joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d420
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x49d449
xor eax, eax
jmp 0x49d679
push 0x517ea8
lea ecx, [ebp - 0x42c]
call fcn.0040f510
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x42c]
call fcn.0040e800
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x430], 0
lea edx, [ebp - 0x408]
mov dword [ebp - 0x41c], edx
lea ecx, [ebp - 0x420]
call fcn.00418350
push 0x400
push 0x400
lea ecx, [ebp - 0x420]
call fcn.00416ee0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x424], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x420]
call fcn.00418620
cmp dword [ebp - 0x424], 0
jbe 0x49d525
push str.DeviceHarddisk
call fcn.004ebfed
add esp, 4
push eax
push str.DeviceHarddisk
lea ecx, [ebp - 0x420]
call fcn.0044ea20
push eax
call fcn.004ec31c
add esp, 0xc
test eax, eax
je 0x49d525
mov dword [ebp - 0x434], 0
lea ecx, [ebp - 0x420]
call fcn.004335b0
lea ecx, [ebp - 0x42c]
call fcn.004335b0
mov eax, dword [ebp - 0x434]
jmp 0x49d679
push 0
push 0x80
push 3
push 0
push 1
push 0x20000
lea ecx, [ebp - 0x42c]
call fcn.0044ea20
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0xffffffff
jne 0x49d583
mov dword [ebp - 0x438], 0
lea ecx, [ebp - 0x420]
call fcn.004335b0
lea ecx, [ebp - 0x42c]
call fcn.004335b0
mov eax, dword [ebp - 0x438]
jmp 0x49d679
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 4], 0x400
push 0
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x41c]
push edx
push 0xc
lea eax, [ebp - 0x418]
push eax
push 0x2d1400
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x49d612
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x43c], 1
lea ecx, [ebp - 0x420]
call fcn.004335b0
lea ecx, [ebp - 0x42c]
call fcn.004335b0
mov eax, dword [ebp - 0x43c]
jmp 0x49d679
mov byte [ebp - 0x425], 1
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x444], ecx
cmp dword [ebp - 0x444], 4
je 0x49d63c
cmp dword [ebp - 0x444], 7
je 0x49d63c
jmp 0x49d643
mov byte [ebp - 0x425], 0
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x425]
mov dword [ebp - 0x440], eax
lea ecx, [ebp - 0x420]
call fcn.004335b0
lea ecx, [ebp - 0x42c]
call fcn.004335b0
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x49e150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
cmp dword [ebp + 8], 0
je 0x49e175
cmp dword [ebp + 0xc], 0
jne 0x49e179
xor eax, eax
jmp 0x49e1cd
mov dword [ebp - 0x21c], 1
xor eax, eax
mov word [ebp - 0x218], ax
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004ebd80
add esp, 0xc
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 8

Function at 0x49e1e0
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1_
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49e22a
xor eax, eax
jmp 0x49e2e6
push 0
push 0x80080000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49e25d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x49e2e6
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 4
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x20000013
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
cmp dword [ebp - 4], 0xc8
jb 0x49e2d0
cmp dword [ebp - 4], 0x12b
ja 0x49e2d0
mov byte [ebp - 0x418], 0
push 0x3ff
push 0
lea eax, [ebp - 0x417]
push eax
call fcn.004ebd80
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0x400
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4
Function at 0x49e480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc48], 0
jne 0x49e509
mov ecx, dword [ebp - 8]
add ecx, 0x442
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49e4fc
push str..exe
mov edx, dword [ebp - 4]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
je 0x49e4ed
push str..dll
mov eax, dword [ebp - 4]
push eax
call fcn.004ec19f
add esp, 8
test eax, eax
je 0x49e4ed
push str..tpi
mov ecx, dword [ebp - 4]
push ecx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x49e4fc
mov edx, dword [ebp - 8]
mov dword [edx + 0xc48], 1
jmp 0x49e509
mov eax, dword [ebp - 8]
mov dword [eax + 0xc48], 2
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0xc44], 0xffffffff
je 0x49e52f
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x42]
test eax, eax
je 0x49e52a
push 0
mov ecx, dword [ebp - 8]
call fcn.0049e650
jmp 0x49e5d9
mov ecx, dword [ebp - 8]
add ecx, 0x442
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49e555
mov edx, dword [ebp - 8]
mov dword [edx + 0xc44], 1
jmp 0x49e5d9
mov eax, dword [ebp - 8]
add eax, 0xc44
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x442
push ecx
mov ecx, dword [ebp - 8]
call fcn.0049e5e0
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc44], 0xffffffff
je 0x49e57e
jmp 0x49e5d9
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x842]
test ecx, ecx
jne 0x49e5a4
push 1
mov ecx, dword [ebp - 8]
call fcn.0049e650
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc44], 0xffffffff
je 0x49e5a4
jmp 0x49e5d9
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x42]
test edx, edx
je 0x49e5d9
mov eax, dword [ebp - 8]
add eax, 0x42
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x842
push ecx
call fcn.0043f9a0
add esp, 8
test eax, eax
jge 0x49e5d9
mov edx, dword [ebp - 8]
mov dword [edx + 0xc44], 0
mov esp, ebp
pop ebp
ret
Function at 0x49e650
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0xc48], 1
jne 0x49e7b9
push 0x538e3c
push 0x4000
call fcn.004ef666
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x49e68f
jmp 0x49e7fd
push 0x4000
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x442
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49e6c4
cmp dword [ebp - 0xc], 3
jbe 0x49e6f0
movzx edx, byte [ebp + 8]
test edx, edx
je 0x49e6d9
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc44], 4
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004ec873
add esp, 4
jmp 0x49e7fd
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 0x24]
add edx, 0x442
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49e7a5
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x50d6f8
mov edx, dword [ebp - 8]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49e7a5
push 0x400
push 0
mov eax, dword [ebp - 0x24]
add eax, 0x842
push eax
call fcn.004ebd80
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
push str._d._d._d._d
push 0x3ff
mov ecx, dword [ebp - 0x24]
add ecx, 0x842
push ecx
call fcn.00456320
add esp, 0x1c
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.004ec873
add esp, 4
jmp 0x49e7da
push 0x400
mov ecx, dword [ebp - 0x24]
add ecx, 0x842
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0x442
push edx
call fcn.00421000
add esp, 0xc
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x842]
test ecx, ecx
jne 0x49e7fd
movzx edx, byte [ebp + 8]
test edx, edx
je 0x49e7fd
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xc44], 3
mov esp, ebp
pop ebp
ret 4
Function at 0x49e930
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x57c], ecx
push 0x11c
push 0
lea eax, [ebp - 0x540]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x540], 0x11c
push 0x11c
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ebd80
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx], 0x11c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 5
jne 0x49e9be
mov ecx, dword [ebp - 0x57c]
call fcn.0049eb50
test eax, eax
je 0x49e9be
mov edx, dword [ebp - 0x57c]
mov dword [edx + 4], 0
mov eax, 1
jmp 0x49eb3a
lea eax, [ebp - 0x540]
push eax
mov ecx, dword [ebp - 0x57c]
call fcn.0049ec50
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0xa
mov eax, dword [ebp + 8]
add edx, dword [eax + 8]
mov dword [ebp - 0x41c], edx
mov ecx, dword [ebp - 0x53c]
imul ecx, ecx, 0xa
add ecx, dword [ebp - 0x538]
mov dword [ebp - 0x420], ecx
mov edx, dword [ebp - 0x420]
cmp edx, dword [ebp - 0x41c]
jle 0x49ea2c
push 0x11c
lea eax, [ebp - 0x540]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ef680
add esp, 0xc
mov edx, dword [ebp - 0x420]
mov dword [ebp - 0x41c], edx
xor eax, eax
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004ebd80
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x57c]
call fcn.0049eba0
test eax, eax
jl 0x49eb28
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp - 0x418]
push ecx
mov ecx, dword [ebp - 0x57c]
call fcn.0049eca0
test eax, eax
je 0x49eb28
mov edx, dword [ebp - 0x564]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
imul eax, eax, 0xa
mov ecx, dword [ebp - 0x564]
and ecx, 0xffff
movzx edx, cx
add eax, edx
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x578]
jge 0x49eb14
mov ecx, dword [ebp - 0x564]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x564]
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x560]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x57c]
mov dword [ecx + 4], 1
jmp 0x49eb21
mov edx, dword [ebp - 0x57c]
mov dword [edx + 4], 0
mov eax, 1
jmp 0x49eb3a
mov eax, dword [ebp - 0x57c]
mov dword [eax + 4], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4
Function at 0x49eca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49ed5c
push 0x10
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49ed52
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49ed52
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x49ed48
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004ec9cd
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49ed48
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004ef680
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x49edb1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x50d6f8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49eda5
mov esi, dword [ebp - 0x20]
mov ecx, 0xd
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004ec3c2
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x49ee10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x49ee1e
xor eax, eax
jmp 0x49ee94
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49ee30
xor eax, eax
jmp 0x49ee94
mov ecx, dword [ebp + 8]
push ecx
call fcn.004176a0
add esp, 4
mov dword [0x5350dc], eax
cmp dword [0x5350dc], 0
jne 0x49ee4e
xor eax, eax
jmp 0x49ee94
push str.Get360CommonInstance
mov edx, dword [0x5350dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350e0], eax
cmp dword [0x5350e0], 0
jne 0x49ee88
mov eax, dword [0x5350dc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5350e0], 0
xor eax, eax
jmp 0x49ee94
mov ecx, dword [0x5350e0]
mov dword [ebp - 4], ecx
call dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a1bc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x230], ecx
mov eax, dword [ebp - 0x230]
add eax, 0x54
push eax
lea ecx, [ebp - 8]
call fcn.0047c900
cmp dword [ebp + 0xc], 0
je 0x4a1c05
mov ecx, dword [ebp - 0x230]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [edx + 8]
call ecx
cmp dword [ebp + 8], 0
je 0x4a1c19
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test eax, eax
jne 0x4a1d29
lea ecx, [ebp - 0xc]
call fcn.00418350
call fcn.004182b0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a1cbc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [edx + 0x10]
call ecx
test eax, eax
je 0x4a1cbc
xor edx, edx
mov word [ebp - 0x220], dx
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004ebd80
add esp, 0xc
push 0
push 0x103
lea ecx, [ebp - 0x220]
push ecx
push 0x5183a8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
je 0x4a1cbc
lea eax, [ebp - 0x220]
push eax
call fcn.004ebfed
add esp, 4
test eax, eax
jbe 0x4a1cbc
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a1cbc
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0xc]
call fcn.0040f550
lea ecx, [ebp - 0xc]
call fcn.00418600
movzx eax, al
test eax, eax
je 0x4a1cf7
push 0x510d0c
lea ecx, [ebp - 0x224]
push ecx
call fcn.00493b60
mov ecx, eax
call fcn.00493db0
push eax
lea ecx, [ebp - 0xc]
call fcn.00418390
lea ecx, [ebp - 0x224]
call fcn.004335b0
lea ecx, [ebp - 0xc]
call fcn.0044ea20
push eax
mov ecx, dword [ebp - 0x230]
call fcn.004a1d60
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0xc]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.0047c940
mov eax, dword [ebp - 0x228]
jmp 0x4a1d4c
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x230]
call fcn.004a1d60
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 8]
call fcn.0047c940
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 8
Function at 0x4a32d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509e10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x533014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x28], 0x10
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x14]
push eax
push str.showTime
push str.SOFTWARE360Safe_softmgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4a33ca
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0046f220
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x48]
call fcn.0046f220
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x50]
call fcn.0046f510
lea ecx, [ebp - 0x40]
call fcn.0046f120
push eax
call fcn.004f18ee
add esp, 4
xor edx, edx
cmp eax, 7
setge dl
mov eax, edx
jmp 0x4a33dd
mov dword [ebp - 4], 0xffffffff
jmp 0x4a33d8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a4390
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp + 8]
call fcn.00418600
movzx eax, al
test eax, eax
je 0x4a43b2
mov eax, 1
jmp 0x4a458b
lea ecx, [ebp - 0x18]
call fcn.00444840
push 0x5188a4
lea ecx, [ebp - 0x2c]
call fcn.0040f510
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0049b000
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.004335b0
mov dword [ebp - 0x1c], 0
jmp 0x4a43f5
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x18]
call fcn.0043c600
cmp dword [ebp - 0x1c], eax
jae 0x4a4579
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.0048aac0
push eax
lea ecx, [ebp - 0x24]
call fcn.00418370
lea ecx, [ebp - 0x24]
call fcn.00418600
movzx eax, al
test eax, eax
je 0x4a4434
lea ecx, [ebp - 0x24]
call fcn.004335b0
jmp 0x4a43ec
lea ecx, [ebp - 0x24]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4a4466
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x24]
call fcn.004335b0
lea ecx, [ebp - 0x18]
call fcn.00444870
mov eax, dword [ebp - 0x30]
jmp 0x4a458b
push 0
push 0x51872c
lea ecx, [ebp - 0x24]
call fcn.0040f570
test eax, eax
jl 0x4a4498
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x24]
call fcn.004335b0
lea ecx, [ebp - 0x18]
call fcn.00444870
mov eax, dword [ebp - 0x34]
jmp 0x4a458b
lea ecx, [ebp - 0x20]
push ecx
call fcn.00493b60
mov ecx, eax
call fcn.00493be0
lea edx, [ebp - 0x24]
push edx
push 0x50d6f8
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
push ecx
call fcn.004185a0
add esp, 0xc
push eax
lea edx, [ebp - 0x28]
push edx
call fcn.0041f890
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.004335b0
lea ecx, [ebp - 0x28]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a4515
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.004335b0
lea ecx, [ebp - 0x20]
call fcn.004335b0
lea ecx, [ebp - 0x24]
call fcn.004335b0
lea ecx, [ebp - 0x18]
call fcn.00444870
mov eax, dword [ebp - 0x3c]
jmp 0x4a458b
cmp dword [ebp + 0xc], 0
je 0x4a455c
lea ecx, [ebp - 0x28]
call fcn.0044ea20
push eax
call fcn.00417aa0
add esp, 4
test eax, eax
jne 0x4a455c
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x28]
call fcn.004335b0
lea ecx, [ebp - 0x20]
call fcn.004335b0
lea ecx, [ebp - 0x24]
call fcn.004335b0
lea ecx, [ebp - 0x18]
call fcn.00444870
mov eax, dword [ebp - 0x40]
jmp 0x4a458b
lea ecx, [ebp - 0x28]
call fcn.004335b0
lea ecx, [ebp - 0x20]
call fcn.004335b0
lea ecx, [ebp - 0x24]
call fcn.004335b0
jmp 0x4a43ec
mov dword [ebp - 0x44], 1
lea ecx, [ebp - 0x18]
call fcn.00444870
mov eax, dword [ebp - 0x44]
mov esp, ebp
pop ebp
ret 8
Function at 0x4a6d90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
cmp dword [ebp + 0x10], 0
jne 0x4a6da6
mov eax, 0x80070057
jmp 0x4a6f44
cmp dword [ebp + 0xc], 0
jne 0x4a6db6
mov eax, 0x80070057
jmp 0x4a6f44
push 0x518a78
lea ecx, [ebp - 8]
call fcn.0040f510
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0041d430
test eax, eax
je 0x4a6dea
mov dword [ebp - 0x2c], 0x80070057
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x2c]
jmp 0x4a6f44
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4a6f32
lea ecx, [ebp - 0x20]
call fcn.0044c8d0
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x30]
call fcn.0040f510
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call fcn.0044c970
lea ecx, [ebp - 0x30]
call fcn.004335b0
lea ecx, [ebp - 0x20]
call fcn.0044c9a0
lea ecx, [ebp - 0x20]
call fcn.0044cec0
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x4a6eaf
mov ecx, dword [ebp - 0x24]
call fcn.00418600
movzx edx, al
test edx, edx
jne 0x4a6eaf
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040f510
push 1
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.00430e40
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x31], al
lea ecx, [ebp - 0x38]
call fcn.004335b0
movzx ecx, byte [ebp - 0x31]
test ecx, ecx
je 0x4a6eaf
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x3c]
call fcn.0040f510
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
call fcn.0042f060
lea ecx, [ebp - 0x3c]
call fcn.004335b0
lea ecx, [ebp - 0x20]
call fcn.0044cee0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.00418600
movzx eax, al
test eax, eax
jne 0x4a6f2a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ecx
mov ecx, esp
push eax
call fcn.0040f510
lea ecx, [ebp - 0x44]
push ecx
call fcn.0049bcd0
add esp, 8
mov ecx, eax
call fcn.0044ea20
push eax
lea edx, [ebp - 0x48]
push edx
call fcn.0049b160
add esp, 4
mov ecx, eax
call fcn.0044ea20
push eax
mov ecx, dword [ebp - 0x28]
call fcn.0044ea20
push eax
push str.maintab
call fcn.004a6f50
mov ecx, eax
call fcn.00432c70
lea ecx, [ebp - 0x48]
call fcn.004335b0
lea ecx, [ebp - 0x44]
call fcn.004335b0
lea ecx, [ebp - 0x20]
call fcn.0044c920
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x4c]
mov esp, ebp
pop ebp
ret 0x10