joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035690
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x12c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
mov ecx, 6
mov esi, 0x100a0d14
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x104
mov esi, 0x1591
lea eax, [esp + 0x16]
mov edi, 9
jmp 0x100356e0
mov dl, byte [eax - 2]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov ecx, esi
imul esi, esi, 0x343fd
shr ecx, 0x10
and ecx, 0x7fff
movzx ebx, dl
sub dl, cl
add esi, 0x269ec3
mov ecx, esi
imul esi, esi, 0x343fd
mov byte [eax - 2], dl
mov dl, byte [eax - 1]
shr ecx, 0x10
and ecx, 0x7fff
movzx ebx, dl
sub dl, cl
add esi, 0x269ec3
mov byte [eax - 1], dl
mov dl, byte [eax]
mov ecx, esi
shr ecx, 0x10
and ecx, 0x7fff
movzx ebx, dl
sub dl, cl
mov byte [eax], dl
add eax, 3
sub edi, 1
jne 0x100356e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x14]
push edx
push str.ExeString
lea eax, [esp + 0x24]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x100357a0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100357a0
mov eax, 1
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.10079a05
add esp, 0x12c
ret
mov ecx, dword [esp + 0x128]
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x12c
ret

Function at 0x10035f20
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push edi
xor edi, edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], edi
mov dword [esp + 0x10], 4
cmp esi, edi
je 0x10036021
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpSendRequestW]
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetQueryOptionW]
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x1003601f
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x10035fd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f0d
je 0x10035f88
cmp eax, 0x2f19
jne 0x10035fc4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1f
push esi
mov dword [esp + 0x2c], 4
call ebp
or dword [esp + 0xc], 0x3180
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x10035f50
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10035f50
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x20000013
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov edi, eax
test edi, edi
je 0x10035fc8
mov eax, dword [esp + 0x10]
cmp eax, 0xc8
je 0x1003601f
cmp eax, 0xce
je 0x1003601f
xor edi, edi
jmp 0x10035f50
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x10037810
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 4]
xor eax, eax
test ecx, ecx
je 0x1003782d
test esi, esi
jbe 0x10037828
mov edi, edi
xor byte [eax + ecx], dl
inc eax
cmp eax, esi
jb 0x10037820
mov eax, 1
ret
Function at 0x10038fc0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push 0x100a0e5c
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10039010
lea ecx, [esp]
push ecx
call eax
jmp 0x1003901a
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
je 0x1003902e
cmp ax, 6
mov eax, 0x20
jne 0x10039033
mov eax, 0x40
add esp, 0x24
ret

Function at 0x100390e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x100390f4
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100a0e80
push esi
call edi
mov dword [0x100df068], eax
test eax, eax
je 0x10039150
push 0x100a0e90
push esi
call edi
mov dword [0x100df06c], eax
test eax, eax
je 0x10039150
push str.RegDeleteKeyExW
push esi
call edi
mov dword [0x100df070], eax
test eax, eax
je 0x10039150
push 0x100a0e9c
push esi
call edi
mov dword [0x100df074], eax
test eax, eax
je 0x10039150
push 0x100a0eac
push esi
call edi
mov dword [0x100df078], eax
test eax, eax
jne 0x10039155
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0xc]
call fcn.10039040
pop edi
pop esi
ret
Function at 0x10039230
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
push esi
mov dword [esp + 4], 0
mov dword [esp + 8], 2
mov esi, 0xf003f
call fcn.10038fc0
cmp eax, 0x40
jne 0x10039198
mov esi, 0xf013f
mov eax, dword [0x100df068]
test eax, eax
je 0x100391e6
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0
push esi
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallA36O90FC_9D81_43B1_8A3C_82802F608193
push connect
call eax
test eax, eax
jne 0x100391e6
mov eax, dword [0x100df078]
test eax, eax
je 0x100391e6
mov ecx, dword [esp + 4]
push str.UninstallString
push ecx
call eax
test eax, eax
jne 0x100391e6
mov eax, dword [0x100df070]
test eax, eax
jne 0x100391fa
mov edx, dword [esp + 4]
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
push 0
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallA36O90FC_9D81_43B1_8A3C_82802F608193
push connect
call eax
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
push esi
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x10039244
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100a0e80
push esi
call edi
mov dword [0x100df068], eax
test eax, eax
je 0x100392a0
push 0x100a0e90
push esi
call edi
mov dword [0x100df06c], eax
test eax, eax
je 0x100392a0
push str.RegDeleteKeyExW
push esi
call edi
mov dword [0x100df070], eax
test eax, eax
je 0x100392a0
push 0x100a0e9c
push esi
call edi
mov dword [0x100df074], eax
test eax, eax
je 0x100392a0
push 0x100a0eac
push esi
call edi
mov dword [0x100df078], eax
test eax, eax
jne 0x100392a5
pop edi
xor eax, eax
pop esi
ret
pop edi
pop esi
jmp 0x10039170

Function at 0x100392b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1007dcf0
add esp, 0xc
xor ebx, ebx
push ebx
push 2
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1003933a
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10039333
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea esp, [esp]
push edi
lea edx, [esp + 0x34]
push edx
call ebp
test eax, eax
je 0x1003932d
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10039310
jmp 0x10039332
mov ebx, 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x230
ret
Function at 0x10039820
Capabilities:
Create process on windows
Delete registry key
Get common file path
Persist via default file association registry key
Self delete
Set registry value

Disassembly:
sub esp, 0x458
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x454], eax
mov eax, dword [esp + 0x460]
push ebx
push ebp
mov ebp, dword [esp + 0x464]
mov dword [esp + 0xc], eax
xor ebx, ebx
mov eax, ebp
mov dword [esp + 8], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10039853
push esi
push edi
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x2000000
push ebx
push ebx
push ebx
sub eax, edx
push str.SoftwareClassesms_settings_shellopencommand
sar eax, 1
push connect
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100398ba
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 2
push 0x1009edfc
push 1
push ebx
push str.DelegateExecute
push edx
call edi
test eax, eax
jne 0x100398ba
mov ecx, dword [esp + 0x10]
lea eax, [esi + esi + 2]
push eax
push ebp
push 1
push ebx
push ebx
push ecx
call edi
push 0x206
lea eax, [esp + 0x5a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x60], dx
call fcn.1007dcf0
push 0x206
lea edx, [esp + 0x26e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x274], cx
call fcn.1007dcf0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add esp, 0x18
push 0x104
lea eax, [esp + 0x58]
push eax
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.Sysnative
lea ecx, [esp + 0x58]
push ecx
call esi
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10039930
push 0x104
lea eax, [esp + 0x58]
push eax
call edi
push str.fodhelper.exe
lea ecx, [esp + 0x58]
push ecx
call esi
push 0x104
lea edx, [esp + 0x260]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.explorer.exe
lea eax, [esp + 0x260]
push eax
call esi
pop edi
mov ecx, 0x3c
lea eax, [esp + 0x14]
pop esi
lea esp, [esp]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10039970
lea eax, [esp + 0x10]
lea ecx, [esp + 0x254]
lea edx, [esp + 0x4c]
push eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x40
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100399df
mov eax, dword [esp + 0xc]
call fcn.10039360
test eax, eax
je 0x100399df
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x454]
xor ecx, esp
call fcn.10079a05
add esp, 0x458
ret
push str.SoftwareClassesms_settings_shellopencommand
push connect
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x100399fe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x45c]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x458
ret

Function at 0x10039a20
Capabilities:
Create process on windows

Disassembly:
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret
Function at 0x10039e20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10093ae0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x2c]
cmp dword [0x100e493c], 0
jne 0x10039f35
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push connect
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x206
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10039f21
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10039f21
lea ecx, [esp + 0x10]
push ecx
push 0x100e4940
lea edx, [esp + 0x1c]
push edx
push 0
push str.path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10039f0a
lea eax, [esp + 0x18]
push eax
mov ecx, 0x100e4940
mov dword [0x100e493c], 1
call fcn.10013050
mov dword [esp + 0x24], 0
mov eax, dword [eax]
push eax
push esi
push ebx
call fcn.1003b7a0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10013100
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10039f75
mov ecx, dword [esp + 0xc]
push ecx
mov dword [0x100e493c], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10039f75
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
lea edx, [esp + 0x18]
push edx
mov ecx, 0x100e4940
call fcn.10013050
mov dword [esp + 0x24], 1
mov eax, dword [eax]
shr esi, 1
mov ecx, esi
je 0x10039f64
cmp ecx, 0x7fffffff
ja 0x10039f64
push eax
mov edx, ebx
call fcn.1006b400
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10013100
mov eax, dword [0x100e493c]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x10039f90
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x418
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x414], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call fcn.1007dcf0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1a]
push eax
mov word [esp + 0x1c], dx
call fcn.1007dcf0
lea ecx, [esp + 0x224]
push ecx
mov ecx, 0x104
call fcn.10039e20
add esp, 0x1c
test eax, eax
jne 0x1003a006
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.10079a05
add esp, 0x418
ret
push esi
lea eax, [esp + 8]
lea esi, [esp + 0x210]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
jmp 0x1003a020
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x1003a040
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003a040
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1003a020
jmp 0x1003a044
test edx, edx
jne 0x1003a047
sub eax, 2
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov word [eax], dx
push str.360leakfixer.exe
lea eax, [esp + 0x14]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
je 0x1003a09c
lea edx, [esp + 0x10]
push edx
lea esi, [esp + 0x10]
mov dword [esp + 0x10], 0xffffffff
call fcn.100259d0
add esp, 4
test eax, eax
je 0x1003a09c
xor eax, eax
cmp dword [esp + 0xc], 4
sete al
test eax, eax
jne 0x1003a104
push str.hipsver.dll
lea eax, [esp + 0x21c]
push eax
call edi
lea ecx, [esp + 0x218]
push ecx
call ebx
test eax, eax
je 0x1003a104
lea edx, [esp + 0x218]
push edx
lea esi, [esp + 0x10]
mov dword [esp + 0x10], 0xffffffff
call fcn.100259d0
add esp, 4
test eax, eax
je 0x1003a104
xor eax, eax
cmp dword [esp + 0xc], 4
sete al
test eax, eax
je 0x1003a104
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.10079a05
add esp, 0x418
ret
mov ecx, dword [esp + 0x420]
pop edi
pop ebx
pop esi
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x418
ret
Function at 0x1003a120
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x100975bb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
push 0x206
xor edi, edi
lea ecx, [esp + 0x22]
xor eax, eax
push edi
push ecx
mov word [esp + 0x28], ax
call fcn.1007dcf0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push connect
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0x206
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003a251
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1003a251
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
push ecx
push edi
push str.path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
jne 0x1003a246
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
call fcn.10013050
mov dword [esp + 0x230], edi
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x23c]
push eax
push esi
call fcn.1003b7a0
mov dword [esp + 0x230], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10013100
push str.dep360.exe
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003a246
mov eax, esi
call fcn.10025aa0
test eax, eax
je 0x1003a246
mov ecx, dword [esp + 0xc]
push ecx
call ebx
mov edi, 1
mov edx, dword [esp + 0xc]
push edx
call ebx
mov eax, edi
jmp 0x1003a253
xor eax, eax
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.10079a05
add esp, 0x228
ret
Function at 0x1003a280
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10094298
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.1007dcf0
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x208
call fcn.10039e20
mov dword [esp + 0x1c], 0
mov dword [esp + 0x234], 1
push 0x208
call fcn.10079b72
add esp, 0x14
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1003a323
mov dword [esp + 0x224], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.10023040
xor eax, eax
jmp 0x1003a3ce
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.QHVer.dll
lea ecx, [esp + 0x14]
push ecx
push eax
call edi
test eax, eax
jne 0x1003a353
mov dword [esp + 0x224], 0xffffffff
lea edx, [esp + 0xc]
push edx
call fcn.10023040
xor eax, eax
jmp 0x1003a3ce
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
je 0x1003a380
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.10023040
mov eax, 1
jmp 0x1003a3ce
mov eax, dword [esp + 0xc]
push str.QHSafeMain.exe
lea edx, [esp + 0x14]
push edx
push eax
call edi
test eax, eax
jne 0x1003a3ae
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0xc]
push ecx
call fcn.10023040
xor eax, eax
jmp 0x1003a3ce
mov edx, dword [esp + 0xc]
push edx
call esi
mov esi, eax
mov dword [esp + 0x224], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.10023040
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10079a05
add esp, 0x21c
ret

Function at 0x1003a690
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x41c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x418], eax
push 0x208
lea eax, [esp + 0x214]
push 0
push eax
call fcn.1007dcf0
push 0x208
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.1007dcf0
lea edx, [esp + 0x228]
push edx
mov ecx, 0x104
call fcn.10039e20
add esp, 0x1c
test eax, eax
je 0x1003a755
push str.safemon360tray.exe
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x1003a755
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003a755
push edi
lea eax, [esp + 8]
push eax
lea edi, [esp + 8]
lea eax, [esp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.10013e60
add esp, 4
cmp dword [esp + 4], 0
pop edi
je 0x1003a755
mov eax, 1
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.10079a05
add esp, 0x41c
ret
mov ecx, dword [esp + 0x418]
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x41c
ret
Function at 0x1003ab30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10093ab1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
xor ebx, ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.1001a210
mov ebp, 1
mov dword [esp + 0x2c], ebp
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1003abc4
push edi
call fcn.1001a210
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x14]
call fcn.10013100
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], 0x208
mov eax, dword [edx - 8]
mov ecx, ebp
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x1003abf3
mov ecx, 0x104
lea eax, [esp + 0x14]
call fcn.1006d450
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push edx
push ebx
push ebx
push str.path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.1007b238
add esp, 8
cmp eax, ebx
jl 0x1003ac62
mov ecx, dword [esp + 0x14]
cmp eax, dword [ecx - 8]
jg 0x1003ac62
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 0x14]
xor edx, edx
mov word [ecx + eax*2], dx
cmp esi, ebx
je 0x1003ac47
push edi
call fcn.1001a210
jmp 0x1003ab9d
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push edi
call fcn.10013410
jmp 0x1003ab9d
push 0x80070057
call fcn.10013cc0
int3
Function at 0x1003ac70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10093ab1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
xor ebx, ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.1001a210
mov ebp, 1
mov dword [esp + 0x2c], ebp
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1003ad04
push edi
call fcn.1001a210
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x14]
call fcn.10013100
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], 0x208
mov eax, dword [edx - 8]
mov ecx, ebp
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x1003ad33
mov ecx, 0x104
lea eax, [esp + 0x14]
call fcn.1006d450
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push edx
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.1007b238
add esp, 8
cmp eax, ebx
jl 0x1003ad9e
mov ecx, dword [esp + 0x14]
cmp eax, dword [ecx - 8]
jg 0x1003ad9e
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 0x14]
xor edx, edx
mov word [ecx + eax*2], dx
cmp esi, ebx
je 0x1003ad83
push edi
call fcn.1001a210
jmp 0x1003acdd
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push edi
call fcn.10013410
jmp 0x1003acdd
push 0x80070057
call fcn.10013cc0
int3