joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424bac
Capabilities:
Get file size

Disassembly:
push 0x14
mov eax, 0x45df2c
call fcn.0043ac8b
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push ebx
push ebx
push 0x80
push 3
push 1
push SysReAllocString
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00422d18
test eax, eax
je 0x424bf7
cmp dword [ebp - 0x10], ebx
je 0x424bf0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x424d1e
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp dword [ebp - 0x20], ebx
jne 0x424be2
lea esi, [edi + 2]
push esi
call fcn.004339c0
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x424be2
push esi
push ebx
push eax
call fcn.0043a190
add esp, 0xc
push edi
mov edi, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x10]
call fcn.00422d4e
test eax, eax
je 0x424c41
push edi
call fcn.0043a76e
pop ecx
jmp 0x424be2
cmp dword [ebp - 0x10], ebx
je 0x424c52
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
push 0x47bc90
lea ecx, [ebp - 0x14]
mov esi, edi
call fcn.00402172
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 1
cmp byte [edi], bl
je 0x424cec
mov al, byte [esi]
cmp al, 0x20
je 0x424c82
cmp al, 9
je 0x424c82
cmp al, 0xd
je 0x424c82
cmp al, 0xa
jne 0x424c85
inc esi
jmp 0x424c70
mov ecx, esi
cmp al, bl
je 0x424c9a
mov al, byte [esi]
cmp al, 0xd
je 0x424c9a
cmp al, 0xa
je 0x424c9a
inc esi
cmp byte [esi], bl
jne 0x424c8b
mov al, byte [esi]
push ecx
lea ecx, [ebp - 0x14]
mov byte [ebp + 0xb], al
mov byte [esi], bl
call fcn.0042338e
mov al, byte [ebp + 0xb]
push ebx
push 0x463164
lea ecx, [ebp - 0x14]
mov byte [esi], al
call fcn.004231d0
cmp eax, 0xffffffff
jne 0x424ce8
push 0x2a
lea ecx, [ebp - 0x14]
call fcn.004233f5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
jle 0x424ce8
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
push ebx
push eax
call fcn.00424a42
cmp eax, 1
jne 0x424ce8
mov dword [ebp - 0x18], ebx
cmp byte [esi], bl
jne 0x424c70
push edi
call fcn.0043a76e
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x424d02
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014f1
cmp dword [ebp - 0x10], ebx
je 0x424d1b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
call fcn.0043ad63
ret 4
Function at 0x4253a1
Capabilities:
Get file size

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x45dff5
call fcn.0043ac8b
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebx + 0x2c]
push esi
push esi
push 0x80
push 3
xor edi, edi
inc edi
push edi
push SysReAllocString
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00422d18
test eax, eax
jne 0x4254fe
push 0x10
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x10]
call fcn.00422d4e
test eax, eax
jne 0x4254ed
lea ecx, [ebx + 4]
call fcn.00423e4c
cmp dword [ebp - 0x30], 0x4c573351
jne 0x4254ed
mov eax, dword [ebp - 0x28]
cmp eax, 2
ja 0x4254ed
mov dword [ebx + 0x28], eax
cmp eax, edi
jne 0x42544b
cmp dword [ebp - 0x10], esi
je 0x425444
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x42550f
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x24], esi
jbe 0x4254ed
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
mov dword [ebp - 0x20], esi
call fcn.004339c0
pop ecx
add esi, 0xfffffff0
mov edi, eax
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.00422d4e
test eax, eax
jne 0x4254e4
push esi
push 0x4c573351
push edi
call fcn.0040fabe
mov eax, dword [edi]
add esp, 0xc
mov esi, edi
jmp 0x4254e0
cmp eax, dword [ebp - 0x20]
jae 0x4254e4
lea eax, [esi + 4]
push eax
push 0x208
lea eax, [ebp]
push eax
call fcn.0041e8b0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004236b2
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0042523b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004014f1
add esi, dword [esi]
mov eax, dword [esi]
test eax, eax
ja 0x42549b
push edi
call fcn.00439fec
pop ecx
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x42550c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], esi
je 0x42550c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043a7c3
add ebp, 0x20c
leave
ret
Function at 0x4257e9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0043a190
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0043a190
add esp, 0x18
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.....SoftMgr_advutils.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
jne 0x425898
push str.....SoftMgrSoftManager.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x42589b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043a7c3
leave
ret

Function at 0x425b36
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.SB_State
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp dword [ebp - 4], eax
setne al
leave
ret

Function at 0x426393
Capabilities:
Check if file exists

Disassembly:
call fcn.004016e3
test eax, eax
je 0x4263a0
xor eax, eax
inc eax
ret
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4263df
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4263df
push esi
call fcn.00439ea0
pop ecx
test eax, eax
je 0x4263df
push esi
call fcn.00401aac
pop ecx
test eax, eax
jne 0x4263df
push 1
call fcn.00439b50
push eax
push esi
call fcn.00439d60
add esp, 0xc
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret
Function at 0x426444
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call fcn.0043a190
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...SomProxy.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4264f9
lea eax, [ebp - 0x20c]
push eax
call fcn.00401aac
pop ecx
test eax, eax
je 0x4264f9
cmp dword [esi], edi
jne 0x4264f9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
cmp eax, edi
je 0x4264f9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RichTabIsSupport
push eax
call edi
push str.RichTabIsEnable
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.RichTabEnable
push dword [esi]
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043a7c3
leave
ret

Function at 0x426534
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x454], ax
xor ebx, ebx
lea eax, [ebp - 0x452]
push ebx
push eax
call fcn.0043a190
xor eax, eax
push esi
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push ebx
push eax
call fcn.0043a190
add esp, 0x18
push 0x208
lea eax, [ebp - 0x454]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.....SoftMgr_advutils.exe
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x24c]
push eax
call edi
test eax, eax
je 0x4265c7
mov al, 1
jmp 0x4265eb
push str.....SoftMgrSoftManager.exe
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
call esi
lea eax, [ebp - 0x24c]
push eax
call edi
test eax, eax
je 0x42663d
xor al, al
xor ecx, ecx
cmp al, bl
sete cl
lea eax, [ebp - 0x44]
lea ecx, [ecx*4 + 3]
push ecx
push str._page_d
push 0x20
push eax
call fcn.00423081
lea eax, [ebp - 0x24c]
push eax
call fcn.00426393
add esp, 0x14
test eax, eax
je 0x426639
push 5
push ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x461b54
push ebx
call fcn.00439fb0
add esp, 0x18
mov al, 1
jmp 0x42663f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a7c3
leave
ret
Function at 0x42664e
Capabilities:
Check if file exists

Disassembly:
push 0x418
mov eax, 0x45e0e7
call fcn.0043acf4
lea ecx, [ebp - 0x424]
call fcn.0042270d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x424]
call fcn.00422a86
test eax, eax
je 0x42671d
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0043a190
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Adfilter.dll
lea eax, [ebp - 0x218]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42671d
call fcn.004016e3
test eax, eax
jne 0x4266fc
lea eax, [ebp - 0x218]
push eax
call fcn.00401aac
pop ecx
test eax, eax
je 0x42671d
lea eax, [ebp - 0x218]
push eax
call fcn.00422290
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x424]
call fcn.0042272d
xor eax, eax
inc eax
jmp 0x42672e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.0042272d
xor eax, eax
call fcn.0043ad77
ret

Function at 0x4267b2
Capabilities:
Check if file exists
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push edi
push 0
mov edi, str.Q360SafeMainClass
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x42681e
push 9
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp + 0x1a0], 0
jbe 0x426816
push 0x168
push dword [ebp + 0x1a0]
push 0x52c
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x4268c4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.0043a190
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x460a50
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4268c2
xor eax, eax
mov ebx, 0x3e8
push ebx
push eax
push eax
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.00426734
add esp, 0x14
and dword [ebp - 0x78], 0
push 0
push edi
call esi
inc dword [ebp - 0x78]
test eax, eax
jne 0x4268ac
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x78], 0xa
jl 0x42688e
jmp 0x426816
push 0x168
push dword [ebp + 0x1a0]
push 0x52c
push eax
jmp 0x426810
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a7c3
add ebp, 0x198
leave
ret
Function at 0x426d1f
Capabilities:
Check if file exists

Disassembly:
push 0x60
mov eax, 0x45e16b
call fcn.0043ac8b
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
xor ebx, ebx
mov dword [eax], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x426d46
xor eax, eax
jmp 0x426e51
push dword [ebp + 8]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
cmp edi, ebx
je 0x426e3f
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str..exe
push edi
call esi
test eax, eax
je 0x426d7e
push 0x463338
push edi
call esi
test eax, eax
jne 0x426e3f
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x426e3f
push 0x47bc90
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
call fcn.00402172
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0x46266c
push eax
mov dword [ebp - 4], ebx
call fcn.00404c93
add esp, 0xc
push 0x44
pop ecx
mov edx, ecx
lea eax, [ebp - 0x6c]
mov byte [eax], bl
inc eax
dec edx
jne 0x426dbb
push 0x10
pop edx
lea eax, [ebp - 0x28]
mov byte [eax], bl
inc eax
dec edx
jne 0x426dc7
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x6c], ecx
call fcn.00425b74
add esp, 0x18
test eax, eax
je 0x426e09
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
mov dword [ebp - 0x18], 1
jmp 0x426e2e
cmp dword [ebp - 0x10], 0x2e4
jne 0x426e28
mov eax, dword [ebp + 0xc]
mov dword [eax], 6
lea ecx, [edi - 0x10]
call fcn.004014f1
jmp 0x426d3f
cmp dword [ebp - 0x10], 5
je 0x426e1b
or dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
call fcn.004014f1
cmp dword [ebp - 0x18], ebx
jne 0x426e4e
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425d07
pop ecx
pop ecx
jmp 0x426e51
xor eax, eax
inc eax
call fcn.0043ad63
ret

Function at 0x4272fd
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....updatecfg.ini
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0043a190
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4273a6
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push 0x460a50
push 0x463358
push str.urllib.dat
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4273a6
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.00404c6e
mov al, 1
jmp 0x4273a8
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043a7c3
leave
ret
Function at 0x42741f
Capabilities:
Check if file exists

Disassembly:
call fcn.004259f8
test eax, eax
je 0x415edc
jmp 0x4285f4
jmp 0x4285f4
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x45d4b1
call fcn.0043ac8b
xor eax, eax
push 0x206
mov word [ebp], ax
xor ebx, ebx
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0043a190
add esp, 0xc
push 0x208
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str...360Baobiao.exe
lea eax, [ebp]
push eax
call esi
push 0x47bc90
lea ecx, [ebp - 0x10]
call fcn.00402172
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp]
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x4274b6
push 0x460c30
lea eax, [ebp]
push eax
call esi
push str.360DownloadGuard.exe
lea eax, [ebp]
push eax
call esi
jmp 0x4274c3
push str._funname_DownloadGuard
lea ecx, [ebp - 0x10]
call fcn.00404c6e
lea eax, [ebp]
push eax
call edi
test eax, eax
jne 0x4274fd
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014f1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043a7c3
add ebp, 0x20c
leave
ret
lea eax, [ebp]
push eax
call fcn.00426393
pop ecx
test eax, eax
je 0x427523
push 5
push ebx
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
push 0x461b54
push ebx
call fcn.00439fb0
add esp, 0x18
xor ebx, ebx
inc ebx
jmp 0x4274cd
jmp 0x42741f

Function at 0x427528
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x45d4b1
call fcn.0043ac8b
xor eax, eax
push 0x206
mov word [ebp], ax
xor ebx, ebx
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0043a190
add esp, 0xc
push 0x208
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str...360Baobiao.exe
lea eax, [ebp]
push eax
call esi
push 0x47bc90
lea ecx, [ebp - 0x10]
call fcn.00402172
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp]
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x4275c4
push 0x460c30
lea eax, [ebp]
push eax
call esi
push str.360DownloadGuard.exe
lea eax, [ebp]
push eax
call esi
push str._s:2
jmp 0x4275c9
push str._funnameDownloadGuardLog
lea ecx, [ebp - 0x10]
call fcn.00404c6e
lea eax, [ebp]
push eax
call edi
test eax, eax
jne 0x42760b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014f1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043a7c3
add ebp, 0x20c
leave
ret
lea eax, [ebp]
push eax
call fcn.00426393
pop ecx
test eax, eax
je 0x427631
push 5
push ebx
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
push 0x461b54
push ebx
call fcn.00439fb0
add esp, 0x18
xor ebx, ebx
inc ebx
jmp 0x4275db
Function at 0x427636
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x479f14]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x45d4b1
call fcn.0043ac8b
xor eax, eax
push 0x206
mov word [ebp], ax
xor ebx, ebx
lea eax, [ebp + 2]
push ebx
push eax
call fcn.0043a190
add esp, 0xc
push 0x208
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str...360Baobiao.exe
lea eax, [ebp]
push eax
call esi
push 0x47bc90
lea ecx, [ebp - 0x10]
call fcn.00402172
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp]
push eax
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x4276d2
push 0x460c30
lea eax, [ebp]
push eax
call esi
push str.360DownloadGuard.exe
lea eax, [ebp]
push eax
call esi
push 0x46074c
jmp 0x4276d7
push str._funnameDownloadGuardSetting
lea ecx, [ebp - 0x10]
call fcn.00404c6e
lea eax, [ebp]
push eax
call edi
test eax, eax
jne 0x427719
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014f1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043a7c3
add ebp, 0x20c
leave
ret
lea eax, [ebp]
push eax
call fcn.00426393
pop ecx
test eax, eax
je 0x42773f
push 5
push ebx
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
push 0x461b54
push ebx
call fcn.00439fb0
add esp, 0x18
xor ebx, ebx
inc ebx
jmp 0x4276e9
Function at 0x429cda
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x45e646
call fcn.0043ac8b
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov esi, 0x47bb58
push eax
mov ecx, esi
call fcn.0041239f
mov ecx, dword [ebp + 8]
call fcn.004154a5
mov edi, dword [0x47bb60]
jmp 0x429e23
lea ecx, [ebp - 0x4c]
call fcn.004269d0
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call fcn.00426507
pop ecx
push edi
mov ecx, esi
call fcn.00413296
mov ebx, eax
push ebx
mov ecx, esi
call fcn.00412ab6
test eax, eax
je 0x429e17
push edi
mov ecx, esi
mov dword [ebp - 0x4c], edi
call fcn.004122b2
cmp eax, 1
jne 0x429d56
mov dword [ebp - 0x48], 3
jmp 0x429d68
push 2
pop ecx
cmp eax, ecx
je 0x429d65
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [ebp - 0x48], ecx
push ebx
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00414111
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00404bfc
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004014f1
push edi
mov ecx, esi
call fcn.004122f1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x18], edx
call fcn.0043c684
pop ecx
mov ecx, dword [eax + 0x10]
push 0xffffffffffffffff
push dword [eax]
inc ecx
push dword [eax + 4]
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea ecx, [ebp - 0x24]
call fcn.00425da5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x34]
push eax
push edi
mov ecx, esi
call fcn.00412c29
push edi
mov ecx, esi
call fcn.00412315
push eax
lea ecx, [ebp - 0x30]
call fcn.00404c6e
push edi
mov ecx, esi
call fcn.00412263
push dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00429b79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004145d9
dec edi
jns 0x429d0d
call fcn.0043ad63
ret
Function at 0x429f17
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x45e6a4
call fcn.0043acf4
cmp dword [0x47baf0], 0
jne 0x429f31
call fcn.004293bb
lea ecx, [ebp - 0x44]
call fcn.0042893e
push dword [0x47baf8]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42a063
push dword [0x47baf8]
lea ecx, [ebp - 0x44]
call fcn.0042c54c
test eax, eax
jne 0x42a063
push 0x47bc90
lea ecx, [ebp - 0x18]
call fcn.00402172
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0041fb50
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
jmp 0x42a035
push 0x47bc90
lea ecx, [ebp - 0x14]
call fcn.00402172
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0042611c
mov ebx, dword [eax + 0x118]
lea ecx, [ebp - 0x20]
call fcn.0042611c
mov edi, eax
add edi, 4
je 0x429fd8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x429fdc
xor eax, eax
jmp 0x429ff0
lea eax, [esi + esi]
call fcn.0043bc40
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.0042261b
push eax
lea ecx, [ebp - 0x18]
call fcn.00404c6e
test ebx, 0x100
je 0x42a01e
test bl, 1
je 0x42a01e
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.00404bfc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.0042b56a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004014f1
lea ecx, [ebp - 0x20]
call fcn.00426148
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.0041fb50
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041eb57
test al, al
je 0x429f98
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004014f1
lea ecx, [ebp - 0x44]
call fcn.004273b6
lea esp, [ebp - 0x54]
call fcn.0043ad77
ret