joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ee0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5350dc], 0
jne 0x417f95
mov dword [ebp - 0x80c], 0x400
push 0x400
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [0x5350d8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [ebp - 0x810], 0
jmp 0x417f4b
mov eax, dword [ebp - 0x810]
add eax, 1
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [0x5350d4]
jge 0x417f68
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x417f3c
push 0x50d9ec
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x808]
push edx
call fcn.004176a0
add esp, 4
mov dword [0x5350dc], eax
cmp dword [0x5350dc], 0
jne 0x417fa5
xor eax, eax
jmp 0x418048
push str.Get360CommonInstance
mov eax, dword [0x5350dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350e0], eax
push str.Get360ProductHistoryManager
mov ecx, dword [0x5350dc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350e8], eax
push str.Create360FireWareStateFunction
mov edx, dword [0x5350dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350ec], eax
push str.GetFireWallState
mov eax, dword [0x5350dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350f0], eax
push str.Create360FireWareStateFunction2
mov ecx, dword [0x5350dc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350f4], eax
push str.GetIAdMgr
mov edx, dword [0x5350dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350e4], eax
push str.GetExcludeChecker
mov eax, dword [0x5350dc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5350f8], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x41a7f0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84c], ecx
lea ecx, [ebp - 0x838]
call fcn.00418350
mov ax, word [0x52022c]
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x420], 0x208
push 0x410
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x41c]
push edx
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41a8b9
mov dword [ebp - 0x83c], 0
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x83c]
jmp 0x41a9dd
push 4
push 0x50db68
lea eax, [ebp - 0x418]
push eax
call fcn.004ec31c
add esp, 0xc
test eax, eax
je 0x41a8f3
mov dword [ebp - 0x840], 0
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x840]
jmp 0x41a9dd
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x834], ecx
mov dx, word [0x52022c]
mov word [ebp - 0x830], dx
push 0x40e
push 0
lea eax, [ebp - 0x82e]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x410
push 0
lea ecx, [ebp - 0x830]
push ecx
call fcn.004ebd80
add esp, 0xc
mov edx, dword [ebp - 0x834]
movzx eax, word [edx]
cmp eax, 0x22
jne 0x41a970
mov ecx, 0x22
mov word [ebp - 0x830], cx
push 0x206
lea edx, [ebp - 0x82e]
push edx
push str.safemon360Tray.exe___start
push 0
call fcn.0041b720
add esp, 0x10
jmp 0x41a98b
push 0x206
lea eax, [ebp - 0x830]
push eax
push str.safemon360Tray.exe__start
push 0
call fcn.0041b720
add esp, 0x10
lea ecx, [ebp - 0x830]
push ecx
mov edx, dword [ebp - 0x834]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x41a9c2
mov dword [ebp - 0x844], 1
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x844]
jmp 0x41a9dd
mov dword [ebp - 0x848], 0
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x848]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x41a9f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push str.DisableAutorun
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41aa3c
xor eax, eax
jmp 0x41aa4d
cmp dword [ebp - 0x10], 0
je 0x41aa4b
mov eax, 1
jmp 0x41aa4d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41aa60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.0040deb0
test eax, eax
je 0x41aaa0
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x41aabb
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ab01
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x10], 0xc
mov edx, dword [ebp - 0x10]
push edx
push 0x50daec
mov eax, dword [ebp - 0xc]
push eax
push 0
push str.360Safetray
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x41ab10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.0040deb0
test eax, eax
je 0x41ab60
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x41ab7b
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ac42
mov dword [ebp - 0xc], 3
mov byte [ebp - 0x418], 0
push 0x3ff
push 0
lea edx, [ebp - 0x417]
push edx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.360Safetray
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x41c], 1
cmp dword [ebp - 0x14], 0
je 0x41ac07
movzx edx, byte [ebp - 0x418]
and edx, 0xff
mov dword [ebp - 0x41c], edx
cmp dword [ebp - 0x14], 0
je 0x41ac30
mov eax, dword [ebp - 0x41c]
and eax, 0x80000001
jns 0x41ac1f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x41ac30
mov dword [ebp - 0x424], 1
jmp 0x41ac3a
mov dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
jmp 0x41ac44
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x41ac60
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84c], ecx
lea ecx, [ebp - 0x838]
call fcn.00418350
mov ax, word [0x52022c]
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x420], 0x208
push 0x410
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x41c]
push edx
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41ad29
mov dword [ebp - 0x83c], 0
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x83c]
jmp 0x41ae4d
push 4
push str.rem
lea eax, [ebp - 0x418]
push eax
call fcn.004ec31c
add esp, 0xc
test eax, eax
je 0x41ad63
mov dword [ebp - 0x840], 0
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x840]
jmp 0x41ae4d
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x834], ecx
mov dx, word [0x52022c]
mov word [ebp - 0x830], dx
push 0x40e
push 0
lea eax, [ebp - 0x82e]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x410
push 0
lea ecx, [ebp - 0x830]
push ecx
call fcn.004ebd80
add esp, 0xc
mov edx, dword [ebp - 0x834]
movzx eax, word [edx]
cmp eax, 0x22
jne 0x41ade0
mov ecx, 0x22
mov word [ebp - 0x830], cx
push 0x206
lea edx, [ebp - 0x82e]
push edx
push str.safemon360Tray.exe___start
push 0
call fcn.0041b720
add esp, 0x10
jmp 0x41adfb
push 0x206
lea eax, [ebp - 0x830]
push eax
push str.safemon360Tray.exe__start
push 0
call fcn.0041b720
add esp, 0x10
lea ecx, [ebp - 0x830]
push ecx
mov edx, dword [ebp - 0x834]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x41ae32
mov dword [ebp - 0x844], 1
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x844]
jmp 0x41ae4d
mov dword [ebp - 0x848], 0
lea ecx, [ebp - 0x838]
call fcn.004335b0
mov eax, dword [ebp - 0x848]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x41ae60
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x844], ecx
lea ecx, [ebp - 0x834]
call fcn.00418350
mov ax, word [0x52022c]
mov word [ebp - 0x418], ax
push 0x40e
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x420], 0x208
push 0x410
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x41c]
push edx
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41af1f
mov dword [ebp - 0x838], 0
lea ecx, [ebp - 0x834]
call fcn.004335b0
mov eax, dword [ebp - 0x838]
jmp 0x41affa
mov ax, word [0x52022c]
mov word [ebp - 0x830], ax
push 0x40e
push 0
lea ecx, [ebp - 0x82e]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x410
push 0
lea edx, [ebp - 0x830]
push edx
call fcn.004ebd80
add esp, 0xc
movzx eax, word [ebp - 0x418]
cmp eax, 0x22
jne 0x41af8d
mov ecx, 0x22
mov word [ebp - 0x830], cx
push 0x206
lea edx, [ebp - 0x82e]
push edx
push str.safemon360Tray.exe___start
push 0
call fcn.0041b720
add esp, 0x10
jmp 0x41afa8
push 0x206
lea eax, [ebp - 0x830]
push eax
push str.safemon360Tray.exe__start
push 0
call fcn.0041b720
add esp, 0x10
lea ecx, [ebp - 0x830]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x41afdf
mov dword [ebp - 0x83c], 1
lea ecx, [ebp - 0x834]
call fcn.004335b0
mov eax, dword [ebp - 0x83c]
jmp 0x41affa
mov dword [ebp - 0x840], 0
lea ecx, [ebp - 0x834]
call fcn.004335b0
mov eax, dword [ebp - 0x840]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x41b010
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004ec880
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x101c], ecx
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b270
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x41b05c
push 1
mov ecx, dword [ebp - 0x101c]
call fcn.0041b1c0
jmp 0x41b1a8
mov dword [ebp - 0x1018], 0x400
mov ax, word [0x52022c]
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dx, word [0x52022c]
mov word [ebp - 0x1010], dx
push 0x7fe
push 0
lea eax, [ebp - 0x100e]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x810], 0x800
push 0x800
push 0
lea ecx, [ebp - 0x808]
push ecx
call fcn.004ebd80
add esp, 0xc
mov edx, 0x22
mov word [ebp - 0x1010], dx
push 0x3fe
lea eax, [ebp - 0x100e]
push eax
push str.safemon360Tray.exe___start
push 0
call fcn.0041b720
add esp, 0x10
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x80c]
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41b15a
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x808]
push edx
call fcn.004ec19f
add esp, 8
test eax, eax
jne 0x41b15a
mov dword [ebp - 0x1014], 1
cmp dword [ebp - 0x1014], 0
jne 0x41b19b
cmp dword [ebp + 8], 0
je 0x41b19b
lea eax, [ebp - 0x1010]
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x1010]
push ecx
push 1
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b650
add esp, 0x18
push 0
mov ecx, dword [ebp - 0x101c]
call fcn.0041b1c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 4

Function at 0x41b200
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunQQDisabled
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b270
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x41b5c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x3b
call fcn.0041b310
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41b5e9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x41b5fa
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x41b6b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x45
call fcn.0041b310
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41b6e9
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x41b70a
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x18

Function at 0x41c180
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
call fcn.0047ef80
shl eax, 1
push eax
mov ecx, dword [ebp + 8]
call fcn.0044ea20
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x41c1cf
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.Modify_AppPath_Default_Failed:__s_n
call fcn.00420df0
add esp, 8
xor eax, eax
jmp 0x41c296
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.Modify_AppPath_Default_Success:__s_n
call fcn.00420df0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 4]
call fcn.00418370
push 0x5c
lea ecx, [ebp - 4]
call fcn.0041d490
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
call fcn.00418530
push eax
lea ecx, [ebp - 4]
call fcn.00418390
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
push 1
push 0x50dfc8
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x41c273
mov eax, dword [ebp - 4]
push eax
push str.Modify_AppPath_path_Failed:__s_n
call fcn.00420df0
add esp, 8
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp - 0xc]
jmp 0x41c296
mov ecx, dword [ebp - 4]
push ecx
push str.Modify_AppPath_path_Success:__s_n
call fcn.00420df0
add esp, 8
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x41c2a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 8]
call fcn.0040f510
push 0x50e0b8
lea ecx, [ebp - 8]
call fcn.0040e800
push 0x50e0a0
push 0
lea eax, [ebp - 4]
push eax
call fcn.0041d6f0
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
push 1
push str.UninstallString
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x41c32e
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0xc]
jmp 0x41c3ac
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 4]
call fcn.00418390
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
push 1
push str.DisplayIcon
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x41c392
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x10]
jmp 0x41c3ac
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 4]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x41c3c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x434], ecx
cmp dword [ebp + 8], 0
jne 0x41c3e6
xor eax, eax
jmp 0x41c5a8
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.00418370
push 0x5c
lea ecx, [ebp - 4]
call fcn.0041d490
push eax
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 4]
call fcn.00418530
push eax
lea ecx, [ebp - 4]
call fcn.00418390
lea ecx, [ebp - 0x42c]
call fcn.004335b0
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [eax + 0x24]
call edx
push 0x50d4a8
lea ecx, [ebp - 4]
call fcn.0040f550
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.0041d780
push 0x50d4a8
lea ecx, [ebp - 4]
call fcn.0040e800
push 0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [edx + 0x44]
call ecx
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [eax + 0x50]
call edx
lea eax, [ebp - 0x10]
push eax
push 0x51b4a8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x41c58a
mov dx, word [0x52022c]
mov word [ebp - 0x428], dx
push 0x206
push 0
lea eax, [ebp - 0x426]
push eax
call fcn.004ebd80
add esp, 0xc
push 0
push 0x10
lea ecx, [ebp - 0x428]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x50d6f8
push 0x104
lea edx, [ebp - 0x428]
push edx
call fcn.0041d570
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x50e0b8
push 0x104
lea edx, [ebp - 0x428]
push edx
call fcn.0041d570
push str..lnk
push 0x104
lea eax, [ebp - 0x428]
push eax
call fcn.0041d570
push 0
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 0x18]
call edx
test eax, eax
jne 0x41c573
mov dword [ebp - 8], 1
jmp 0x41c57a
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ecx + 8]
call eax
jmp 0x41c591
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x430], ecx
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret 8
Function at 0x41ca10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 8]
call fcn.0044ea20
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41ca47
xor eax, eax
jmp 0x41ca63
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41ca60
xor eax, eax
jmp 0x41ca63
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4