joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a485
Capabilities:
Check if file exists
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
and word [ebp - 0x210], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov dword [ebp - 4], edx
stosw word es:[edi], ax
add edx, 0x210
mov edi, str._s360se.exe
push edx
mov ebx, 0x103
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a5ff
mov eax, dword [ebp - 4]
add eax, 8
push eax
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call esi
and word [ebp - 0x418], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push str.__s_____1_
lea eax, [ebp - 0x418]
push ebx
push eax
call esi
and word [ebp - 0x620], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61e]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push str.360seURL
push str._s_shellopencommand
lea eax, [ebp - 0x620]
push 0x104
push eax
call esi
and word [ebp - 0x828], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x826]
rep stosd dword es:[edi], eax
add esp, 0x10
mov dword [ebp - 8], 1
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov edi, SysReAllocString
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x620]
push 0x42bc4c
push eax
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x828], 0
je 0x40a5d2
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
je 0x40a5ff
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x418]
push eax
push 1
lea eax, [ebp - 0x620]
push 0x42bc4c
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
and word [ebp - 0xa30], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
mov eax, str._tp:2__v:0
cmp dword [ebp + 8], edi
jne 0x40a629
mov eax, str._tp:2__v:1
push eax
lea eax, [ebp - 0x210]
push eax
push str.__s___s
lea eax, [ebp - 0xa30]
push ebx
push eax
call esi
add esp, 0x14
cmp dword [ebp + 0xc], edi
push edi
je 0x40a650
push 0x2710
jmp 0x40a652
push 0xffffffffffffffff
lea eax, [ebp - 0xa30]
push edi
push eax
call fcn.0040d6aa
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a92f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push esi
mov ebx, ecx
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], si
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40aa5d
mov edx, 0x82
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x622]
mov word [ebp - 0x624], si
mov word [ebp - 0x418], si
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, edx
lea edi, [ebp - 0x416]
add ebx, 0x210
rep stosd dword es:[edi], eax
push ebx
mov edi, 0x104
push 0x4290e4
lea eax, [ebp - 0x624]
push edi
push eax
call esi
push 0x4290e0
push ebx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 0x18
test eax, eax
je 0x40aa5d
add eax, 2
push eax
push 0x4205a0
lea eax, [ebp - 0x418]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncat]
dec edi
push edi
lea eax, [ebp - 0x20c]
push str.LocalVirtualStore_
push eax
call esi
lea eax, [ebp - 0x418]
add esp, 0xc
test eax, eax
je 0x40aa5d
cmp word [ebp - 0x418], 0
je 0x40aa5d
lea eax, [ebp - 0x418]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40aa5d
lea eax, [ebp - 0x20c]
mov dword [ebp - 4], 1
push eax
call fcn.0040dfb4
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aa65
Capabilities:
Check if file exists
Delete directory
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
lea eax, [ecx + 0x210]
xor edx, edx
mov dword [ebp - 8], eax
cmp word [eax], dx
jne 0x40aa82
xor eax, eax
leave
ret
push ebx
push esi
mov ebx, 0x81
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x210]
push 0x1a
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push str.360NotifyBin360seNotify.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
test eax, eax
je 0x40ab65
lea eax, [ebp - 0x210]
push 0x1388
push eax
call fcn.0040d1b7
and word [ebp - 0x418], 0
pop ecx
pop ecx
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push str.__s___Uninstall:360se
lea eax, [ebp - 0x418]
push 0x104
push eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0xbb8
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.0040d6aa
add esp, 0x20
test eax, eax
je 0x40ab65
cmp dword [ebp - 4], 0
jne 0x40ab65
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call fcn.0040dfb4
pop ecx
mov dword [ebp - 4], str.extensions
mov ebx, 0x103
xor eax, eax
cmp dword [ebp - 4], eax
je 0x40ac81
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x208], eax
je 0x40ac45
push dword [ebp - 4]
mov ecx, 0x81
lea edi, [ebp - 0x416]
mov word [ebp - 0x418], ax
push dword [ebp - 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._s_s
lea eax, [ebp - 0x418]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40ac81
and word [ebp - 0x620], ax
push dword [ebp - 4]
mov ecx, 0x81
lea edi, [ebp - 0x61e]
push dword [ebp - 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4290ec
lea eax, [ebp - 0x620]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ac1a
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40ac81
push 4
lea eax, [ebp - 0x620]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40ac81
push dword [ebp - 4]
mov word [ebp - 0x828], ax
mov ecx, 0x81
xor eax, eax
push dword [ebp - 8]
lea edi, [ebp - 0x826]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._s_s
lea eax, [ebp - 0x828]
push ebx
push eax
call esi
lea eax, [ebp - 0x828]
push eax
call fcn.0040dfb4
add esp, 0x18
add dword [ebp - 4], 0x20c
cmp dword [ebp - 4], 0x428a04
jl 0x40ab71
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aca6
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
push ebx
push esi
mov esi, 0x81
push edi
xor ebx, ebx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40ae39
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
mov edi, 0x104
push eax
push str._s360NotifyBin360seNotify.exe
lea eax, [ebp - 0x410]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ad56
lea eax, [ebp - 0x208]
push eax
push str._s360Notify
lea eax, [ebp - 0x410]
push edi
push eax
call esi
lea eax, [ebp - 0x410]
push eax
call fcn.0040dfb4
add esp, 0x14
mov ebx, 0x103
lea eax, [ebp - 0x208]
push ebx
push str.360se
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
and word [ebp - 0xa28], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa26]
rep stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push str.data_bookmarks.dat
push eax
push str._s_s
lea eax, [ebp - 0xa28]
push ebx
push eax
call esi
and word [ebp - 0x820], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x81e]
rep stosd dword es:[edi], eax
add esp, 0x14
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push str.data360sefav.db
push eax
push str._s_s
lea eax, [ebp - 0x820]
push ebx
push eax
call esi
and word [ebp - 0x618], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x616]
rep stosd dword es:[edi], eax
add esp, 0x14
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push str.dataDailyBackup
push eax
push str._s_s
lea eax, [ebp - 0x618]
push ebx
push eax
call esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0040e13e
add esp, 0x24
jmp 0x40ae3b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aeb2
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], esi
cmp word [esi + 0x210], bx
jne 0x40aed4
xor eax, eax
jmp 0x40af6a
mov edx, 0x81
push edi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esi, 8
mov ebx, str._s360se.exe
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, 0x103
push ebx
lea eax, [ebp - 0x414]
push edi
push eax
call esi
mov eax, dword [ebp - 4]
add esp, 0x10
add eax, 0x210
push eax
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call esi
mov ecx, dword [ebp - 4]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a432
test eax, eax
pop edi
je 0x40af67
lea eax, [ebp - 0x414]
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
pop eax
pop esi
pop ebx
leave
ret

Function at 0x40af6e
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebx + 8]
push eax
push str._s360se.exe
lea eax, [ebp - 0x208]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
lea eax, [ebp - 0x208]
push 0
push eax
call esi
push 4
add ebx, 0x210
push 0
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b046
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
cmp word [ecx + 0x210], 0
push esi
lea esi, [ecx + 0x210]
push edi
je 0x40b10b
and word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push 0x42bc4c
push str.http_shellopencommand
push SysReAllocString
mov dword [ebp - 8], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x210], 0
je 0x40b10b
and word [ebp - 0x418], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push str.__s360SE.exe_____1_
lea eax, [ebp - 0x418]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40b10b
push 1
pop eax
jmp 0x40b10d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40b1c2
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
push edi
push dword [ebp + 8]
call ebx
test eax, eax
pop ecx
je 0x40b2ee
mov edx, 0x81
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x236]
mov word [ebp - 0x238], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x43e]
mov word [ebp - 0x440], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x440]
push 0x26
push eax
push esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x440]
push eax
push str._sInternet_Exploreriexplore.exe
lea eax, [ebp - 0x238]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x238]
push eax
call edi
test eax, eax
jne 0x40b29e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x42bc4c
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x238]
push eax
call edi
test eax, eax
jne 0x40b29e
mov word [ebp - 0x238], si
lea eax, [ebp - 0x238]
push eax
call ebx
test eax, eax
pop ecx
jbe 0x40b2d0
push 0xa
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x238]
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40b36a
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 0x41b718
push 0x15
push esi
push 0x41b708
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x40b2f2
xor eax, eax
jmp 0x40b36d
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x40b36a
lea edx, [ebp - 4]
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
cmp dword [ebp - 4], esi
je 0x40b322
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [ebp - 0x20]
mov edi, eax
push edx
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20]
mov word [ebp - 0x20], si
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x30]
mov word [ebp - 0x30], 8
mov dword [ebp - 0x28], edi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40b374
Capabilities:
Check if file exists
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [ebp + 8]
push esi
test eax, eax
push edi
mov dword [ecx + 0x430], eax
je 0x40b3ac
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, SysReAllocString
push str.Software360360se3
push edi
call esi
push str.Software360360se5
push edi
call esi
jmp 0x40b46f
and word [ebp - 0x410], 0
mov esi, 0x81
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40e]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40b46f
and word [ebp - 0x208], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
stosw word es:[edi], ax
lea eax, [ebp - 0x410]
mov edi, 0x103
push eax
push str._s360se
lea eax, [ebp - 0x208]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b43a
lea eax, [ebp - 0x208]
push eax
call fcn.0040df30
pop ecx
lea eax, [ebp - 0x208]
push eax
push 0x42964c
lea eax, [ebp - 0x410]
push edi
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
push 0x429648
push str.IsSave
push str.addunstall
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret 4

Function at 0x40b475
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
and word [ebp - 0x414], 0
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebx, 0x103
stosw word es:[edi], ax
lea eax, [edx + 0x210]
mov dword [ebp - 4], eax
push eax
push str.__s_seup.exe___delv3cfg
lea eax, [ebp - 0x414]
push ebx
push eax
call esi
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push dword [ebp - 4]
lea eax, [ebp - 0x20c]
push str._s_seup.exe
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40b51d
push 0
push 0xbb8
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0040d6aa
add esp, 0x10
leave
ret
Function at 0x40b51f
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 4
pop eax
xor ebx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push str.ShellMode
push str.Software360360se5defaultoption
push SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, 0x81
xor eax, eax
cmp dword [ebp - 4], ebx
lea edi, [ebp - 0x212]
mov word [ebp - 0x214], bx
lea ebx, [esi + 0x210]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
jne 0x40b587
push str.__s_seup.exe___uninstall
jmp 0x40b58c
push str.__s_seup.exe___uninstall__m
mov esi, 0x103
lea eax, [ebp - 0x214]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
and word [ebp - 0x41c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push ebx
push str._s_seup.exe
lea eax, [ebp - 0x41c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40b5fe
push 0
push 0xbb8
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0040d6aa
add esp, 0x10
leave
ret
Function at 0x40beb6
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 1
mov dword [ebp - 4], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, 0x81
mov dword [0x42c688], eax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0xa2a]
mov word [ebp - 0xa2c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa2c]
push 0x103
push eax
call fcn.0040df11
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push esi
push eax
push esi
push esi
push esi
push 0x2710
push 1
push esi
push 1
push esi
push esi
push str.http:__dl.360safe.com_se_uninstdat.cab
call fcn.0040ccfc
add esp, 0x38
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c087
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x61a]
mov word [ebp - 0x61c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x822]
mov word [ebp - 0x824], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x61c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x61c]
push str.uninstdat.dll
push eax
lea eax, [ebp - 0x824]
push eax
call edi
lea eax, [ebp - 0x61c]
push 0x4297e0
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
mov edi, dword [ebp - 4]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.0040c08c
test eax, eax
je 0x40c02d
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040bcd4
mov ecx, edi
call fcn.0040b6ba
test eax, eax
je 0x40c027
mov ecx, edi
call fcn.0040b848
mov dword [0x42c69c], 1
jmp 0x40c02d
mov dword [0x42c69c], esi
push dword [0x42c688]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40c05b
lea eax, [ebp - 0x414]
push eax
call edi
lea eax, [ebp - 0x824]
push eax
call esi
test eax, eax
je 0x40c071
lea eax, [ebp - 0x824]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x40c087
lea eax, [ebp - 0x20c]
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c08c
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x40c174
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x40c174
cmp dword [ebp + 0x14], edi
je 0x40c174
push ebx
mov dword [ebp + 0x10], edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ebbe
pop ecx
test eax, eax
pop ecx
je 0x40c16e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c16e
push esi
call fcn.00418db1
test eax, eax
pop ecx
je 0x40c16e
push esi
call fcn.0040e9ed
test eax, eax
pop ecx
je 0x40c16e
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x40c16e
push 0x429884
push str.piyao.INI
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x40c167
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test edi, edi
mov dword [ebp + 8], eax
je 0x40c167
test eax, eax
je 0x40c167
push 0x429868
push dword [ebp + 0x14]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x40c167
push esi
push 1
push dword [ebp + 8]
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov dword [ebp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x10]
pop ebx
jmp 0x40c176
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10