx, eax
cmp ebx, esi
je 0x42f017
mov edi, dword [edi + 0x18]
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
push str.Base
push str.SystemRoot_system32drivers360AntiARP.sys
push 1
push esi
push 1
push 0xf01ff
push edi
push edi
push ebx
mov dword [ebp - 0x10], esi
call dword [0x464010]
cmp eax, esi
jne 0x42f076
push ebx
call dword [0x464034]
jmp 0x42f017
mov edi, dword [0x464034]
push eax
call edi
push ebx
call edi
cmp dword [ebp - 4], esi
je 0x42f090
push dword [ebp - 4]
call dword [0x464020]
push 1
pop eax
jmp 0x42f027
Function at 0x42f3cc
Capabilities:
Check if file exists
Hide graphical window
Query or enumerate registry value

Disassembly:
mov eax, 0x4620ac
call fcn.00452e40
sub esp, 0x214
push ebx
push esi
mov esi, dword [0x46458c]
push edi
mov edi, str.Q360SafeMainClass
push 0
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x42f428
push 9
push ebx
call dword [0x464588]
push ebx
call dword [0x464584]
cmp dword [ebp + 8], 0
jbe 0x42f4e4
push 0x168
push dword [ebp + 8]
push 0x52c
push ebx
call dword [0x46457c]
jmp 0x42f4e4
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x104
and dword [ebp - 4], 0
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
lea ecx, [ebp - 0x10]
call fcn.0042f509
test eax, eax
jne 0x42f4e9
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push eax
push dword [ebp - 0x10]
call dword [section..rdata]
test eax, eax
jne 0x42f4e9
lea eax, [ebp - 0x220]
push eax
call dword [0x464440]
test eax, eax
je 0x42f4e9
mov ebx, 0x3e8
xor eax, eax
push ebx
push eax
lea ecx, [ebp - 0x220]
push eax
push ecx
push eax
call fcn.0042f547
add esp, 0x14
and dword [ebp - 0x14], 0
push 0
push edi
call esi
inc dword [ebp - 0x14]
test eax, eax
jne 0x42f4c1
push ebx
call dword [0x4641b8]
cmp dword [ebp - 0x14], 0xa
jl 0x42f4a6
jmp 0x42f4d5
push 0x168
push dword [ebp + 8]
push 0x52c
push eax
call dword [0x46457c]
cmp dword [ebp - 0x10], 0
je 0x42f4e4
push dword [ebp - 0x10]
call dword [0x464020]
push 1
pop eax
jmp 0x42f4fa
cmp dword [ebp - 0x10], 0
je 0x42f4f8
push dword [ebp - 0x10]
call dword [0x464020]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42f547
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
xor edi, edi
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.00452e6c
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], eax
call fcn.0042f5c8
neg eax
sbb eax, eax
mov dword [ebp - 0x20], 1
and eax, str.runas
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call dword [0x46440c]
test eax, eax
je 0x42f5c3
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [0x464200]
push dword [ebp - 4]
call dword [0x464280]
push 1
pop edi
mov eax, edi
pop edi
leave
ret

Function at 0x42f686
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push 0
push eax
call dword [0x464610]
test eax, eax
je 0x42f6a0
test byte [ebp - 4], 7
jne 0x42f6a4
xor eax, eax
leave
ret
push 1
pop eax
leave
ret
Function at 0x431777
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 2
call fcn.00405e3a
cmp eax, 3
pop ecx
jne 0x43178f
push 1
pop eax
leave
ret
push 4
pop ecx
cmp eax, ecx
jne 0x43179a
xor eax, eax
leave
ret
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.NoNotiLeak
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 4], 1
setne al
leave
ret

Function at 0x4317d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 3
call fcn.00405e3a
cmp eax, 3
pop ecx
jne 0x4317e8
push 1
pop eax
leave
ret
push 4
pop ecx
cmp eax, ecx
jne 0x4317f3
xor eax, eax
leave
ret
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.UDiskAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
leave
ret

Function at 0x43182b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x43
call dword [0x464578]
cmp eax, 1
je 0x431853
cmp eax, 2
je 0x431853
push 4
call fcn.00405e3a
cmp eax, 3
pop ecx
jne 0x43184e
push 1
pop eax
ret
cmp eax, 4
jne 0x431856
xor eax, eax
ret
jmp fcn.0043185b

Function at 0x431d1b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 1
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push 0x4721dc
call fcn.004026c2
call fcn.00431de6
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
je 0x431dda
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 8]
je 0x431d59
push ebx
push esi
push 7
call fcn.0040d2e2
add esp, 0xc
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edi], ebx
mov dword [eax], ebx
call fcn.00405ce1
mov ebx, eax
test ebx, ebx
je 0x431dda
and dword [ebp + 0x14], 0
test esi, esi
je 0x431d7d
mov dword [ebp + 0x14], 1
lea eax, [ebp + 0x14]
push 4
push eax
push 4
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
neg esi
sbb esi, esi
push edi
and esi, 0xfffffffe
push 0x3a98
push 1
add esi, 0x6e
push 0x168
push esi
push 0x418
push ebx
call dword [0x4645b8]
test eax, eax
jne 0x431de1
and dword [edi], eax
call dword [0x464288]
cmp eax, 0x5b4
jne 0x431dda
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 1
pop eax
jmp 0x431ddc
Function at 0x431fba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov dword [ebx], esi
mov dword [eax], esi
call fcn.00405ce1
cmp eax, esi
mov dword [ebp - 4], eax
je 0x432041
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 8]
push 1
test esi, esi
pop edi
je 0x431fe9
mov dword [ebp + 0x10], edi
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
neg esi
sbb esi, esi
push ebx
and esi, 0xfffffffe
push 0x3a98
push edi
add esi, 0x6e
push 0x168
push esi
push 0x417
push dword [ebp - 4]
call dword [0x4645b8]
test eax, eax
jne 0x432048
call dword [0x464288]
cmp eax, 0x5b4
jne 0x432041
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, edi
jmp 0x432043

Function at 0x43204c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
push edi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 8], esp
push 0x4721f8
call fcn.004026c2
call fcn.00431de6
pop ecx
cmp eax, esi
pop ecx
je 0x432137
cmp dword [ebp + 0x10], esi
je 0x432089
push esi
push dword [ebp + 8]
push 5
call fcn.0040d2e2
add esp, 0xc
push 4
lea eax, [ebp - 4]
pop ebx
mov dword [ebp + 0x10], esi
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov edi, str.SOFTWARE360Safe_safemon
push str.NewExec
mov esi, 0x80000002
push edi
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [0x464438]
xor eax, eax
cmp dword [ebp + 0x10], eax
je 0x4320c4
cmp dword [ebp + 8], eax
jne 0x432106
cmp dword [ebp + 8], eax
mov dword [ebp + 0x10], eax
je 0x4320d3
mov dword [ebp + 0x10], 1
lea eax, [ebp + 0x10]
push ebx
push eax
push ebx
push str.ExecAccess
push edi
push esi
call dword [0x464444]
mov eax, dword [ebp + 8]
push 0
neg eax
sbb eax, eax
and al, 0xfe
add eax, 0x6b
push eax
call fcn.0040718d
push 0
push 0x65
call fcn.0040718d
add esp, 0x10
call fcn.0040bd94
test eax, eax
jne 0x43213b
push 1
push 0x301
call fcn.00432143
pop ecx
test eax, eax
pop ecx
je 0x432137
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004321cd
add esp, 0xc
test eax, eax
jne 0x43213b
xor eax, eax
jmp 0x43213e
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4321cd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov dword [ebx], esi
mov dword [eax], esi
call fcn.00405ce1
cmp eax, esi
mov dword [ebp - 4], eax
je 0x432254
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 8]
push 1
test esi, esi
pop edi
je 0x4321fc
mov dword [ebp + 0x10], edi
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
neg esi
sbb esi, esi
push ebx
and esi, 0xfffffffe
push 0x3a98
push edi
add esi, 0x6e
push 0x168
push esi
push 0x41c
push dword [ebp - 4]
call dword [0x4645b8]
test eax, eax
jne 0x43225b
call dword [0x464288]
cmp eax, 0x5b4
jne 0x432254
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, edi
jmp 0x432256
Function at 0x432fe5
Capabilities:
Set registry value

Disassembly:
mov eax, 0x46237e
call fcn.00452e40
sub esp, 0x134
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
push ebx
lea ecx, [edi + 0xb0]
call fcn.00435dac
mov esi, dword [eax]
lea ecx, [ebp - 0x10]
call fcn.0043bf7f
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0043c10d
test eax, eax
jne 0x4331c0
lea ecx, [ebp - 0x10]
call fcn.0043c27c
test eax, eax
jne 0x4331c0
push 1
push 0x4721dc
push 7
mov ecx, edi
call fcn.00432f62
test eax, eax
je 0x433269
cmp dword [esi], ebx
je 0x43311b
lea ecx, [ebp - 0x140]
call fcn.0043863f
mov byte [ebp - 4], 2
call fcn.0040bd94
push ebx
push dword [edi + 0x70]
test eax, eax
jne 0x4330a0
push 0x4751e8
push 0x4751d0
push 0x47199c
lea ecx, [ebp - 0x140]
call fcn.00439269
push 0x4751bc
lea ecx, [ebp - 0x140]
call fcn.004391c5
jmp 0x4330ba
push 0x4751bc
push 0x475188
push 0x47199c
lea ecx, [ebp - 0x140]
call fcn.00439269
push 0xa0
push 0x190
lea ecx, [ebp - 0x140]
call fcn.00439321
call dword [0x464488]
mov edi, eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push edi
push 9
push eax
call dword [0x464574]
cmp eax, 2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x140]
je 0x433264
call fcn.0043891c
xor eax, eax
cmp dword [esi], ebx
lea ecx, [ebp - 0x1c]
push 1
push ecx
lea ecx, [ebp - 0x20]
sete al
push ecx
push eax
mov dword [esi], eax
call fcn.00431d1b
mov edi, dword [esi]
add esp, 0x10
call fcn.00405c1a
cmp eax, edi
je 0x43315e
xor eax, eax
cmp edi, ebx
sete al
push eax
mov dword [esi], eax
push dword [ebp - 0x1c]
push 7
call fcn.0043225f
add esp, 0xc
jmp 0x433269
cmp edi, ebx
jne 0x43316a
push 3
call fcn.0040dce4
pop ecx
xor eax, eax
cmp dword [esi], ebx
je 0x433173
push 1
pop eax
cmp eax, ebx
mov dword [ebp - 0x18], ebx
je 0x433181
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0x471680
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
mov ecx, dword [ebp - 0x14]
push esi
call fcn.0043259d
push 1
push ebx
push dword [esi + 8]
call dword [0x464520]
mov ecx, dword [ebp - 0x14]
call fcn.00434243
jmp 0x433269
lea ecx, [ebp - 0x140]
call fcn.0043863f
push 0x47be6c
push 0x471990
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 1
call fcn.004392d8
cmp dword [esi], ebx
push 4
push ebx
je 0x4331f7
push 0x475158
push 0x47511c
jmp 0x433201
push 0x4750ec
push 0x4750b0
push 0x47199c
lea ecx, [ebp - 0x140]
call fcn.00439269
push 0x96
push 0x1c2
lea ecx, [ebp - 0x140]
call fcn.00439321
call dword [0x464488]
mov esi, eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push esi
push 9
push eax
call dword [0x464574]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x140]
call fcn.0043891c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043bfa4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x433566
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x433580
push 0
push esi
push 2
call fcn.0040d2e2
add esp, 0xc
and dword [ebp + 0xc], 0
test esi, esi
jne 0x43358f
mov dword [ebp + 0xc], 1
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push str.NoNotiLeak
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
neg esi
sbb esi, esi
push 0
and esi, 0xfffffffe
add esi, 0x76
push esi
call fcn.0040718d
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x4339ca
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4623fa
call fcn.00452e40
sub esp, 0x130
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0xb4]
lea ecx, [edi + 0xb0]
cmp eax, ebx
je 0x433a01
mov edx, dword [ecx + 8]
sub edx, eax
and edx, 0xfffffffc
cmp edx, 8
jg 0x433a09
push 1
pop eax
jmp 0x433c46
push 2
call fcn.00435dac
mov esi, dword [eax]
push 1
push 0x4721ec
push 6
mov ecx, edi
call fcn.00432f62
test eax, eax
je 0x433c44
lea ecx, [ebp - 0x10]
call fcn.0043bf7f
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0043c10d
test eax, eax
jne 0x433b8f
lea ecx, [ebp - 0x10]
call fcn.0043c27c
test eax, eax
jne 0x433b8f
cmp dword [esi], ebx
je 0x433aea
lea ecx, [ebp - 0x13c]
call fcn.0043863f
push ebx
push 1
push 0x4751bc
push 0x4754f8
push 0x47199c
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 2
call fcn.00439269
push 0xa0
push 0x190
lea ecx, [ebp - 0x13c]
call fcn.00439321
call dword [0x464488]
mov edi, eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push edi
push 9
push eax
call dword [0x464574]
cmp eax, 2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x13c]
je 0x433c33
call fcn.0043891c
xor eax, eax
cmp dword [esi], ebx
push 1
sete al
mov dword [esi], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ebx
push dword [esi]
call fcn.00431f68
mov edi, dword [esi]
add esp, 0xc
call fcn.0040aeb1
cmp eax, edi
je 0x433b2d
xor eax, eax
cmp edi, ebx
sete al
push eax
mov dword [esi], eax
push dword [ebp - 0x1c]
push 6
call fcn.0043225f
add esp, 0xc
jmp 0x433c38
cmp edi, ebx
jne 0x433b39
push 1
call fcn.0040dce4
pop ecx
xor eax, eax
cmp dword [esi], ebx
je 0x433b42
push 1
pop eax
cmp eax, ebx
mov dword [ebp - 0x14], ebx
je 0x433b50
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0x471b60
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
mov ecx, dword [ebp - 0x18]
push esi
call fcn.0043259d
push 1
push ebx
push dword [esi + 8]
call dword [0x464520]
mov ecx, dword [ebp - 0x18]
call fcn.00434243
jmp 0x433c38
lea ecx, [ebp - 0x13c]
call fcn.0043863f
push 0x47be6c
push 0x471990
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 1
call fcn.004392d8
cmp dword [esi], ebx
push 4
push ebx
je 0x433bc6
push 0x475158
push 0x4754c0
jmp 0x433bd0
push 0x4750ec
push 0x475488
push 0x47199c
lea ecx, [ebp - 0x13c]
call fcn.00439269
push 0x96
push 0x1c2
lea ecx, [ebp - 0x13c]
call fcn.00439321
call dword [0x464488]
mov esi, eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push esi
push 9
push eax
call dword [0x464574]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x13c]
call fcn.0043891c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043bfa4
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10