joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f15e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.Software360360se6Chrome
lea ecx, [ebp - 0x40]
call fcn.004022ea
push 0x65
pop edx
push 0x6e
pop eax
push 0x61
pop ecx
push 0x62
mov word [ebp - 0x26], ax
pop eax
push 0x6c
mov word [ebp - 0x22], ax
pop eax
push 0x70
mov word [ebp - 0x20], ax
mov word [ebp - 0x24], cx
mov word [ebp - 0x1c], cx
pop ecx
push 0x64
pop eax
push 0x73
mov word [ebp - 0x16], ax
pop eax
push 0x6b
mov word [ebp - 0x12], ax
pop eax
push 0x74
mov word [ebp - 0x10], ax
pop eax
push 0x6f
mov word [ebp - 0xe], ax
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
and dword [ebp - 0x44], eax
push 4
mov word [ebp - 8], ax
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
mov word [ebp - 0x28], dx
push eax
lea eax, [ebp - 0x4c]
mov word [ebp - 0x1e], dx
push eax
lea eax, [ebp - 0x28]
mov word [ebp - 0x1a], cx
push eax
push str.Software360360se6chrome
push reloc.WS2_32.dll_accept
mov word [ebp - 0x18], cx
mov word [ebp - 0x14], dx
mov word [ebp - 0xa], cx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x44], 1
lea ecx, [ebp - 0x40]
sete bl
call fcn.00404061
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret

Function at 0x41f22d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.app_showdesk_show
push str.Software360360se6chrome
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
sete al
leave
ret

Function at 0x41f26a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.app_slider_show
push str.Software360360se6chrome
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 1
sete al
leave
ret
Function at 0x41f2a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x74
pop eax
push 0x72
mov word [ebp - 0x24], ax
pop eax
push 0x61
pop esi
push 0x79
mov word [ebp - 0x22], ax
pop eax
push 0x5f
pop edx
push 0x65
pop ecx
push 0x6e
mov word [ebp - 0x1e], ax
pop eax
push 0x62
mov word [ebp - 0x18], ax
pop eax
push 0x6c
mov word [ebp - 0x14], ax
pop eax
push 0x70
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0xa], ax
mov word [ebp - 8], ax
xor eax, eax
and dword [ebp - 0x28], eax
push 4
mov word [ebp - 6], ax
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
mov word [ebp - 0x20], si
push eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x1c], dx
push eax
lea eax, [ebp - 0x24]
mov word [ebp - 0x1a], cx
push eax
push str.Software360360se6chrome
push reloc.WS2_32.dll_accept
mov word [ebp - 0x16], si
mov word [ebp - 0x10], cx
mov word [ebp - 0xe], dx
mov word [ebp - 0xc], si
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x28], 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop esi
call fcn.00496ca3
leave
ret

Function at 0x421886
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x1c]
push esi
xor esi, esi
push edi
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x544], eax
mov dword [ebx + 0x548], esi
mov dword [ebx + 0x558], esi
mov dword [ebx + 0x554], esi
test ecx, ecx
je 0x4218df
mov eax, dword [ecx]
mov dword [ebx + 0x554], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0x558], eax
test edx, edx
je 0x4218ec
push edx
lea ecx, [ebx + 0x30]
call fcn.00459204
mov eax, dword [ebp + 0xc]
mov ecx, ebx
neg ecx
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x10]
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, 0x50a1d4
call fcn.0041fdbd
mov ecx, dword [ebx + 0x544]
test ecx, ecx
jne 0x421917
mov eax, dword [ebx + 0x20]
jmp 0x421923
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0045b663
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.00459075
push esi
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push closesocket
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0045fba9
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x421960
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x42195b
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret 0x18
Function at 0x4238ac
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
shr eax, 4
xor eax, ecx
mov dword [ebp - 4], 8
and eax, 0xf0f0f0f
xor ecx, eax
shl eax, 4
xor edx, eax
mov eax, edx
shr eax, 0x10
xor eax, ecx
movzx eax, ax
xor ecx, eax
shl eax, 0x10
xor edx, eax
mov eax, ecx
shr eax, 2
xor eax, edx
and eax, 0x33333333
xor edx, eax
shl eax, 2
xor ecx, eax
mov edi, ecx
shr edi, 8
xor edi, edx
and edi, 0xff00ff
xor edx, edi
shl edi, 8
xor edi, ecx
rol edi, 1
mov ebx, edi
xor ebx, edx
and ebx, 0xaaaaaaaa
xor edi, ebx
xor ebx, edx
rol ebx, 1
mov eax, dword [ebp + 0xc]
mov edx, edi
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x50a330]
or esi, dword [eax*4 + 0x50a530]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x50a730]
or esi, dword [edx*4 + 0x50a930]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
xor edx, edi
mov ecx, edx
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x50a430]
or ecx, dword [eax*4 + 0x50a630]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x50a830]
or ecx, dword [edx*4 + 0x50aa30]
mov eax, dword [ebp + 0xc]
or ecx, esi
xor ebx, ecx
mov edx, ebx
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x50a330]
or esi, dword [eax*4 + 0x50a530]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x50a730]
mov eax, dword [ebp + 0xc]
or esi, dword [edx*4 + 0x50a930]
mov edx, dword [eax]
add eax, 4
xor edx, ebx
mov dword [ebp + 0xc], eax
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x50a430]
or ecx, dword [eax*4 + 0x50a630]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x50a830]
or ecx, dword [edx*4 + 0x50aa30]
or ecx, esi
xor edi, ecx
sub dword [ebp - 4], 1
jne 0x42391f
ror edi, 1
mov edx, edi
mov esi, dword [ebp + 8]
xor edx, ebx
and edx, 0xaaaaaaaa
xor edi, edx
xor edx, ebx
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, edi
and eax, 0xff00ff
xor edi, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, edi
and eax, 0x33333333
xor edi, eax
shl eax, 2
xor edx, eax
mov eax, edi
shr eax, 0x10
xor eax, edx
movzx eax, ax
xor edx, eax
shl eax, 0x10
xor edi, eax
mov ecx, edi
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov eax, ecx
shl eax, 4
xor eax, edi
xor ecx, edx
pop edi
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
pop ebx
leave
ret 8
Function at 0x423ab5
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ebx
movzx ecx, byte [edx + str.80_]
mov eax, ecx
and ecx, 7
shr eax, 3
mov al, byte [eax + esi]
test byte [ecx*2 + 0x50a248], al
setne al
mov byte [ebp + edx - 0x3c], al
inc edx
cmp edx, 0x38
jl 0x423adf
push 0x1e
xor edi, edi
pop esi
cmp ebx, 1
lea eax, [edi + edi]
mov edx, esi
cmovne edx, eax
movzx eax, byte [edi + 0x50a2f0]
and dword [ebp + edx*4 - 0xf0], 0
and dword [ebp + edx*4 - 0xf4], 0
xor ecx, ecx
cmp eax, 0x1c
jge 0x423b39
mov bl, byte [ebp + eax - 0x3c]
jmp 0x423b3d
mov bl, byte [ebp + eax - 0x58]
mov byte [ebp + ecx - 0x74], bl
inc ecx
inc eax
cmp ecx, 0x1c
jl 0x423b2e
movzx eax, byte [edi + 0x50a2f0]
push 0x1c
pop ecx
add eax, ecx
cmp eax, 0x38
jge 0x423b5f
mov bl, byte [ebp + eax - 0x3c]
jmp 0x423b63
mov bl, byte [ebp + eax - 0x58]
mov byte [ebp + ecx - 0x74], bl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x423b54
xor ecx, ecx
movzx eax, byte [ecx + 0x50a300]
cmp byte [ebp + eax - 0x74], 0
je 0x423b8c
mov eax, dword [ecx*4 + 0x50a258]
or dword [ebp + edx*4 - 0xf4], eax
movzx eax, byte [ecx + 0x50a318]
cmp byte [ebp + eax - 0x74], 0
je 0x423ba8
mov eax, dword [ecx*4 + 0x50a258]
or dword [ebp + edx*4 - 0xf0], eax
inc ecx
cmp ecx, 0x18
jl 0x423b70
mov ebx, dword [ebp - 0xf8]
sub esi, 2
inc edi
cmp esi, 0xfffffffe
jg 0x423b0a
mov ecx, dword [ebp - 0xfc]
lea eax, [ebp - 0xf4]
push eax
call fcn.00423693
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret 8
Function at 0x424d94
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca531
mov eax, dword fs:[0]
push eax
mov eax, 0x1001c
call fcn.00496fd0
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10010]
push 0xfffe
xor ebx, ebx
push ebx
push eax
call fcn.0049f230
add esp, 0xc
lea eax, [ebp - 0x10010]
push esi
push 0x7ffe
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea esi, [ebp - 0x10010]
cmp word [esi], bx
je 0x424e3b
push esi
lea ecx, [ebp - 0x10028]
call fcn.004022ea
lea eax, [ebp - 0x10028]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.00424d54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10028]
call fcn.00404061
push esi
call fcn.004a338c
pop ecx
lea esi, [esi + eax*2]
add esi, 2
jne 0x424dfb
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ca3
leave
ret 4
Function at 0x42627b
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4262ff
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4262ff
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, dword [ebp - 4]
sete al
jmp 0x426301
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x426346
Capabilities:
Check if file exists

Disassembly:
push 0x240
mov eax, 0x4ca7fc
call fcn.00496d1f
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x525914]
mov edi, 0x4d18d0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24c], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x51a2dc]
cmp eax, dword [ecx + 4]
jg 0x426596
push edi
mov ecx, 0x51a2c4
call fcn.004143ae
test al, al
jne 0x4263ab
push 0x51a2c4
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040458e
jmp 0x42658e
push edi
lea ecx, [ebp - 0x248]
call fcn.004022ea
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 1
push eax
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push reloc.WS2_32.dll_accept
call fcn.004276ff
add esp, 0x10
test eax, eax
jne 0x4263ed
push edi
mov ecx, esi
call fcn.004022ea
jmp 0x426583
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0049f230
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x248]
add esp, 0xc
cmp dword [ebp - 0x234], 8
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.........
lea eax, [ebp - 0x218]
push eax
call edi
push 0x4d6b60
lea eax, [ebp - 0x218]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x4264ed
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049f230
add esp, 0xc
lea ecx, [ebp - 0x230]
push 0x4d18d0
call fcn.004022ea
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
push eax
push str.user_data_dir
push str.Software360360se6chrome
push reloc.WS2_32.dll_accept
call fcn.004276ff
add esp, 0x10
test eax, eax
jne 0x4264c0
push 0x4d18d0
mov ecx, esi
call fcn.004022ea
lea ecx, [ebp - 0x230]
call fcn.00404061
jmp 0x426583
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.00404061
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x426552
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0049f230
lea eax, [ebp - 0x230]
push eax
call fcn.00426a76
add esp, 0x10
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.360se6User_Data
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x230]
call fcn.00404061
lea eax, [ebp - 0x218]
push eax
call fcn.004a338c
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ebx, 0x51a2c4
push eax
mov ecx, ebx
call fcn.004041f3
and dword [esi + 0x10], 0
mov ecx, esi
and dword [esi + 0x14], 0
push ebx
call fcn.0040458e
lea ecx, [ebp - 0x248]
call fcn.00404061
mov eax, esi
call fcn.00496cc9
ret
push 0x51a2dc
call fcn.004967d3
cmp dword [0x51a2dc], 0xffffffff
pop ecx
jne 0x426385
push edi
mov ecx, 0x51a2c4
mov dword [ebp - 4], ebx
call fcn.004022ea
push 0x4d024a
call fcn.00496c8e
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x51a2dc
call fcn.00496789
pop ecx
jmp 0x426385
Function at 0x426a76
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.0049f230
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004022ea
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00496ca3
leave
ret

Function at 0x426c5a
Capabilities:
Check if file exists

Disassembly:
push 0x240
mov eax, 0x4ca881
call fcn.00496d1f
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24c], esi
mov edi, 0x4d18d0
lea ecx, [ebp - 0x248]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.004022ea
push edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.004022ea
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
push eax
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push reloc.WS2_32.dll_accept
call fcn.004276ff
add esp, 0x10
test eax, eax
jne 0x426ccb
push edi
mov ecx, esi
call fcn.004022ea
jmp 0x426da7
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0049f230
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
add esp, 0xc
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.......
lea eax, [ebp - 0x218]
push eax
call edi
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x426d67
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.......
lea eax, [ebp - 0x218]
push eax
call edi
push 0x4d2d98
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call fcn.004a338c
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004041f3
mov byte [ebp - 0x24c], bl
lea eax, [ebp - 0x248]
push dword [ebp - 0x24c]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.00403e90
lea ecx, [ebp - 0x230]
call fcn.00404061
lea ecx, [ebp - 0x248]
call fcn.00404061
lea ecx, [ebp + 0xc]
call fcn.00404061
mov eax, esi
call fcn.00496cc9
ret
Function at 0x426f90
Capabilities:
Read file on windows

Disassembly:
push 0x118
mov eax, 0x4ca985
call fcn.00496d1f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x4d37c4
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x11c], ebx
call fcn.004a9d3e
add esp, 0xc
cmp dword [ebp - 0x11c], ebx
je 0x4270b6
push 2
push ebx
push dword [ebp - 0x11c]
call fcn.004aa47e
push dword [ebp - 0x11c]
call fcn.004aaa77
push 0
push 0
push dword [ebp - 0x11c]
mov ebx, eax
call fcn.004aa47e
add esp, 0x1c
test ebx, ebx
je 0x4270aa
lea eax, [ebx + 1]
push eax
call fcn.0049702c
mov edi, eax
pop ecx
test edi, edi
je 0x4270aa
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.0049f230
push dword [ebp - 0x11c]
push 1
push ebx
push edi
call fcn.004aa078
add esp, 0x1c
test eax, eax
je 0x4270a3
push 0x105
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0049f230
push 0x104
lea eax, [ebp - 0x118]
push eax
push ebx
push edi
call fcn.00425847
add esp, 0x1c
test eax, eax
je 0x4270a3
lea eax, [ebp - 0x118]
push eax
call fcn.004a33b0
pop ecx
push eax
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.004041aa
push edi
call fcn.00496dc7
pop ecx
push dword [ebp - 0x11c]
call fcn.004a9e06
pop ecx
mov eax, esi
call fcn.00496cc9
ret

Function at 0x4270be
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4218
call fcn.00496fd0
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x420c]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.0049f230
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4270fd
mov eax, dword [esi]
lea ecx, [ebp - 0x4214]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4271c6
cmp eax, 0x3fff
ja 0x4271c6
cmp dword [esi + 0x14], 8
jb 0x427125
mov esi, dword [esi]
lea ecx, [ebp - 0x420c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4271c6
lea eax, [ebp - 0x4218]
push eax
lea eax, [ebp - 0x4210]
push eax
push 0x4d3930
lea eax, [ebp - 0x420c]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4271c6
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049f230
mov ecx, dword [ebp - 0x4210]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00404609
lea eax, [ebp - 0x20c]
push eax
call fcn.004a338c
add esp, 0x2c
mov ecx, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004041f3
xor eax, eax
inc eax
jmp 0x4271c8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00496ca3
leave
ret
Function at 0x42736c
Capabilities:
Get common file path

Disassembly:
push 0x244
mov eax, 0x4ca9f7
call fcn.00496d1f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x250], esi
xor eax, eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x234]
mov dword [ebp - 4], ebx
push eax
push str.user_data_dir
push str.Software360360se6Chrome
push reloc.WS2_32.dll_accept
call fcn.004276ff
add esp, 0x10
test eax, eax
je 0x4273e6
mov byte [ebp - 0x250], bl
lea eax, [ebp - 0x234]
push dword [ebp - 0x250]
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov dword [esi + 0x14], ebx
call fcn.00403e90
jmp 0x42745d
lea eax, [ebp - 0x24c]
push eax
call fcn.00426346
pop ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.004043d8
lea ecx, [ebp - 0x24c]
call fcn.00404061
cmp dword [ebp - 0x224], 0
jne 0x4273c4
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.0049f230
add esp, 0xc
lea eax, [ebp - 0x21c]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42744f
push str.360se6User_Data
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.004022ea
lea ecx, [ebp - 0x234]
call fcn.00404061
mov eax, esi
call fcn.00496cc9
ret