joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429221
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [esi + 0xb]
test al, al
js 0x429243
mov ecx, esi
jmp 0x429248
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, 0x647e9a
test eax, eax
jle 0x42927d
xor ebx, ebx
xor edi, edi
cmp word [ecx + ebx*2], 0x3f
je 0x429266
add edi, 0xfffffffe
inc ebx
cmp eax, ebx
jne 0x429255
jmp 0x42927d
add eax, eax
cmp edi, 2
mov ecx, 0x647e9a
mov edx, 0x647eaa
cmove edx, ecx
add eax, edi
cmove edx, ecx
mov ecx, esi
push edx
call fcn.00469188
lea edi, [ebp - 0x1c]
push edi
call fcn.00428ebc
add esp, 4
movzx eax, byte [edi + 0xb]
test al, al
jns 0x42929f
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, esi
push eax
push edi
call fcn.00468fc8
cmp byte [ebp - 0x11], 0
jns 0x4292b9
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, esi
push 0x647ea2
call fcn.00469188
lea edi, [ebp - 0x1c]
push edi
call fcn.00428f64
add esp, 4
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4292df
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, esi
push eax
push edi
call fcn.00468fc8
cmp byte [ebp - 0x11], 0
jns 0x4292f9
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
movzx ebx, byte [esi + 0xb]
test bl, bl
js 0x429305
mov eax, ebx
jmp 0x429308
mov eax, dword [esi + 4]
inc eax
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.00517c03
add esp, 4
mov edi, eax
test bl, bl
js 0x429324
mov eax, esi
jmp 0x429326
mov eax, dword [esi]
push eax
push edi
call fcn.006207f6
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
push ecx
push eax
push edi
push 0x429100
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esi + 0xb], 0
jns 0x429357
push dword [esi]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x429771
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004175be
lea edi, [ebp - 0x1c]
mov ecx, eax
push edi
call fcn.004181aa
mov al, byte [edi + 0xb]
test al, al
js 0x4297a5
test al, al
jne 0x4297ae
xor ebx, ebx
jmp 0x429800
cmp dword [ebp - 0x18], 0
je 0x4297c9
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4297c9
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x4297cd
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x4297d0
xor ebx, ebx
jmp 0x4297ef
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x28]
mov ecx, edi
push eax
push edx
call fcn.0046ed80
push esi
push edi
call fcn.00438b7c
add esp, 8
mov ebx, eax
mov ecx, edi
call fcn.0046ee40
cmp byte [ebp - 0x11], 0
jns 0x429800
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429832
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x48], eax
call fcn.00436db0
mov ecx, eax
push 1
push 0x6e
call fcn.004374f6
lea esi, [esp + 0x30]
mov ecx, 0x770d84
push esi
call fcn.00415b04
cmp byte [esi + 0xb], 0
jns 0x429872
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push 0x20019
push esi
push SysReAllocStringLen
call fcn.00485170
cmp byte [esp + 0x3b], 0
jns 0x429899
push dword [esp + 0x30]
call fcn.00517bd6
add esp, 4
xor eax, eax
lea edi, [esp + 0x30]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
lea ecx, [esp + 0x3c]
push edi
push str.UninstallString
call fcn.00485a20
test eax, eax
jne 0x4299b3
movzx eax, byte [esp + 0x3b]
test al, al
jns 0x4298cf
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea esi, [esp + 0x24]
mov ecx, esi
push eax
push edi
call fcn.0046ed80
mov edi, esp
mov ecx, esi
push edi
call fcn.0046f6e0
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.0046f6e0
cmp word [0x6496c4], 0
je 0x429910
xor ecx, ecx
lea eax, [ecx + 1]
cmp word [ecx + ecx + 0x6496c6], 0
mov ecx, eax
jne 0x4298fe
jmp 0x429912
xor eax, eax
lea edi, [esp + 0x18]
lea ebx, [esp + 0xc]
mov ecx, ebx
push eax
push 0x6496c4
push edi
call fcn.0046fbd0
mov ecx, esi
push edi
call fcn.0046ee80
mov ecx, edi
call fcn.0046ee40
mov ecx, ebx
call fcn.0046ee40
mov ecx, esp
call fcn.0046ee40
push esi
call fcn.00482720
add esp, 4
test al, al
je 0x429982
cmp byte [esp + 0x2f], 0
jns 0x42995d
mov esi, dword [esp + 0x24]
push 0
push str.doctor
push 0x648122
push esi
call fcn.00438279
add esp, 0x10
test eax, eax
je 0x429982
lea eax, [esp + 0x24]
push eax
call fcn.00438791
jmp 0x4299a7
mov ecx, edi
push str.https:__bbs.360.cn_thread_15943067_1_1.html
call fcn.00401a6c
push edi
call fcn.0042973a
add esp, 4
cmp byte [esp + 0x23], 0
jns 0x4299aa
push dword [esp + 0x18]
call fcn.00517bd6
add esp, 4
lea ecx, [esp + 0x24]
call fcn.0046ee40
cmp byte [esp + 0x3b], 0
jns 0x4299c6
push dword [esp + 0x30]
call fcn.00517bd6
add esp, 4
lea ecx, [esp + 0x3c]
call fcn.00485370
mov eax, dword [0x7711bc]
test eax, eax
je 0x429a09
cmp byte [eax + 0x340], 0
je 0x429a09
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x429a09
mov eax, dword [0x7711bc]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push 0x601
call fcn.004197aa
add esp, 0xc
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x429afc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7711b8]
test eax, eax
je 0x429b13
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00436db0
mov ecx, eax
push 1
push 7
call fcn.004374f6
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
je 0x429b5a
call fcn.00418a10
mov ecx, eax
call fcn.00418ca6
test al, al
jne 0x429b5a
push 0x6390a0
push str.Software360Chrome
push SysReAllocStringLen
call fcn.00437e3b
add esp, 0xc
call fcn.00412e84
mov ecx, eax
call fcn.004130c6
call fcn.00411d12
mov ecx, eax
call fcn.004126f6
xor eax, eax
push eax
push eax
push 0x601
call fcn.004197aa
add esp, 0xc
pop ebp
ret

Function at 0x429b85
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7711b8]
test eax, eax
je 0x429b9c
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x42bdd9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7711c4]
test eax, eax
je 0x42bdf0
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret

Function at 0x42d566
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov dword [eax], 0
cmp dword [esi + 0x50], 0
je 0x42d5bd
lea edi, [ebp - 0x214]
push 0x208
push 0
push edi
call fcn.006030b0
add esp, 0xc
push 0x104
push edi
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
push edi
push dword [esi + 4]
call dword [eax]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
xor eax, eax
add esp, 0x20c
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x42dbf4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42dc12
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret
Function at 0x42f9fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x3e0]
mov ecx, dword [eax]
xor edx, edx
inc edx
push edx
push 0x3ff
push eax
call dword [ecx + pe_nt_image_headers32]
xor edi, edi
lea ebx, [ebp - 0x18]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov ecx, ebx
push str.CIRCLE_GIF
push 0x6487e0
call fcn.00426a48
lea edx, [ebp - 0x1c]
mov dword [edx], edi
mov eax, dword [0x770ec4]
mov ecx, dword [eax]
push edx
push 0x6484a4
push edi
push 0x39
push eax
call dword [ecx + 0x2c]
push dword [ebx + 4]
push dword [0x900108]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebp - 0x1c]
push edi
push eax
call fcn.0042fafc
mov eax, dword [esi + 0x39c]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push dword [edx]
mov edi, edx
push 0x60e
push eax
call dword [ecx + 0x90]
mov ecx, esi
call fcn.0042fb5a
mov dword [0x77116c], 0xa
mov dword [0x771168], 0x2d
xor eax, eax
push eax
xor eax, eax
inc eax
push eax
push 0x3e8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [edi]
test eax, eax
je 0x42fad4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42faea
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42ffb2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov ecx, 0x900100
push 0
call fcn.0051856d
test eax, eax
je 0x430075
mov ecx, dword [ebp + 8]
mov edx, ecx
shr edx, 4
inc edx
movzx edx, dx
mov dword [ebp - 0x20], edx
and ecx, 0xf
mov dword [ebp - 0x1c], ecx
dec ecx
mov dword [ebp - 0x18], ecx
xor edi, edi
inc edi
push 0
push dword [ebp - 0x20]
push 6
mov dword [ebp - 0x10], eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x430061
mov esi, eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x430061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x430061
mov ebx, eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setg cl
cmp dword [ebp - 0x1c], 0
je 0x430057
test eax, eax
jle 0x430057
mov edx, ebx
add edx, eax
mov eax, dword [ebp - 0x18]
movzx ecx, word [ebx]
lea ebx, [ebx + ecx*2]
add ebx, 2
cmp ebx, edx
setb cl
add eax, 0xffffffff
jae 0x430057
cmp ebx, edx
jb 0x430040
test cl, cl
je 0x430061
cmp word [ebx], 0
jne 0x430081
mov ecx, 0x900100
push edi
inc edi
call fcn.0051856d
test eax, eax
jne 0x42ffee
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x430075
mov ecx, dword [ebp - 0x14]
push dword [ebp + 8]
push eax
call fcn.00430096
jmp 0x430077
Function at 0x430096
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, edi
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
xor eax, eax
test esi, esi
je 0x430163
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x430161
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x430161
mov ebx, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setg cl
and edi, 0xf
je 0x430118
test eax, eax
jle 0x430118
mov edx, ebx
add edx, eax
dec edi
movzx eax, word [ebx]
lea ebx, [ebx + eax*2]
add ebx, 2
cmp ebx, edx
setb cl
add edi, 0xffffffff
jae 0x430118
cmp ebx, edx
jb 0x430101
test cl, cl
je 0x430161
movzx esi, word [ebx]
test esi, esi
mov eax, 0
je 0x430163
lea eax, [ebx + 2]
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x14]
mov ecx, edi
push esi
call fcn.0042e554
movzx ecx, word [ebx]
push ecx
push dword [ebp - 0x10]
push esi
push eax
call fcn.00430178
add esp, 0x10
mov eax, dword [edi]
cmp dword [eax - 8], esi
jl 0x43016d
mov dword [eax - 0xc], esi
mov eax, dword [edi]
mov word [eax + esi*2], 0
xor eax, eax
inc eax
jmp 0x430163
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00485120
int3
Function at 0x433de6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
cmp byte [eax + 0xb], 0
jns 0x433e21
mov eax, dword [eax]
mov esi, esp
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
setne al
mov ecx, dword [esi]
mov edx, dword [esi + 4]
shld edx, ecx, 0xc
cmp edx, 0x63
seta bl
and bl, al
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x434387
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x23c
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00436db0
mov ecx, eax
push 0x191
push 0x1c
call fcn.004374f6
xor esi, esi
lea edi, [ebp - 0x218]
push 0x208
push esi
push edi
call fcn.006030b0
add esp, 0xc
push 0x103
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4343e7
push 1
push edi
call fcn.004381df
add esp, 8
test al, al
je 0x434420
call fcn.0046b890
mov esi, eax
mov eax, str.exe_path
lea ebx, [ebp - 0x230]
mov dword [ebx], eax
push eax
call fcn.0061fdf0
add esp, 4
mov dword [ebx + 4], eax
lea edi, [ebp - 0x224]
mov ecx, esi
push ebx
push edi
call fcn.0046bf10
cmp byte [edi + 0xb], 0
js 0x434433
jne 0x434442
jmp 0x434451
call fcn.00436db0
mov ecx, eax
call fcn.004374ec
mov esi, eax
jmp 0x43460c
cmp dword [ebp - 0x220], 0
je 0x434451
mov edi, dword [ebp - 0x224]
push 1
push edi
call fcn.004381df
add esp, 8
test al, al
je 0x4344bc
call fcn.00436db0
mov ecx, eax
push 0x192
push 0x1c
call fcn.004374f6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00401a6c
lea edi, [ebp - 0x23c]
mov ecx, edi
push 0x6390a0
call fcn.00401a6c
movzx eax, byte [edi + 0xb]
test al, al
jns 0x43449e
mov edi, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x238]
cmp word [ebp - 0x218], 0
je 0x4344cf
xor edx, edx
lea ecx, [edx + 1]
cmp word [ebp + edx*2 - 0x216], 0
mov edx, ecx
jne 0x4344aa
jmp 0x4344d1
call fcn.00436db0
mov ecx, eax
call fcn.004374ec
mov esi, eax
jmp 0x4345f5
xor ecx, ecx
push eax
push edi
push ecx
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call fcn.0047b6e0
add esp, 0x18
cmp byte [ebp - 0x231], 0
jns 0x4344fd
push dword [ebp - 0x23c]
call fcn.00517bd6
add esp, 4
movzx ebx, byte [ebp - 0x225]
test bl, bl
jns 0x43450e
mov ebx, dword [ebp - 0x22c]
call fcn.00436db0
mov ecx, eax
cmp ebx, 3
ja 0x434526
call fcn.004374ec
mov esi, eax
jmp 0x4345de
push 0x193
push 0x1c
call fcn.004374f6
xor esi, esi
call fcn.00498564
test al, al
jne 0x4345de
lea esi, [ebp - 0x23c]
push 0x138a
push esi
call fcn.00498905
add esp, 8
lea edi, [ebp - 0x248]
push 0x1388
push edi
call fcn.00498905
add esp, 8
call fcn.00418dbe
mov ecx, eax
call fcn.00418fa0
test al, al
jne 0x4345a5
cmp byte [ebp - 0x231], 0
jns 0x434588
mov esi, dword [ebp - 0x23c]
cmp byte [ebp - 0x23d], 0
mov eax, edi
jns 0x434599
mov eax, dword [ebp - 0x248]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00436db0
mov ecx, eax
call fcn.004374ec
mov esi, eax
cmp byte [edi + 0xb], 0
jns 0x4345c7
push dword [ebp - 0x248]
call fcn.00517bd6
add esp, 4
cmp byte [ebp - 0x231], 0
jns 0x4345de
push dword [ebp - 0x23c]
call fcn.00517bd6
add esp, 4
cmp byte [ebp - 0x225], 0
jns 0x4345f5
push dword [ebp - 0x230]
call fcn.00517bd6
add esp, 4
cmp byte [ebp - 0x219], 0
jns 0x43460c
push dword [ebp - 0x224]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x23c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x434efa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x414
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x418], ecx
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x414], eax
push 0x60
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
jne 0x434f4c
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
je 0x434ff3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x434fd8
mov edi, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x434fd8
mov dword [ebp - 0x420], eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, 0x8007000e
cmp eax, 0xffffffff
je 0x434fdf
mov ebx, eax
inc eax
lea ecx, [ebp - 0x414]
push eax
call fcn.0043501e
lea eax, [ebp - 0x414]
mov eax, dword [eax]
test eax, eax
je 0x434fdf
push ebx
push eax
push ebx
push dword [ebp - 0x420]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x434fd8
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x414]
mov word [ecx + eax*2], 0
lea ecx, [ebp - 0x41c]
push edx
push dword [ebp - 0x414]
call fcn.00435052
jmp 0x434fdd
call fcn.00434c1f
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x410]
cmp dword [eax - 4], eax
jne 0x434ffa
jmp 0x435005
call fcn.00434c1f
mov edi, eax
lea ecx, [ebp - 0x414]
call fcn.00436a1e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, edi
add esp, 0x414
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4363a2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x220
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov eax, dword [ecx]
mov dword [ebp - 0x22c], ecx
mov ebx, dword [ecx + 4]
mov ecx, ebx
or ecx, 0x2001f
lea edx, [ebp - 0x210]
mov dword [edx], esi
push edx
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4363ff
mov edi, eax
jmp 0x4364d8
mov edi, dword [ebp - 0x210]
mov dword [ebp - 0x21c], edi
and ebx, 0x300
mov dword [ebp - 0x218], ebx
lea eax, [ebp - 0x228]
mov dword [eax], 0x100
lea ecx, [ebp - 0x224]
push ecx
push esi
push esi
push esi
push eax
lea ebx, [ebp - 0x210]
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
mov esi, dword [ebp - 0x22c]
jne 0x436492
xor esi, esi
lea ecx, [ebp - 0x21c]
push ebx
call fcn.004363a2
test eax, eax
jne 0x4364bb
mov dword [ebp - 0x228], 0x100
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
push ebx
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x436449
mov edi, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x22c]
test edi, edi
je 0x4364a7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov ecx, esi
push dword [ebp + 8]
call fcn.00436942
mov edi, eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4364d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, edi
add esp, 0x220
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x437400
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x18], eax
xor edi, edi
lea ebx, [esp + 0x10]
mov dword [ebx + 4], edi
mov dword [ebx], edi
lea esi, [esp + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
push esi
call fcn.0061b861
add esp, 4
mov eax, 4
lea ecx, [esp + 4]
mov dword [ecx], eax
mov edx, esp
mov dword [edx], eax
push edx
push ebx
push ecx
push str.LastTimeUninstall
push str.Software360ChromeChrome
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov edx, ecx
or edx, eax
je 0x437482
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
sub edx, ecx
sbb edi, eax
xor eax, eax
mov ecx, 0x1517f
cmp ecx, edx
sbb eax, edi
jl 0x437488
xor edi, edi
inc edi
mov dword [0x8999e4], edi
push 4
push esi
push dword [esp + 0xc]
push str.LastTimeUninstall
push str.Software360ChromeChrome
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x437742
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp byte [ecx + 4], 0
je 0x437800
cmp byte [0x8999ef], 0
jne 0x437800
mov esi, ecx
mov byte [0x8999ef], 1
call fcn.0043aa4e
lea edi, [ebp - 0x18]
mov ecx, eax
push edi
call fcn.0043afb4
cmp byte [0x771257], 0
js 0x43779f
mov word [0x77124c], 0
mov byte [0x771257], 0
jmp 0x4377d4
mov eax, dword [0x77124c]
mov word [eax], 0
mov dword [0x771250], 0
cmp byte [0x771257], 0
jns 0x4377d4
push dword [0x77124c]
call fcn.00517bd6
add esp, 4
mov dword [0x771254], 0
mov eax, dword [ebp - 0x10]
mov dword [0x771254], eax
movsd xmm0, qword [ebp - 0x18]
movsd qword [0x77124c], xmm0
xor eax, eax
mov dword [ebp - 0x18], eax
push edi
push eax
push eax
push 0x436ea0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x10
pop esi
pop edi
pop ebp
ret

Function at 0x437812
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ecx]
test eax, eax
je 0x43786e
mov esi, ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43783c
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x43786e
xor edi, edi
dec edi
mov ecx, 0x7d3f50
push edi
call fcn.0048b7e0
mov ecx, 0x836c48
push edi
call fcn.0048b7e0
mov ecx, 0x771258
push edi
call fcn.0048b7e0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop esi
pop edi
pop ebp
ret 4