joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x410], 0
mov ecx, dword [ebp - 0x21c]
call fcn.0040e630
movzx ecx, al
test ecx, ecx
jne 0x40e42f
xor al, al
jmp 0x40e61c
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x210]
push ecx
push str._SystemDrive_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jne 0x40e4a0
push 2
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x208
push eax
call fcn.004ec31c
add esp, 0xc
test eax, eax
jne 0x40e4a0
movzx ecx, word [ebp - 0x20c]
test ecx, ecx
je 0x40e4b4
mov edx, dword [ebp - 0x21c]
mov byte [edx + 0x410], 1
mov al, 1
jmp 0x40e61c
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x210]
push ecx
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x208
push eax
call fcn.004ec19f
add esp, 8
test eax, eax
je 0x40e51a
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x410], 1
mov al, 1
jmp 0x40e61c
push 0x208
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.004ebd80
add esp, 0xc
push 0x103
lea eax, [ebp - 0x210]
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x214], eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x21c]
add edx, 0x208
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
je 0x40e581
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x410], 1
mov al, 1
jmp 0x40e61c
push 0x208
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x103
lea edx, [ebp - 0x210]
push edx
push str._ComSpec_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x21c]
push eax
call fcn.004ebfed
add esp, 4
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call fcn.004ec31c
add esp, 0xc
test eax, eax
jne 0x40e609
push str.cmd.exe
mov ecx, dword [ebp - 0x218]
lea edx, [ebp + ecx*2 - 0x210]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
je 0x40e61a
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x410], 1
mov al, 1
jmp 0x40e61c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x40e630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
test ecx, ecx
jne 0x40e670
push 0x103
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jb 0x40e664
cmp dword [ebp - 4], 0x104
jb 0x40e670
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov word [ecx], ax
xor al, al
jmp 0x40e6b7
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 0x208]
test eax, eax
jne 0x40e6b5
push 0x103
mov ecx, dword [ebp - 0xc]
add ecx, 0x208
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jb 0x40e6a5
cmp dword [ebp - 8], 0x104
jb 0x40e6b5
xor edx, edx
mov eax, dword [ebp - 0xc]
mov word [eax + 0x208], dx
xor al, al
jmp 0x40e6b7
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x40e6c0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], ecx
mov eax, dword [ebp - 0x22c]
add eax, 0x208
push eax
push str.windir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0x22c]
add ecx, 0x208
push ecx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004ebd80
add esp, 0xc
mov ecx, dword [str.cmd.exe]
mov dword [ebp - 0x228], ecx
mov edx, dword [0x50cb64]
mov dword [ebp - 0x224], edx
mov eax, dword [0x50cb68]
mov dword [ebp - 0x220], eax
mov ecx, dword [0x50cb6c]
mov dword [ebp - 0x21c], ecx
mov dx, word [0x50cb70]
mov word [ebp - 0x218], dx
mov eax, dword [ebp - 0x22c]
push eax
call fcn.004ebfed
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x22c]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0040ee20
lea eax, [ebp - 0x228]
push eax
mov ecx, 0x104
sub ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x214]
lea eax, [ebp + edx*2 - 0x210]
push eax
call fcn.0040ee20
lea ecx, [ebp - 0x210]
push ecx
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
mov word [ebp - 0x20c], dx
lea eax, [ebp - 0x210]
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x40f150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x40f172
cmp dword [ebp + 0x10], 0
je 0x40f172
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax]
test ecx, ecx
je 0x40f172
cmp dword [ebp + 0xc], 0
jne 0x40f179
xor eax, eax
jmp 0x40f1fd
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40f1a7
xor eax, eax
jmp 0x40f1fd
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
shl ecx, 1
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push str.Path
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
je 0x40f1f1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ebfed
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x40f230
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x40f24f
cmp dword [ebp + 0xc], 0
jne 0x40f253
xor eax, eax
jmp 0x40f29f
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004ebd80
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x50cdb4
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040f2b0
add esp, 0x14
test eax, eax
jge 0x40f292
xor eax, eax
jmp 0x40f29f
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x411540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00410ec0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.00422a60
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.00411830
lea ecx, [ebp - 0x438]
call fcn.00422a60
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.00410f20
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4115be
call fcn.00410f30
mov dword [ebp - 0x444], eax
jmp 0x411713
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x4115ef
call fcn.00410f30
mov dword [ebp - 0x444], eax
jmp 0x411713
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x41161f
call fcn.00410f30
mov dword [ebp - 0x444], eax
jmp 0x411713
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x41166f
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.004143f0
lea ecx, [ebp - 0x2c]
call fcn.00414040
mov eax, dword [ebp - 0x44c]
jmp 0x411748
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00414410
lea ecx, [ebp - 0x438]
call fcn.0044ea20
test eax, eax
jne 0x41169c
mov dword [ebp - 0x444], 0x8007000e
jmp 0x411713
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.0044ea20
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.00410ec0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x4116de
call fcn.00410f30
mov dword [ebp - 0x444], eax
jmp 0x411713
lea ecx, [ebp - 0x438]
call fcn.0044ea20
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.0044ea20
push eax
lea ecx, [ebp - 0x18]
call fcn.00411860
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x411723
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.004143f0
lea ecx, [ebp - 0x2c]
call fcn.00414040
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4130b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00427e30
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00413040
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41311b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00412e30
mov eax, dword [ebp - 0x224]
jmp 0x4131ac
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x413181
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004130b0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x413178
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00412e30
mov eax, dword [ebp - 0x228]
jmp 0x4131ac
mov dword [ebp - 4], 0x100
jmp 0x413122
lea ecx, [ebp - 0x14]
call fcn.00412f70
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00412eb0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00412e30
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4
Function at 0x413710
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x413719
xor ecx, ecx
jne 0x413719
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41373a
mov eax, 0xd
jmp 0x413795
xor eax, eax
jne 0x413721
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x41374b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x414cd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.004ec880
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2014], ecx
mov dword [ebp - 0x180c], 0x400
push 0x800
push 0
lea eax, [ebp - 0x1008]
push eax
call fcn.004ebd80
add esp, 0xc
push str.Config_newui
mov ecx, dword [ebp - 0x2014]
add ecx, 0x18
call fcn.0044ea20
push eax
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x800
push 0
lea edx, [ebp - 0x1808]
push edx
call fcn.004ebd80
add esp, 0xc
push str.ConfigBase.ini
mov ecx, dword [ebp - 0x2014]
call fcn.00416d90
mov ecx, eax
call fcn.0044ea20
push eax
lea eax, [ebp - 0x1808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x1808]
push ecx
call fcn.004180f0
add esp, 4
test eax, eax
jne 0x414d86
jmp 0x414e45
push 0x800
push 0
lea edx, [ebp - 0x2010]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 0x1808]
push eax
push 0x3fc
lea ecx, [ebp - 0x2010]
push ecx
push 0
push str.ConfigDir
push str.Main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x2010]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x414dd6
jmp 0x414e45
push 0x800
push 0
lea eax, [ebp - 0x808]
push eax
call fcn.004ebd80
add esp, 0xc
lea ecx, [ebp - 0x2010]
push ecx
mov ecx, 0x535320
call fcn.00416d90
mov ecx, eax
call fcn.0044ea20
push eax
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x808]
push eax
call fcn.004180f0
add esp, 4
test eax, eax
jne 0x414e29
jmp 0x414e45
lea ecx, [ebp - 0x808]
push ecx
mov ecx, dword [ebp - 0x2014]
add ecx, 0x1c
call fcn.0040f550
mov eax, 1
jmp 0x414e5f
lea edx, [ebp - 0x1008]
push edx
mov ecx, dword [ebp - 0x2014]
add ecx, 0x1c
call fcn.0040f550
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x415710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5097f0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x533014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
push str.Try_to_terminate_360tray_n
call fcn.00420df0
add esp, 4
mov dword [ebp - 4], 0
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4157c3
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4157c3
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4157c3
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
jmp 0x4157d2
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
add ecx, 0x2c
call fcn.00450b80
push 0
push 0
push 5
push str._repairmain
mov ecx, dword [ebp + 8]
call fcn.0044ea20
push eax
call fcn.00415830
add esp, 0x14
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.Call_360safe.exe__s_repairmain_:__d_n
call fcn.00420df0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4158d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
call fcn.00418350
lea ecx, [ebp - 0xc]
call fcn.00418350
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41591b
cmp dword [ebp - 4], 0
jg 0x415942
push 0x52022c
mov ecx, dword [ebp + 8]
call fcn.0040f510
lea ecx, [ebp - 0xc]
call fcn.004335b0
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov eax, dword [ebp + 8]
jmp 0x4159e9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
lea ecx, [ebp - 0xc]
call fcn.0040f550
lea ecx, [ebp - 0xc]
call fcn.00416e70
push 0
push 0x50d55c
lea ecx, [ebp - 0xc]
call fcn.0040f570
test eax, eax
jl 0x415979
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040f550
mov dword [ebp - 8], 1
jmp 0x41598b
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x4159c0
lea ecx, [ebp - 0x14]
call fcn.0047ef80
test eax, eax
jle 0x4159ac
push 0x50d558
lea ecx, [ebp - 0x14]
call fcn.0040e800
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040e800
jmp 0x415982
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0xc]
call fcn.004335b0
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x416800
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [0x53510c], 0
jne 0x416842
mov dword [0x53510c], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
push str._Prefetch
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x416842
mov dword [0x535108], 1
mov eax, dword [0x535108]
mov esp, ebp
pop ebp
ret
Function at 0x416960
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x834], ecx
push 0
mov ecx, dword [ebp - 0x834]
call fcn.00416940
mov eax, dword [ebp - 0x834]
cmp dword [eax + 0x14], 0
je 0x416aa2
push 0x410
push 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 4], 0x207
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x834]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 0x834]
mov ecx, dword [eax + 0x14]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x18]
call eax
test eax, eax
je 0x416aa2
push str.default
lea ecx, [ebp - 0x418]
push ecx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x4169fd
jmp 0x416aa2
push 0x410
push 0
lea edx, [ebp - 0x830]
push edx
call fcn.004ebd80
add esp, 0xc
mov ecx, dword [ebp - 0x834]
add ecx, 0x18
call fcn.0044ea20
push eax
push 0x208
lea eax, [ebp - 0x830]
push eax
call fcn.0040ee20
push str.Config_newui_themes_
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.skin.ini
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x830]
push edx
push 0
push str.isAll
push str.skin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x41c], eax
xor eax, eax
cmp dword [ebp - 0x41c], 1
sete al
push eax
mov ecx, dword [ebp - 0x834]
call fcn.00416940
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x416ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x416d80
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp + 0xc]
shl ecx, 1
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.Path
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ebfed
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x416d7b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
cmp ecx, 0x5c
je 0x416d7b
mov edx, 0x5c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
jmp 0x416d82
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4176d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.00417aa0
add esp, 4
test eax, eax
je 0x4176ea
mov eax, 1
jmp 0x417712
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4176fc
xor eax, eax
jmp 0x417712
push 1
call fcn.00417720
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00417730
add esp, 0xc
xor eax, eax
pop ebp
ret

Function at 0x417910
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18

Function at 0x417970
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x820], 0x400
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x814], 0x800
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x80c]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x417a03
mov eax, 1
jmp 0x417a8a
push 0x50d914
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417a34
mov eax, 1
jmp 0x417a8a
lea edx, [ebp - 0x808]
push edx
call fcn.00417dc0
add esp, 4
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x417a59
mov eax, 1
jmp 0x417a8a
push str.IsBetaVersion
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
call dword [ebp - 4]
mov dword [ebp - 0x818], eax
mov ecx, dword [ebp - 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x818]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x417e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 0x1000
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret 4