joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442fd0
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x4dbc2d
call fcn.004b53ae
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x418], bl
jne 0x443131
lea eax, [esi + 0x41c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043c97c
mov dword [ebp - 4], ebx
cmp byte [esi + 0x418], bl
jne 0x443124
push ebx
push 0x28
xor eax, eax
push esi
lea edi, [esi + 0x20c]
push ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x414], ebx
mov word [esi], ax
mov word [edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x443047
push 0x4f9a74
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4430cf
mov dword [ebp - 0x14], ebx
call fcn.0043a66f
test al, al
jne 0x443124
cmp dword [ebp + 8], ebx
je 0x443124
push dword [ebp + 8]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [0x536040], eax
je 0x4430bf
cmp eax, ebx
je 0x4430bf
lea ecx, [ebp + 8]
push ecx
push 8
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4430bf
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x18], 0x104
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
je 0x4430b6
mov dword [ebp - 0x14], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0043f1fb
cmp dword [ebp - 0x14], ebx
je 0x443124
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call fcn.004b5ec7
mov dword [esp], 0x104
push edi
push esi
mov dword [esi + 0x208], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebx
je 0x4430fc
cmp eax, 0x104
jb 0x443101
xor eax, eax
mov word [edi], ax
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x443110
mov word [edi], ax
push edi
call fcn.004b5ec7
pop ecx
mov dword [esi + 0x414], eax
mov byte [esi + 0x418], 1
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004b5486
ret 4
Function at 0x44593c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x270], 0
jne 0x445b4a
call fcn.0043a311
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004b47e0
add esp, 0xc
push str.360TSCommon.dll
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.004448f1
test al, al
je 0x445b4a
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x445b4a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenLinkLowPermission
push eax
call edi
push str.OpenBrowser
push dword [esi]
mov dword [esi + 0x20c], eax
call edi
push str.GetDeviceRegistration
push dword [esi]
mov dword [esi + 0x210], eax
call edi
push str.ShowPromotion
push dword [esi]
mov dword [esi + 0x214], eax
call edi
push str.GetThemeName
push dword [esi]
mov dword [esi + 0x218], eax
call edi
push str.ValidateTheme
push dword [esi]
mov dword [esi + 0x21c], eax
call edi
push str.OpenLinkByBrowserLowPermission
push dword [esi]
mov dword [esi + 0x220], eax
call edi
push str.IsOpera360e
push dword [esi]
mov dword [esi + 0x224], eax
call edi
push str.IsOpera360eByAppPath
push dword [esi]
mov dword [esi + 0x228], eax
call edi
push str.GetEdition
push dword [esi]
mov dword [esi + 0x22c], eax
call edi
push str.PromoOpera
push dword [esi]
mov dword [esi + 0x230], eax
call edi
push str.PromoBoottime
push dword [esi]
mov dword [esi + 0x234], eax
call edi
push str.PromoUpgradeNow
push dword [esi]
mov dword [esi + 0x238], eax
call edi
push str.PromoMedal
push dword [esi]
mov dword [esi + 0x23c], eax
call edi
push str.PromoPopup
push dword [esi]
mov dword [esi + 0x240], eax
call edi
push str.PromoReminder
push dword [esi]
mov dword [esi + 0x244], eax
call edi
push str.PromoNews
push dword [esi]
mov dword [esi + 0x248], eax
call edi
push str.PromoAutoPopup
push dword [esi]
mov dword [esi + 0x24c], eax
call edi
push str.PromoFullCheck
push dword [esi]
mov dword [esi + 0x250], eax
call edi
push str.PromoDesktopPlus
push dword [esi]
mov dword [esi + 0x254], eax
call edi
push str.GetMachineSpec
push dword [esi]
mov dword [esi + 0x258], eax
call edi
push str.UpdateTrialInfo
push dword [esi]
mov dword [esi + 0x25c], eax
call edi
push str.UpdateToolUsageCount
push dword [esi]
mov dword [esi + 0x260], eax
call edi
push str.GetToolUsageCount
push dword [esi]
mov dword [esi + 0x264], eax
call edi
push str.TriggerToolPromotion
push dword [esi]
mov dword [esi + 0x268], eax
call edi
mov dword [esi + 0x26c], eax
mov byte [esi + 0x270], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b48bf
leave
ret
Function at 0x446661
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x4dc13b
call fcn.004b5417
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x446771
cmp byte [esi + 0x41], 0
je 0x446771
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x446697
xor al, al
jmp 0x446773
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004464c2
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c520
mov ecx, eax
call fcn.0043ef4a
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c520
mov ecx, eax
call fcn.0043ef4a
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x44670b
dec eax
je 0x44670f
dec eax
dec eax
je 0x44676d
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040d2f0
mov al, bl
jmp 0x446773
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c520
mov ecx, eax
call fcn.0043ef4a
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x44674f
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040c520
mov ecx, eax
call fcn.0043ef4a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004b8daf
add esp, 0x10
cmp edi, eax
jne 0x4466f5
cmp byte [esi + 0x41], 0
je 0x44676d
test edi, edi
jne 0x4466a5
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00432b50
jmp 0x4466a5
mov bl, 1
jmp 0x4466f7
mov al, 1
call fcn.004b549a
ret
Function at 0x4471bf
Capabilities:
Query environment variable

Disassembly:
push 0x244
mov eax, 0x4dc2dc
call fcn.004b5417
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 1
call fcn.00428e60
mov eax, dword [ebx]
xor esi, esi
cmp dword [eax - 0xc], esi
jle 0x4473dc
push esi
mov ecx, ebx
call fcn.0040c870
mov ecx, ebx
cmp ax, 0x25
jne 0x4473bb
lea edi, [esi + 1]
push edi
push 0x25
mov dword [ebp - 0x230], edi
call fcn.004420e7
mov ecx, ebx
test eax, eax
jge 0x447246
push esi
call fcn.0040c870
mov ecx, dword [ebp - 0x21c]
movzx eax, ax
push eax
call fcn.0044686a
mov esi, edi
jmp 0x4473d1
mov edi, eax
sub edi, esi
lea eax, [edi - 1]
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x23c]
push eax
call fcn.00443d2a
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00445121
push eax
lea ecx, [ebp - 0x220]
call fcn.004420c1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.0040d610
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.00444bf1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x22c]
push eax
push dword [eax + 0x18]
mov dword [ebp - 0x238], ecx
lea ecx, [ebp - 0x248]
call fcn.004424c1
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x238]
call fcn.0043cc0e
test al, al
jne 0x447307
lea ecx, [ebp - 0x238]
call fcn.00478005
mov ecx, dword [ebp - 0x21c]
add eax, 4
push eax
call fcn.00446855
mov eax, dword [ebp - 0x220]
mov eax, dword [eax - 0xc]
lea esi, [esi + eax + 2]
jmp 0x4473aa
inc edi
push edi
push esi
lea eax, [ebp - 0x240]
push eax
mov ecx, ebx
call fcn.00443d2a
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.00445121
push eax
lea ecx, [ebp - 0x224]
call fcn.004420c1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x240]
call fcn.0040d610
mov edi, 0x104
push edi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [ebp - 0x21c]
cmp eax, edi
ja 0x44737c
lea eax, [ebp - 0x218]
push eax
call fcn.00444b0f
mov eax, dword [ebp - 0x220]
mov eax, dword [eax - 0xc]
lea esi, [esi + eax + 2]
jmp 0x44739b
mov eax, dword [ebp - 0x224]
push dword [eax - 0xc]
and dword [ebp - 0x228], 0
push eax
call fcn.00444290
mov eax, dword [ebp - 0x224]
add esi, dword [eax - 0xc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040d610
jmp 0x4473d1
push esi
call fcn.0040c870
mov ecx, dword [ebp - 0x21c]
movzx eax, ax
push eax
call fcn.0044686a
inc esi
mov eax, dword [ebx]
cmp esi, dword [eax - 0xc]
jl 0x4471ff
mov eax, dword [ebp - 0x228]
call fcn.004b549a
ret
Function at 0x447a2c
Capabilities:
Check os version
Get common file path

Disassembly:
push 0x334
mov eax, 0x4dc434
call fcn.004b5417
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0x334]
push edi
push eax
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
mov dword [ebp - 0x334], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor esi, esi
inc esi
test eax, eax
je 0x447a86
cmp dword [ebp - 0x330], 6
jne 0x447a86
cmp dword [ebp - 0x32c], esi
jb 0x447a86
mov eax, esi
call fcn.004b549a
ret
push edi
push 0x25
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x338]
call fcn.0040c7d0
mov dword [ebp - 4], edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x338]
push 0x4f9eb0
push eax
call fcn.0040e3f0
add esp, 0xc
push 0x4f9e94
lea ecx, [ebp - 0x338]
call fcn.00444b0f
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x33c]
push eax
push dword [ebp - 0x338]
mov dword [ebp - 0x33c], edi
call fcn.0043bad7
add esp, 0xc
test eax, eax
je 0x447b22
mov eax, dword [ebp - 0x33c]
shr eax, 0x10
cmp ax, 6
jne 0x447b22
cmp word [ebp - 0x33c], si
jb 0x447b22
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x338]
call fcn.0040d610
jmp 0x447a7e
xor esi, esi
jmp 0x447b0e

Function at 0x44a3a4
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 0x41c], esi
call fcn.00444bb6
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x44a4d0
push dword [ebp + 8]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x418], eax
cmp eax, ebx
je 0x44a4d0
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x424], ebx
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 4
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x418]
call sub.PSAPI.DLL_EnumProcessModules
mov esi, 0x104
test eax, eax
je 0x44a466
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x418]
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x44a466
lea eax, [ebp - 0x20c]
jmp 0x44a4b1
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call fcn.0043da65
test eax, eax
je 0x44a4bd
xor eax, eax
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call fcn.004b47e0
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043e5cf
add esp, 0x18
lea eax, [ebp - 0x414]
mov ecx, dword [ebp - 0x41c]
push eax
call fcn.0040c660
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x41c]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp eax, dword [esi + 0x14]
pop esi
sbb eax, eax
xor ecx, ebp
neg eax
pop ebx
call fcn.004b48bf
leave
ret
Function at 0x44a4e7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.00444bb6
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x44a51c
xor eax, eax
jmp 0x44a57e
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x44a562
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x44a568
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x44a54a
jmp 0x44a56e
mov ebx, dword [ebp - 0x218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
call fcn.0044a3a4
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b48bf
leave
ret

Function at 0x44a58d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4dc7af
call fcn.004b5417
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor esi, esi
lea eax, [ebp - 0x216]
push ebx
inc esi
push eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], 0x104
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, edi
cmp eax, ebx
je 0x44a61a
push 0x50ea8c
call fcn.0042b420
jmp 0x44a635
cmp dword [ebp - 0x220], esi
je 0x44a629
push 0x50ea8c
jmp 0x44a630
lea eax, [ebp - 0x218]
push eax
call fcn.0042b420
mov dword [ebp - 4], ebx
mov dword [ebp - 0x21c], esi
mov eax, edi
call fcn.004b549a
ret
Function at 0x44a646
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x260
mov eax, 0x4dc80f
call fcn.004b5417
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], ebx
call fcn.0040c5e0
mov dword [ebp - 4], ebx
xor esi, esi
inc esi
push ebx
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x220], 7
call fcn.0040daa0
mov dword [ebp - 4], esi
push edi
lea ecx, [ebp - 0x238]
call fcn.0040c660
push str._shellopencommand
lea ecx, [ebp - 0x238]
call fcn.00447c32
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x258], ebx
jae 0x44a6d3
lea eax, [ebp - 0x234]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x258]
push ecx
push eax
push 0x80000000
call edi
mov esi, 0x208
test eax, eax
jne 0x44a77a
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x260], ebx
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
push ebx
push dword [ebp - 0x258]
mov dword [ebp - 0x25c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 0x14], cx
cmp eax, ebx
jne 0x44a76e
cmp dword [ebp - 0x260], 1
jne 0x44a76e
mov eax, dword [ebp - 0x25c]
and eax, 0xfffffffe
cmp eax, esi
jae 0x44a76e
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x21c]
push eax
call fcn.0040c660
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043a906
test al, al
je 0x44a8a1
mov eax, dword [ebp - 0x264]
cmp dword [eax + 0x18], 8
jb 0x44a798
mov eax, dword [eax + 4]
jmp 0x44a79b
add eax, 4
push str.C:Windows_system32LaunchWinApp.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
je 0x44a8a1
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
push 0x80000000
call edi
test eax, eax
jne 0x44a8a1
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x25c], ebx
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push str.FriendlyTypeName
push dword [ebp - 0x258]
mov dword [ebp - 0x260], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 0x14], cx
cmp eax, ebx
jne 0x44a895
cmp dword [ebp - 0x25c], 1
jne 0x44a895
mov eax, dword [ebp - 0x260]
and eax, 0xfffffffe
cmp eax, esi
jae 0x44a895
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.0042b420
mov byte [ebp - 4], 2
cmp dword [ebp - 0x23c], 8
mov eax, dword [ebp - 0x250]
jae 0x44a861
lea eax, [ebp - 0x250]
push dword [0x53530c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44a883
push dword [0x53530c]
mov ecx, dword [ebp - 0x264]
call fcn.0040c660
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x254]
call fcn.0040d590
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.0040d590
mov eax, dword [ebp - 0x264]
call fcn.004b549a
ret
Function at 0x44a8be
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x4dc859
call fcn.004b5417
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x22c], esi
mov ecx, ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x220], esi
call fcn.0040c5e0
mov dword [ebp - 4], esi
lea eax, [ebp - 0x220]
push eax
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [ebp - 0x22c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44a9a4
mov edi, 0x208
push edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
mov dword [ebp - 0x228], esi
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push str.Progid
push dword [ebp - 0x220]
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a998
cmp dword [ebp - 0x228], 1
jne 0x44a998
mov eax, dword [ebp - 0x224]
and eax, 0xfffffffe
cmp eax, edi
jae 0x44a998
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.0040c660
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.004b549a
ret

Function at 0x44a9ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], 1
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push str.clid
push dword [0x535260]
mov dword [ebp - 0x214], 0x208
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x44aa28
xor al, al
jmp 0x44aa38
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0040c660
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b48bf
leave
ret
Function at 0x44aa45
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x5382cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x830], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004b47e0
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004b47e0
add esp, 0x18
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x82c]
push eax
push dword [0x535284]
lea edi, [esi + 2]
push dword [0x535258]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x80000001
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x828], edi
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x82c]
push eax
push dword [0x535284]
push dword [0x535258]
push 0x80000002
call esi
push edi
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004b47e0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x44ab2f
lea eax, [ebp - 0x20c]
jmp 0x44ab42
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x44aba6
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
call fcn.0040b640
push edi
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004b47e0
add esp, 0xc
push str.......chrome.exe
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x44aba6
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
je 0x44aba6
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x61c]
push eax
call fcn.0040c660
mov al, 1
jmp 0x44aba8
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b48bf
leave
ret

Function at 0x44abb6
Capabilities:
Check if file exists

Disassembly:
push 0x430
mov eax, 0x4dc88c
call fcn.004b5417
xor edi, edi
push edi
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x424], 7
call fcn.0040daa0
mov dword [ebp - 4], edi
lea eax, [ebp - 0x43c]
push eax
call fcn.0044aa45
pop ecx
test al, al
jne 0x44ac0d
xor bl, bl
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x43c]
call fcn.0040d590
mov al, bl
call fcn.004b549a
ret
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b47e0
push dword [0x5352a4]
lea eax, [ebp - 0x218]
push str.....User_DataDefaultExtensions_s
push 0x104
push eax
call fcn.0043e544
xor eax, eax
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.004b47e0
mov eax, dword [ebp - 0x438]
add esp, 0x28
cmp dword [ebp - 0x424], 8
jae 0x44ac74
lea eax, [ebp - 0x438]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x44abf1
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44aca9
mov bl, 1
jmp 0x44abf3
push 1
push dword [0x5352a4]
push str.Chrome
push str.Google
call fcn.0043e702
add esp, 0x10
mov bl, al
jmp 0x44abf3
Function at 0x44af36
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4dc7af
call fcn.004b5417
mov ebx, dword [ebp + 8]
and dword [ebp - 0x21c], 0
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push 0
inc esi
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], esi
call fcn.004b47e0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office
push 0x80000001
mov dword [ebp - 0x224], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, ebx
test eax, eax
jne 0x44afbc
lea eax, [ebp - 0x218]
push eax
call fcn.0042b420
jmp 0x44afc6
push 0x50ea8c
call fcn.0042b420
and dword [ebp - 4], 0
mov dword [ebp - 0x21c], esi
mov eax, ebx
call fcn.004b549a
ret