joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e70
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x467d3b
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x80c]
mov dword fs:[0], eax
mov eax, dword [0x484064]
mov dword [esp + 4], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 4]
push edx
mov dword [esp + 0x818], 0
call fcn.00433dd0
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0044e060
mov ecx, dword [esp + 0x10]
add esp, 0xc
push str.safemon360procmon.dll
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416f26
lea ecx, [esp + 8]
push ecx
call fcn.00404600
add esp, 4
test eax, eax
jne 0x416f26
call fcn.0044dbe0
push eax
lea edx, [esp + 0xc]
push edx
call fcn.0044ddf0
add esp, 8
jmp 0x416f35
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x416f66
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x416f62
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x416f62
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
xor eax, eax
jmp 0x416faa
push str.InstallCall
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416f78
call eax
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x416fa5
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x416fa5
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x80c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0044e04c
add esp, 0x814
ret
Function at 0x417110
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x467e5b
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x1010]
mov dword fs:[0], eax
mov eax, dword [0x484064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x101c], 0
call fcn.00433dd0
push 0x800
lea eax, [esp + 0x810]
push 0
push eax
call fcn.0044e060
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x46ed5c
push ecx
lea edx, [esp + 0x814]
push edx
call esi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044e060
add esp, 0xc
push str.SoftUpdate.dll
lea ecx, [esp + 0x810]
push ecx
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4171fb
lea ecx, [esp + 0xc]
push ecx
call fcn.00404600
add esp, 4
test eax, eax
jne 0x4171fb
call fcn.0044dbe0
push eax
lea edx, [esp + 0x10]
push edx
call fcn.0044ddf0
add esp, 8
jmp 0x417225
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x417225
push str.OnUninstall
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41721e
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x417252
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x417252
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.0044e04c
add esp, 0x1014
ret
Function at 0x417280
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x467e9b
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
mov eax, dword [0x484064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x81c], 0
call fcn.00433dd0
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044e060
mov ecx, dword [esp + 0x14]
add esp, 0xc
push str.leakrepair.dll
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417337
lea ecx, [esp + 0xc]
push ecx
call fcn.00404600
add esp, 4
test eax, eax
jne 0x417337
call fcn.0044dbe0
push eax
lea edx, [esp + 0x10]
push edx
call fcn.0044ddf0
add esp, 8
jmp 0x417361
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x417361
push str.OnUninstall
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41735a
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41738e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41738e
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0044e04c
add esp, 0x814
ret
Function at 0x4174f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x467e1b
mov eax, dword fs:[0]
push eax
mov eax, 0x1a10
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x1a0c], eax
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x1a18]
mov dword fs:[0], eax
mov eax, dword [0x484064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x1a24], 0
call fcn.00433dd0
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044e060
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x46ed5c
push ecx
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 0xc]
push eax
call fcn.00435f90
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x181a]
push edx
mov word [esp + 0x181c], cx
call fcn.0044e060
add esp, 0x10
push 1
push 0x26
lea eax, [esp + 0x1814]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
lea ecx, [esp + 0x1810]
push str.SoftwareMgrAppsWeb
push ecx
call fcn.0041d860
push 0
lea edx, [esp + 0x181c]
push str.SoftwareMgrAppsGreen
push edx
call fcn.0041d860
push 0
lea eax, [esp + 0x1828]
push str.SoftwareMgrApps
push eax
call fcn.0041d860
push 0x800
lea ecx, [esp + 0x834]
push 0
push ecx
call fcn.0044e060
push 0x800
lea edx, [esp + 0x1040]
push 0
push edx
call fcn.0044e060
add esp, 0x3c
push 0x208
lea eax, [esp + 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.360SoftMgr.cpl
lea ecx, [esp + 0x810]
push ecx
lea edx, [esp + 0x1014]
push edx
call esi
lea eax, [esp + 0x100c]
push eax
call fcn.00435850
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
add esp, 4
cmp ecx, dword [0x484060]
je 0x417684
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x417684
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
mov ecx, dword [esp + 0x1a18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1a0c]
xor ecx, esp
call fcn.0044e04c
add esp, 0x1a1c
ret
Function at 0x4176b0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x467e5b
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x1010]
mov dword fs:[0], eax
mov eax, dword [0x484064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x101c], 0
call fcn.00433dd0
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044e060
push 0x800
lea ecx, [esp + 0x81c]
push 0
push ecx
call fcn.0044e060
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0x18
push str.leakrepair.dll
push edx
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
call fcn.00435850
mov edx, dword [esp + 0xc]
add esp, 4
push str.hotfix
push edx
lea eax, [esp + 0x814]
push eax
call esi
lea ecx, [esp + 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esp + 8]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x4177a8
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4177a8
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.0044e04c
add esp, 0x1014
ret
Function at 0x418560
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x467f96
mov eax, dword fs:[0]
push eax
mov eax, 0x100c
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x1008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x1020]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x4185ae
xor eax, eax
jmp 0x418772
push 0x800
lea eax, [esp + 0x820]
push 0
push eax
call fcn.0044e060
add esp, 0xc
push 1
push 0x10
lea ecx, [esp + 0x824]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea edx, [esp + 0x20]
push 0
push edx
call fcn.0044e060
add esp, 0xc
push 0x88
lea ecx, [esp + 0x18]
call fcn.00418500
mov eax, dword [eax]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
lea eax, [esp + 0x820]
push eax
lea ecx, [esp + 0x24]
push ecx
call ebx
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x418642
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x418642
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
push 0x8a
lea ecx, [esp + 0x18]
call fcn.00418500
mov edi, dword [esp + 0x1030]
mov eax, dword [eax]
push edi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push str.360Safe.exe
push eax
mov ecx, esi
mov dword [esp + 0x1040], 0
call fcn.004167d0
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
mov dword [esp + 0x1028], 0xffffffff
cmp edx, dword [0x484060]
je 0x4186af
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4186af
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
mov ecx, dword [esi + 0xc]
call fcn.00433490
mov ecx, eax
call fcn.00421280
test eax, eax
jne 0x41876d
push 0x89
lea ecx, [esp + 0x18]
call fcn.00418500
mov eax, dword [eax]
push eax
lea eax, [esp + 0x820]
push eax
lea ecx, [esp + 0x24]
push ecx
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x41870f
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41870f
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
push 0x8b
lea ecx, [esp + 0x1c]
call fcn.00418500
mov edx, dword [eax]
push edi
push 0
lea ecx, [esp + 0x24]
push ecx
push str._startdesktop
push str.SoftMgrSoftManager.exe
push edx
mov ecx, esi
mov dword [esp + 0x1040], 1
call fcn.004167d0
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41876d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41876d
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x1020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.0044e04c
add esp, 0x1018
ret 4
Function at 0x4187a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x467fe6
mov eax, dword fs:[0]
push eax
mov eax, 0x200c
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x2008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x2020]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0xc], 0
jne 0x4187ee
xor eax, eax
jmp 0x4189e0
push 0x800
lea eax, [esp + 0x1020]
push 0
push eax
call fcn.0044e060
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x1024]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea edx, [esp + 0x20]
push 0
push edx
call fcn.0044e060
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [esp + 0x1020]
push eax
lea ecx, [esp + 0x24]
push ecx
call esi
push 0x800
lea edx, [esp + 0x820]
push 0
push edx
call fcn.0044e060
add esp, 0xc
push 0x88
lea ecx, [esp + 0x18]
call fcn.00418500
mov eax, dword [eax]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x824]
push ecx
call esi
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x4188ad
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4188ad
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
push 0x8a
lea ecx, [esp + 0x18]
call fcn.00418500
mov edi, dword [esp + 0x2030]
mov eax, dword [eax]
push edi
push 0
lea ecx, [esp + 0x824]
push ecx
push 0
push str.360Safe.exe
push eax
mov ecx, ebx
mov dword [esp + 0x2040], 0
call fcn.004167d0
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
mov dword [esp + 0x2028], 0xffffffff
cmp edx, dword [0x484060]
je 0x41891d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41891d
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
push 0x800
lea eax, [esp + 0x1820]
push 0
push eax
call fcn.0044e060
add esp, 0xc
push 0x89
lea ecx, [esp + 0x18]
call fcn.00418500
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1824]
push edx
call esi
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41897d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41897d
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
push 0x8b
lea ecx, [esp + 0x1c]
call fcn.00418500
mov eax, dword [eax]
push edi
push 0
lea edx, [esp + 0x1824]
push edx
push 0
push str.SoftMgrSoftManager.exe
push eax
mov ecx, ebx
mov dword [esp + 0x2040], 1
call fcn.004167d0
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x4189db
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4189db
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x2020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.0044e04c
add esp, 0x2018
ret 4
Function at 0x418c90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x2008
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x2004], eax
push esi
push edi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044e060
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea edx, [esp + 0x1010]
push 0
push edx
call fcn.0044e060
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1014]
push ecx
call esi
push 0x800
lea edx, [esp + 0x810]
push 0
push edx
call fcn.0044e060
add esp, 0xc
push 0x88
lea ecx, [esp + 0xc]
call fcn.00418500
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1010]
push ecx
lea edx, [esp + 0x814]
push edx
call esi
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x418d69
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x418d69
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
lea eax, [esp + 0x80c]
push eax
call fcn.00435850
push 0x800
lea ecx, [esp + 0x1814]
push 0
push ecx
call fcn.0044e060
add esp, 0x10
push 0x89
lea ecx, [esp + 0xc]
call fcn.00418500
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1010]
push eax
lea ecx, [esp + 0x1814]
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x418dd9
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x418dd9
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
lea ecx, [esp + 0x180c]
push ecx
call fcn.00435850
mov ecx, dword [esp + 0x2010]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0044e04c
add esp, 0x2008
ret
Function at 0x418e00
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov eax, 0x1008
call fcn.0044ef90
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1018]
push edi
push 0x800
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0044e060
push 0x800
lea ecx, [esp + 0x824]
push 0
push ecx
call fcn.0044e060
add esp, 0x18
push 0x8a
lea ecx, [esp + 0x14]
call fcn.00418500
mov edx, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
call edi
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x418e97
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x418e97
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00435f90
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 4
push 0x80
lea ecx, [esp + 0x18]
push ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x14]
push edx
call ebp
push 0xb2
lea ecx, [esp + 0x14]
call fcn.00418500
mov eax, dword [eax]
push eax
push esi
lea ecx, [esp + 0x81c]
push ecx
call edi
mov eax, dword [esp + 0x10]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x418f0c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x418f0c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
lea ecx, [esp + 0x814]
push ecx
call fcn.00435f90
add esp, 4
push 0x80
lea edx, [esp + 0x818]
push edx
call ebx
lea eax, [esp + 0x814]
push eax
call ebp
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044e04c
add esp, 0x1008
ret 4
Function at 0x418f50
Capabilities:
Delete directory
Get common file path

Disassembly:
sub esp, 0x808
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
push ebp
push esi
push edi
push 0x800
lea eax, [esp + 0x18]
push 0
push eax
mov ebx, ecx
call fcn.0044e060
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 1
push 2
lea ecx, [esp + 0x1c]
push ecx
push 0
call esi
push 0x256
lea ecx, [esp + 0x14]
call fcn.00418500
mov edx, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, eax
push ecx
call edi
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x418fe1
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x418fe1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00418e00
push 1
push 0x17
lea edx, [esp + 0x1c]
push edx
push 0
call esi
push 0x256
lea ecx, [esp + 0x14]
call fcn.00418500
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
push ecx
mov edx, ecx
push edx
call edi
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41903e
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41903e
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00418e00
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044e04c
add esp, 0x808
ret

Function at 0x419070
Capabilities:
Delete registry key
Persist via run registry key

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWARE360softmgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.Software360Safe
push SysReAllocString
call esi
push 0x98
lea ecx, [esp + 8]
call fcn.00418500
mov eax, dword [eax]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x4190ed
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4190ed
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0044ec74
add esp, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SYSTEMCurrentControlSetServiceszhudongfangyu
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareLiveupdate360
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWARE360Privacy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun360AutoDeamon
push SysReAllocString
call esi
pop esi
pop ecx
ret