joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c120
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ecx
call dword [0x42234c]
test eax, eax
je 0x40c14f
push 0
push edi
call fcn.00402b80
add esp, 8
mov dword [esi + 0xc], eax
mov edi, dword [esi + 0xc]
test edi, edi
jne 0x40c15d
pop edi
xor eax, eax
pop esi
ret 0x10
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], 0
call fcn.00414ac6
test eax, eax
je 0x40c17a
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x18]
mov edi, dword [esi + 0xc]
mov dword [esi + 0x18], ecx
lea edx, [esp + 0x18]
mov eax, dword [edi + 4]
push edx
push eax
mov dword [esp + 0x20], 0
call fcn.00414ac0
test eax, eax
je 0x40c1a1
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x1c], ecx
lea edx, [eax - 0x28]
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
add eax, 0x14
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov ecx, esi
mov dword [esi + 0x20], edx
mov dword [esi + 0x30], 0xf9
mov dword [esi + 0x38], 0x149
mov dword [esi + 0x34], 0x95
mov dword [esi + 0x3c], 0xb3
mov dword [esi + 0x40], 0x1b
mov dword [esi + 0x48], 0x48
mov dword [esi + 0x44], 0x9a
mov dword [esi + 0x4c], 0xad
call fcn.0040c3d0
pop edi
mov eax, 1
pop esi
ret 0x10

Function at 0x40c210
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x34
push ebx
push esi
push 0x42bf04
push str.Shell_TrayWnd
call dword [0x4223f8]
mov esi, eax
mov ebx, 2
test esi, esi
mov dword [esp + 0x18], 0x24
mov dword [esp + 0x1c], esi
je 0x40c24b
lea eax, [esp + 0x18]
push eax
push 4
call dword [0x42230c]
mov ebx, eax
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
call dword [0x422354]
pop esi
test bl, 1
pop ebx
je 0x40c289
mov ecx, dword [esp + 0x38]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
add esp, 0x34
ret
mov eax, dword [esp + 0x38]
lea edx, [esp]
push edx
push eax
call dword [0x42235c]
add esp, 0x34
ret
Function at 0x40c3d0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x7c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x10], esi
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40c3f3
push eax
call dword [0x4223f0]
test eax, eax
jne 0x40c5e6
push edi
mov edi, dword [esi + 0xc]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.00414ac6
cmp eax, ebx
je 0x40c410
mov dword [edi + 8], eax
mov esi, dword [esi + 0xc]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], ebx
mov eax, dword [esi + 4]
push eax
call fcn.00414ac0
cmp eax, ebx
je 0x40c42c
mov dword [esi + 8], eax
push ebp
push 0x42bf04
push str.Shell_TrayWnd
call dword [0x4223f8]
xor ecx, ecx
lea edx, [esp + 0x24]
mov dword [esp + 0x28], ecx
push edx
mov dword [esp + 0x30], ecx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ecx
call dword [0x422354]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x24], ebx
call dword [0x4223d4]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x54]
push ebx
push ecx
push edx
push eax
call fcn.0040c350
lea ecx, [esp + 0x54]
push ecx
call fcn.0040c210
add esp, 0x14
lea edx, [esp + 0x44]
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push edx
push eax
push ecx
call dword [0x4223cc]
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x94]
sub eax, ebp
mov ebp, dword [esp + 0x14]
sub ecx, edi
dec edx
cmp edx, 4
ja case.0x40c4ca.3
jmp dword [edx*4 + 0x40c5f4]
xor esi, esi
jmp 0x40c503
sub eax, ebp
mov esi, eax
jmp 0x40c503
xor esi, esi
jmp 0x40c4fd
sub eax, ebp
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
mov esi, eax
mov eax, ecx
sub eax, edx
cdq
sub eax, edx
mov ebx, eax
sar esi, 1
sar ebx, 1
jmp 0x40c503
sub eax, ebp
mov esi, eax
sub ecx, dword [esp + 0x10]
mov ebx, ecx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x68]
push 0x7f00
rep stosd dword es:[edi], eax
mov eax, dword [0x42eb80]
push 0
mov dword [esp + 0x6c], 3
mov dword [esp + 0x70], 0x40c610
mov dword [esp + 0x7c], eax
mov dword [esp + 0x90], str.POPTIPS_CLASS
call dword [0x4223c8]
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], eax
push ecx
mov dword [esp + 0x84], 6
call dword [0x4223c4]
mov edi, dword [esp + 0x18]
mov edx, dword [0x42eb80]
mov eax, dword [esp + 0x10]
push edi
mov ecx, dword [esp + 0x8c]
push edx
push 0
push 0
push eax
push ebp
push ebx
push esi
push 0x80000000
push 0
push ecx
push 0x8010088
call dword [0x4223c0]
push edi
push str.THIS_WND
push eax
mov dword [edi + 4], eax
call dword [0x4223bc]
mov edx, dword [esp + 0x10]
push 6
inc edx
push 6
inc ebp
push edx
push ebp
push 0
push 0
call dword [0x422028]
test eax, eax
pop ebp
je 0x40c5c5
push 1
push eax
mov eax, dword [edi + 4]
push eax
call dword [0x4223b8]
mov ecx, dword [edi + 0x5c]
mov edx, dword [edi + 4]
push 0
push ecx
push 0x49644c65
push edx
call dword [0x4223a8]
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
add esp, 0x7c
ret 8
mov eax, dword [esi + 4]
pop esi
pop ebx
add esp, 0x7c
ret 8
Function at 0x40c9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push esi
mov dword [ebp - 4], ecx
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
mov word [ebp - 0x214], si
mov word [ebp - 0x41c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
lea edx, [ebp - 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x41c]
push eax
push ecx
push edx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x208
call dword [0x422338]
lea eax, [ebp - 0x41c]
lea ecx, [ebp - 0x214]
push eax
push str._smodules360inst.exe
push 0x104
push ecx
call dword [0x4222e4]
lea edx, [ebp - 0x214]
push edx
call fcn.00414b7a
add esp, 0x14
test eax, eax
jne 0x40ca93
lea esp, [ebp - 0x630]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], si
cmp ebx, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jne 0x40cab6
xor edi, edi
jmp 0x40cae5
push ebx
call dword [0x4220e8]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00417920
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [0x4220ec]
xor esi, esi
lea eax, [ebp - 0x214]
push edi
push eax
push str.__s___s
lea ecx, [ebp - 0x624]
push 0x104
push ecx
call dword [0x4222e4]
mov ecx, dword [ebp - 4]
add esp, 0x14
lea edx, [ebp - 0x624]
push esi
push esi
push esi
push edx
call fcn.0040c930
lea esp, [ebp - 0x630]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d080
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
cmp ebx, edx
push edi
mov dword [ebp - 8], ecx
je 0x40d23c
cmp byte [ebx], 0
je 0x40d23c
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61e]
mov word [ebp - 0x620], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 8]
lea ecx, [ebp - 0x620]
push eax
lea edx, [ebp - 4]
push ecx
push edx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [ebp - 4], 1
mov dword [ebp + 8], 0x208
call dword [0x422338]
push ebx
call dword [0x4220e8]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00417920
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [0x4220ec]
mov esi, dword [0x4222e4]
lea eax, [ebp - 0x620]
push edi
push eax
push str._smodules_s
lea ecx, [ebp - 0x210]
push 0x104
push ecx
call esi
add esp, 0x14
lea edx, [ebp - 0x210]
push edx
call dword [0x42234c]
test eax, eax
je 0x40d23c
lea eax, [ebp - 0x210]
push eax
call fcn.00414b7a
add esp, 4
test eax, eax
je 0x40d23c
mov ebx, dword [ebp + 0xc]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
mov word [ebp - 0x418], 0
rep stosd dword es:[edi], eax
test ebx, ebx
stosw word es:[edi], ax
je 0x40d1fb
cmp byte [ebx], 0
je 0x40d1fb
push ebx
call dword [0x4220e8]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00417920
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [0x4220ec]
lea ecx, [ebp - 0x210]
push edi
push ecx
push str.__s___s
lea edx, [ebp - 0x418]
push 0x104
push edx
call dword [0x4222e4]
add esp, 0x14
jmp 0x40d218
lea eax, [ebp - 0x210]
lea ecx, [ebp - 0x418]
push eax
push str.__s_
push 0x104
push ecx
call esi
add esp, 0x10
mov ecx, dword [ebp - 8]
push 0
push 0
lea edx, [ebp - 0x418]
push 0
push edx
call fcn.0040c930
lea esp, [ebp - 0x62c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea esp, [ebp - 0x62c]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40d2a0
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0040de20
mov byte [esi], 0x80
pop esi
ret
Function at 0x40eb10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4f0
test eax, eax
push ebx
push esi
push edi
je 0x40ed14
mov esi, dword [esp + 0x504]
test esi, esi
je 0x40ed14
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [0x42200c]
test eax, eax
jne 0x40eca4
mov ebx, dword [section..rdata]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push 0
lea edx, [esp + 0xfc]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x3c], 0x104
call dword [0x422004]
test eax, eax
jne 0x40ec92
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push eax
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [0x42200c]
test eax, eax
jne 0x40ec89
lea edx, [esp + 0x18]
lea eax, [esp + 0x2f4]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x30], 0x208
call ebx
test eax, eax
jne 0x40ec7e
mov ecx, 0x19
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x88]
push 0x64
lea ecx, [esp + 0x2f8]
push eax
push ecx
call fcn.0040ed20
add esp, 0xc
test eax, eax
je 0x40ec7e
mov al, byte [esp + 0x24]
test al, al
je 0x40ec47
lea edx, [esp + 0x24]
lea eax, [esp + 0x88]
push edx
push eax
call dword [0x4220a4]
test eax, eax
jge 0x40ec7e
lea edx, [esp + 0x88]
lea ecx, [esp + 0x24]
mov esi, 0x64
lea eax, [esp + 0x24]
sub edx, ecx
lea ecx, [esi + 0x7fffff9a]
test ecx, ecx
je 0x40ec76
mov cl, byte [edx + eax]
test cl, cl
je 0x40ec76
mov byte [eax], cl
inc eax
dec esi
jne 0x40ec5d
jmp 0x40ec7a
test esi, esi
jne 0x40ec7b
dec eax
mov byte [eax], 0
mov edx, dword [esp + 0x14]
push edx
call dword [0x422008]
inc dword [esp + 0x10]
jmp 0x40eb6c
mov eax, dword [esp + 0xc]
push eax
call dword [0x422008]
mov esi, dword [esp + 0x504]
mov al, byte [esp + 0x24]
test al, al
je 0x40ed14
xor eax, eax
cmp esi, 0x7fffffff
jbe 0x40ecbb
mov eax, 0x80070057
test eax, eax
jl 0x40ed01
mov edx, dword [esp + 0x504]
mov eax, dword [esp + 0x500]
mov edi, 0x7ffffffe
xor ebx, ebx
sub edi, edx
lea edx, [esp + 0x24]
sub edx, eax
lea ecx, [edi + esi]
test ecx, ecx
je 0x40ecf2
mov cl, byte [edx + eax]
test cl, cl
je 0x40ecf2
mov byte [eax], cl
inc eax
dec esi
jne 0x40ecdc
jmp 0x40ecf6
test esi, esi
jne 0x40ecfc
dec eax
mov ebx, 0x8007007a
mov byte [eax], 0
mov eax, ebx
xor edx, edx
pop edi
test eax, eax
setge dl
pop esi
mov eax, edx
pop ebx
add esp, 0x4f0
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4f0
ret
Function at 0x40f250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c4
mov al, byte [0x42bf74]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0xd0], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd1]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x68]
push ebx
push ecx
stosb byte es:[edi], al
call entry0
mov edx, dword [esp + 0x1e0]
add esp, 8
lea eax, [esp + 0xd0]
push edx
push 0x429d28
push 0x104
push eax
call fcn.0040f6d0
lea edi, [esp + 0xe0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xe4]
push ecx
push edx
call fcn.00401060
lea eax, [esp + 0x84]
push eax
call fcn.00401aa0
lea ecx, [esp + 0x88]
push ecx
call fcn.00401aa0
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xec]
mov dword [esp + 0x40], eax
xor eax, eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x44], ecx
mov word [esp + 0x39], ax
mov ecx, 0xf
lea edi, [esp + 0x4d]
mov byte [esp + 0x3b], al
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0xe4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebp, dword [0x422260]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0xf0]
mov ecx, 0x10
stosb byte es:[edi], al
xor eax, eax
lea edi, [esp + 0x4c]
add esp, 0x24
mov dword [esp + 0x24], edx
mov byte [esp + 0x10], bl
xor esi, esi
rep stosd dword es:[edi], eax
xor edx, edx
xor ecx, ecx
mov dl, byte [esp + esi + 0x18]
lea eax, [esp + 0x10]
push edx
push str._02x
mov dword [esp + 0x18], ecx
push 8
push eax
mov dword [esp + 0x24], ecx
call fcn.0040f6d0
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x40
sub edx, ecx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jge 0x40f39d
mov ecx, edx
jmp 0x40f3ab
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
push edx
call ebp
add esp, 0xc
inc esi
cmp esi, 0x10
jl 0x40f34f
mov esi, dword [esp + 0x1dc]
cmp esi, ebx
je 0x40f403
mov edx, dword [esp + 0x1e0]
xor eax, eax
mov ecx, edx
mov edi, esi
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push 0x429d28
push edx
push esi
call fcn.0040f6d0
push esi
call dword [0x422264]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c4
ret
Function at 0x40f440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x508
push ebx
mov ebx, dword [esp + 0x510]
push ebp
push esi
test ebx, ebx
push edi
je 0x40f5f1
mov ebp, dword [esp + 0x520]
cmp ebp, 0x20
jb 0x40f5f1
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x118]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
push ecx
push edx
push 0x429d44
push str.Software360SafeLiveup
push 0x80000002
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x400
call dword [0x42233c]
test eax, eax
jne 0x40f5f1
lea edi, [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x40
jne 0x40f5f1
lea edx, [esp + 0x118]
lea ecx, [esp + 0x18]
mov esi, 0x80
lea eax, [esp + 0x18]
sub edx, ecx
lea ecx, [esi - 0x60]
test ecx, ecx
je 0x40f4fc
mov cl, byte [edx + eax]
test cl, cl
je 0x40f4fc
mov byte [eax], cl
inc eax
dec esi
jne 0x40f4e6
jmp 0x40f500
test esi, esi
jne 0x40f501
dec eax
lea edx, [esp + 0x138]
lea ecx, [esp + 0x98]
mov byte [eax], 0
mov esi, 0x80
lea eax, [esp + 0x98]
sub edx, ecx
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x40f539
mov cl, byte [edx + eax]
test cl, cl
je 0x40f539
mov byte [eax], cl
inc eax
dec esi
jne 0x40f520
jmp 0x40f53d
test esi, esi
jne 0x40f53e
dec eax
mov byte [eax], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x118]
push 0x400
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.0040f250
add esp, 0xc
lea ecx, [esp + 0x98]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [0x4220a8]
test eax, eax
jne 0x40f5f1
test ebp, ebp
je 0x40f591
cmp ebp, 0x7fffffff
jbe 0x40f596
mov eax, 0x80070057
test eax, eax
jl 0x40f5dd
mov eax, ebx
xor ebx, ebx
test ebp, ebp
mov edx, ebp
je 0x40f5d2
mov ecx, dword [esp + 0x51c]
mov edi, 0x7ffffffe
lea esi, [esp + 0x18]
sub edi, ebp
sub esi, ecx
lea ecx, [edi + edx]
test ecx, ecx
je 0x40f5ce
mov cl, byte [esi + eax]
test cl, cl
je 0x40f5ce
mov byte [eax], cl
inc eax
dec edx
jne 0x40f5b8
jmp 0x40f5d2
test edx, edx
jne 0x40f5d8
dec eax
mov ebx, 0x8007007a
mov byte [eax], 0
mov eax, ebx
xor edx, edx
pop edi
test eax, eax
sete dl
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x508
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x508
ret
Function at 0x40fa70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x420782
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
mov al, byte [esp + 0x30]
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x14], al
call dword [0x422170]
lea ecx, [esp + 0x34]
lea edx, [esp + 8]
push ecx
push edx
mov ecx, 0x42ea68
mov byte [esp + 0x30], 1
call fcn.00411940
mov eax, dword [esp + 8]
mov ecx, dword [0x42ea6c]
cmp eax, ecx
je 0x40faea
add eax, 0xc
push eax
lea eax, [esp + 0x38]
push eax
call dword [0x422160]
add esp, 8
test al, al
jne 0x40faea
lea eax, [esp + 8]
jmp 0x40faf8
mov ecx, dword [0x42ea6c]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ecx
mov eax, dword [eax]
mov ecx, dword [0x42ea6c]
cmp ecx, eax
je 0x40fb1c
mov edx, dword [0x422174]
add eax, 0x1c
mov ecx, dword [edx]
push ecx
push ebx
push eax
lea ecx, [esp + 0x1c]
call dword [0x4221a8]
mov esi, dword [esp + 0x30]
mov dl, byte [esp + 0x10]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x422174]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
mov ecx, esi
call dword [0x4221a8]
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x40fb69
mov al, byte [ecx - 1]
cmp al, bl
je 0x40fb5f
cmp al, 0xff
je 0x40fb5f
dec al
mov byte [ecx - 1], al
jmp 0x40fb69
dec ecx
push ecx
call fcn.00414b0e
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], ebx
cmp ecx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
je 0x40fbaa
mov al, byte [ecx - 1]
cmp al, bl
je 0x40fba0
cmp al, 0xff
je 0x40fba0
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
dec ecx
push ecx
call fcn.00414b0e
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x40fbc0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x420798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.0040c070
mov eax, dword [esp + 0xa4]
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x90], 0
call fcn.0040d060
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x98]
push edx
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.0040c120
cmp eax, 1
jne 0x40fc90
mov edx, dword [esp + 0x28]
push 5
push edx
call dword [0x4223b0]
mov esi, dword [0x422378]
xor eax, eax
mov ecx, 6
lea edi, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
push eax
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x40fc90
mov edi, dword [0x4223f4]
push ebx
mov ebx, dword [0x422370]
lea ecx, [esp + 0xc]
push ecx
call edi
lea edx, [esp + 0xc]
push edx
call ebx
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
call esi
test eax, eax
jne 0x40fc70
pop ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x8c], 0xffffffff
call fcn.0040c100
mov ecx, dword [esp + 0x84]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x88
ret
Function at 0x40fcc0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4207bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.00401bf0
mov eax, dword [esp + 0xbc]
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0xa8], 0
call fcn.00402990
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0xb4]
mov eax, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push edx
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.00401ca0
cmp eax, 1
jne 0x40fd93
mov edx, dword [esp + 0x28]
push 5
push edx
call dword [0x4223b0]
mov esi, dword [0x422378]
xor eax, eax
mov ecx, 6
lea edi, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
push eax
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x40fd93
mov edi, dword [0x4223f4]
push ebx
mov ebx, dword [0x422370]
lea ecx, [esp + 0xc]
push ecx
call edi
lea edx, [esp + 0xc]
push edx
call ebx
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
call esi
test eax, eax
jne 0x40fd73
pop ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0xa4], 0xffffffff
call fcn.00401c80
mov ecx, dword [esp + 0x9c]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0xa0
ret
Function at 0x40ff60
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x620
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
lea ecx, [esp + 0x218]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x208
call dword [0x422338]
mov esi, dword [0x4222e4]
test eax, eax
jne 0x40fff7
lea eax, [esp + 0x218]
lea ecx, [esp + 0x10]
push eax
push str._s360Util.dll
push 0x103
push ecx
call esi
add esp, 0x10
cmp word [esp + 0x10], 0
je 0x41000e
lea edx, [esp + 0x10]
push edx
call dword [0x42234c]
test eax, eax
jne 0x41004d
lea eax, [esp + 0x218]
push 0x103
push eax
push 0
call dword [0x4220b0]
lea ecx, [esp + 0x218]
push ecx
call dword [0x422334]
lea edx, [esp + 0x218]
lea eax, [esp + 0x10]
push edx
push str._s360Util.dll
push 0x103
push eax
call esi
add esp, 0x10
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x422]
mov word [esp + 0x420], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x420]
push 0x103
lea edx, [esp + 0x14]
push ecx
push edx
stosw word es:[edi], ax
call fcn.0040b220
add esp, 0xc
test eax, eax
pop edi
pop esi
je 0x4100e8
lea eax, [esp + 0x418]
push str.1.0.0.1032
push eax
call dword [0x42227c]
add esp, 8
test eax, eax
jl 0x4100e8
lea ecx, [esp + 8]
push ecx
call dword [0x4220ac]
test eax, eax
mov dword [0x42eb8c], eax
jne 0x4100ed
lea edx, [esp + 8]
push edx
call fcn.00414b7a
add esp, 4
test eax, eax
je 0x4100e8
lea eax, [esp + 8]
push eax
call dword [0x42209c]
xor ecx, ecx
mov dword [0x42eb8c], eax
test eax, eax
setne cl
mov eax, ecx
add esp, 0x620
ret
mov eax, dword [0x42eb8c]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 0x620
ret