joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b236
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor esi, esi
cmp edi, esi
je 0x43b3b4
cmp dword [ebp + 8], esi
je 0x43b3b4
mov edx, dword [ebp + 0xc]
cmp edx, esi
je 0x43b3b4
cmp dword [ebp + 0x10], esi
je 0x43b3b4
cmp dword [ebp + 8], 2
jbe 0x43b308
mov dword [ebp - 8], 4
mov al, byte [edi]
sub dword [ebp + 8], 3
mov bl, al
shr bl, 2
inc edi
mov cl, byte [edi]
mov byte [ebp - 4], bl
mov bl, cl
and al, 3
inc edi
mov dl, byte [edi]
shr bl, 4
shl al, 4
add al, bl
and cl, 0xf
mov bl, dl
shl cl, 2
shr bl, 6
add cl, bl
mov byte [ebp - 2], cl
mov ecx, dword [ebp - 8]
and dl, 0x3f
inc edi
mov byte [ebp - 1], dl
cmp ecx, dword [ebp + 0x10]
ja 0x43b367
movzx edx, byte [ebp - 4]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [ebp + 0xc]
mov byte [esi + ebx], dl
inc esi
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], al
movzx eax, byte [ebp - 2]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
inc esi
mov byte [esi + ebx], al
movzx eax, byte [ebp - 1]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
inc esi
inc ecx
mov byte [esi + ebx], al
inc esi
inc ecx
cmp dword [ebp + 8], 2
mov dword [ebp - 8], ecx
ja 0x43b278
mov edx, ebx
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x43b3a7
xor al, al
mov byte [ebp - 2], cl
mov byte [ebp - 3], al
mov byte [ebp - 4], cl
cmp dword [ebp + 8], ecx
jbe 0x43b339
push dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
call fcn.004f4830
mov al, byte [ebp - 3]
mov cl, byte [ebp - 4]
add esp, 0xc
mov dl, cl
mov bl, al
and cl, 3
shr bl, 4
shl cl, 4
add cl, bl
mov bl, byte [ebp - 2]
and al, 0xf
shl al, 2
shr bl, 6
lea edi, [esi + 4]
shr dl, 2
add al, bl
cmp edi, dword [ebp + 0x10]
jbe 0x43b36c
mov eax, 0xffffffff
jmp 0x43b3b6
or eax, 0xffffffff
jmp 0x43b3b6
movzx edx, dl
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, dword [ebp + 0xc]
mov byte [esi + edx], bl
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + edx], cl
inc esi
cmp dword [ebp + 8], 1
jne 0x43b395
mov byte [esi + edx], 0x3d
jmp 0x43b3a1
movzx eax, al
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
inc esi
mov byte [esi + edx], 0x3d
inc esi
cmp esi, dword [ebp + 0x10]
jae 0x43b360
mov byte [esi + edx], 0
mov eax, esi
jmp 0x43b3b6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b3bb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x51f820
call fcn.004fc6ce
and dword [ebp - 0x1c], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov byte [ebp - 0xd], 1
cmp eax, esi
je 0x43b452
mov ebx, str.DriverUpdater
cmp eax, ebx
je 0x43b452
mov edi, str.NewDrvNotify
cmp eax, edi
je 0x43b452
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.0042ee4a
and dword [ebp - 0x18], 0
add esp, 0xc
push 4
pop esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
mov edi, dword [ebp - 0x14]
push edi
push SysReAllocString
mov bl, 1
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x43b446
cmp dword [ebp - 0x18], esi
je 0x43b448
xor bl, bl
lea eax, [edi - 0x10]
call fcn.00405521
jmp 0x43b454
xor bl, bl
cmp bl, 1
jne 0x43b461
cmp dword [ebp - 0x1c], 0
setne byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
call fcn.004fc7a6
ret
Function at 0x43daba
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x529488
call fcn.004fc6ce
xor edi, edi
cmp dword [ebp + 8], edi
je 0x43dc5c
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x43dc5c
call fcn.0043dd30
mov dword [ebp - 0x1c], eax
call fcn.0043dd10
push 0x26200a
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push dword [ebp + 8]
call fcn.00475105
mov ebx, eax
add esp, 0x10
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x43dc5c
cmp dword [ebp - 0x1c], edi
mov dword [ebp + 8], edi
jl 0x43dbcc
xor edi, edi
cmp dword [ebp - 0x18], edi
jl 0x43dbbd
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 8]
call fcn.0043dce0
mov ebx, dword [ebp - 0x14]
shr ebx, 0x18
cmp bl, 0xff
jne 0x43db4c
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x10]
jmp 0x43dba4
test bl, bl
je 0x43dbb0
mov esi, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 8]
call fcn.0043dce0
mov edx, dword [ebp - 0x14]
movzx ebx, bl
mov eax, edx
mov ecx, 0xff
shr eax, 0x18
sub ecx, ebx
cmp ecx, eax
jge 0x43db7c
mov al, cl
movzx eax, al
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x14], ecx
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
call fcn.0043dcbe
inc edi
cmp edi, dword [ebp - 0x18]
jle 0x43db24
mov ebx, dword [ebp - 0x10]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x1c]
jle 0x43db19
xor edi, edi
lea esi, [ebp + 8]
mov dword [ebp - 0x14], edi
call fcn.0043dea5
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x43dc3e
push ebx
lea edi, [ebp - 0x10]
call fcn.00475428
pop ecx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x43dc32
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push str.disable_resize
call fcn.00427950
push ecx
mov byte [ebp - 4], 2
mov edi, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00427950
mov byte [ebp - 4], 3
mov edx, dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0043dc64
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.00405521
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x43dc57
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
jmp 0x43dc5e
xor eax, eax
call fcn.004fc7a6
ret
Function at 0x43f6d8
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x48
mov eax, 0x525d00
call fcn.004fc737
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x44], ebx
cmp eax, ebx
jne 0x43f701
mov esi, edi
call fcn.00404e70
jmp 0x43f805
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c], eax
cmp eax, 0xffffffff
je 0x43f7ef
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x43f7e3
push 0x590f51
push esi
call fcn.004f5946
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x50], edi
cmp edi, ebx
je 0x43f7e3
push esi
push ebx
push edi
call fcn.004f18b0
add esp, 0xc
push ebx
lea eax, [ebp - 0x48]
push eax
push esi
push edi
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43f7da
cmp dword [ebp - 0x48], esi
jne 0x43f7da
push 0x10
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.004f18b0
mov ecx, dword [ebp - 0x50]
add esp, 0xc
push esi
lea edi, [ebp - 0x40]
call fcn.004c3210
pop ecx
test eax, eax
je 0x43f7da
lea eax, [ebp - 0x44]
push eax
mov eax, edi
push eax
call fcn.00436d47
mov byte [ebp - 4], 1
mov esi, dword [eax]
push esi
call fcn.004f192a
pop ecx
push esi
lea esi, [ebp - 0x30]
call fcn.00404d75
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
call fcn.00405521
push dword [ebp - 0x50]
call fcn.004f2b13
pop ecx
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x54]
lea eax, [ebp - 0x30]
push eax
mov esi, edi
call fcn.0042a58e
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.00404e29
mov eax, edi
call fcn.004fc7ba
ret
Function at 0x43fc0f
Capabilities:
Get disk information
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x585698]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
push ebx
and al, 0xdf
push esi
xor esi, esi
mov bl, al
inc esi
sub al, 0x41
push edi
mov dword [ebp - 0x1c], esi
cmp al, 0x19
ja 0x43fd06
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x5c3a58
push eax
mov byte [ebp - 0x24], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x43fd06
push 3
pop ecx
cmp eax, ecx
je 0x43fc74
jbe 0x43fc6d
cmp eax, 5
jbe 0x43fd06
cmp eax, 6
je 0x43fc74
mov eax, esi
jmp 0x43fd08
mov esi, str..X:
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 8], bl
xor ebx, ebx
push ebx
push ebx
push ecx
push ebx
push ecx
push SysReAllocString
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x43fca6
xor eax, eax
inc eax
jmp 0x43fd08
mov edi, 0x227
push edi
call fcn.004f0fe5
pop ecx
push ebx
mov esi, eax
mov dword [esi + 4], edi
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push dword [esi + 4]
lea eax, [ebp - 0x18]
push esi
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x43fcf1
mov eax, dword [esi + 0x1c]
cmp eax, 7
je 0x43fcee
cmp eax, 4
jne 0x43fcf1
mov dword [ebp - 0x1c], ebx
push esi
call fcn.004f2b13
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
jmp 0x43fd08
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f189b
leave
ret

Function at 0x43fd17
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x585698]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
and al, 0xdf
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x43fd78
mov dword [ebp - 8], 0x5c3a58
mov byte [ebp - 8], al
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
je 0x43fd73
dec eax
dec eax
je 0x43fd6f
dec eax
je 0x43fd6b
dec eax
je 0x43fd67
push dword [ebp + 8]
call fcn.0043fc0f
neg eax
sbb eax, eax
pop ecx
inc eax
jmp 0x43fd7a
push 5
jmp 0x43fd75
push 4
jmp 0x43fd75
push 3
jmp 0x43fd75
push 2
pop eax
jmp 0x43fd7b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f189b
leave
ret
Function at 0x44002b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x585698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.0043ff81
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x440057
xor ebx, ebx
cmp esi, ebx
jne 0x440067
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004f189b
leave
ret
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x1a
mov dword [ebp - 0x50], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x44008e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x440059
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x4c], 1
sete bl
jmp 0x440083
Function at 0x44080a
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x440917
xor ecx, ecx
cmp cx, word [eax]
je 0x440917
cmp dword [ebp + 8], esi
je 0x440917
push esi
push 0x80
push 4
push esi
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x440917
push esi
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
cmp eax, 0x10
jb 0x4408b1
push 0x30
add eax, 0xfffffff0
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x4408b5
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x24], 0x54534355
jne 0x4408b5
cmp dword [ebp - 0x20], 1
je 0x4408cd
jmp 0x4408b5
cmp eax, esi
jbe 0x4408cd
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], esi
je 0x44091e
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x24], 0x54534355
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44090f
cmp dword [ebp - 8], 0x10
je 0x440929
lea eax, [ebp - 0x14]
call fcn.004407a5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 2
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push 0x30
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44090f
cmp dword [ebp - 8], 0x30
jne 0x44090f
lea eax, [ebp - 0x14]
call fcn.004407a5
xor eax, eax
inc eax
jmp 0x440919
Function at 0x440eb2
Capabilities:
Read .ini file

Disassembly:
push 0xc
mov eax, 0x52d210
call fcn.004fc6ce
lea ecx, [ebp - 0x14]
call fcn.004270bb
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x54a33c
push ecx
mov edi, eax
call fcn.00405a46
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405521
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x927c0
push str.UserIdleTime
mov ebx, str.Test
push ebx
call edi
push dword [ebp - 0x10]
mov dword [esi + 0x40], eax
push 0x2bf20
push str.LockScreenIdleTime
push ebx
call edi
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov dword [esi + 0x44], eax
call edi
xor ebx, ebx
test eax, eax
jne 0x440f62
cmp dword [0x58bc50], ebx
jne 0x440f3b
mov dword [0x58bc50], ebx
lea eax, [esi + 0x20]
push eax
push 0x58bc20
call fcn.0042f932
movzx eax, ax
push eax
xor eax, eax
push eax
push ebx
push 0x56000000
push 0x53a3d8
push eax
push esi
call fcn.0042f6d6
push dword [esi + 4]
call edi
cmp eax, 1
jne 0x440fb1
call fcn.00475c98
test al, al
je 0x440f7e
push ebx
push dword [esi + 4]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
push ebx
push 0xea60
push 0x3ea
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov bl, 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405521
mov al, bl
call fcn.004fc7a6
ret
xor bl, bl
jmp 0x440f9e

Function at 0x441438
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
call fcn.00448249
cmp eax, 1
jne 0x441449
xor al, al
jmp 0x44148f
call fcn.00449525
push eax
call fcn.00440fb5
pop ecx
test eax, eax
je 0x44146a
push str.true
push eax
call fcn.004f5171
pop ecx
pop ecx
test eax, eax
je 0x441445
push 0
push 0
push dword [ebp + 8]
push 0x4410ac
push 0
push 0
call fcn.004f5629
add esp, 0x18
test eax, eax
je 0x44148d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ebp
ret 4

Function at 0x4414c7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x10
Function at 0x442548
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x528fe9
call fcn.004fc6ce
lea edi, [ebp - 0x10]
call fcn.00404523
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
mov bl, 1
jne 0x44257e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405521
mov al, bl
call fcn.004fc7a6
ret
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00404758
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4425a4
push dword [ebp - 0x10]
call fcn.0040595b
pop ecx
test eax, eax
jne 0x44256b
push dword [ebp - 0x10]
call fcn.00448ada
xor bl, bl
jmp 0x44256b
Function at 0x4445fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SOFTWARE360SafeAntiTrack
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x444629
cmp dword [ebp - 4], esi
je 0x444650
push 4
lea eax, [ebp + 8]
push eax
push 4
push esi
push str.AntiTrackAdviseInfo
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x444647
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x444655
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push str.SOFTWARE360SafeAntiTrack
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x444681
cmp dword [ebp - 4], esi
je 0x4446c1
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.AntiTrackAdviseInfo
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4446b8
cmp edi, esi
je 0x4446b5
mov eax, dword [ebp - 8]
mov dword [edi], eax
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x4446c6
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x4447d3
xor ecx, ecx
cmp cx, word [eax]
je 0x4447d3
cmp dword [ebp + 8], esi
je 0x4447d3
push esi
push 0x80
push 4
push esi
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4447d3
push esi
push ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp eax, esi
sete cl
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
cmp eax, 0x10
jb 0x44476d
push 0x30
add eax, 0xfffffff0
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x444771
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x24], 0x54535653
jne 0x444771
cmp dword [ebp - 0x20], 1
je 0x444789
jmp 0x444771
cmp eax, esi
jbe 0x444789
push esi
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], esi
je 0x4447da
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x24], 0x54535653
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4447cb
cmp dword [ebp - 8], 0x10
je 0x4447e5
lea eax, [ebp - 0x14]
call fcn.004407a5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 2
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 8]
push eax
push 0x30
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4447cb
cmp dword [ebp - 8], 0x30
jne 0x4447cb
lea eax, [ebp - 0x14]
call fcn.004407a5
xor eax, eax
inc eax
jmp 0x4447d5
Function at 0x44488a
Capabilities:
Copy file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp eax, edi
je 0x44492b
xor ecx, ecx
cmp cx, word [eax]
je 0x44492b
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x44492b
xor edx, edx
cmp dx, word [ecx]
je 0x44492b
cmp dword [ebp + 0xc], edi
je 0x44492b
cmp dword [ebp + 0x10], edi
je 0x4448ca
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
jmp 0x444927
push ebx
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x444926
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0xfeff
call esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
push ebx
call esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, edi
jmp 0x44492d
xor eax, eax
pop edi
leave
ret

Function at 0x444ab1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00444b34
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esp, 0xc
push 4
lea eax, [ebp - 4]
push eax
push 4
push str.last_optimized
mov ebx, str.Software360360Speedld
push ebx
mov edi, SysReAllocString
push edi
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.last_not_optimized
push ebx
push edi
call esi
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 4
push str.optimized
push ebx
push edi
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.not_optimized
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret