joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4181e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4681f6
mov eax, dword fs:[0]
push eax
mov eax, 0x200c
call fcn.0044f1e0
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x2008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485b90]
xor eax, esp
push eax
lea eax, [esp + 0x2020]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0xc], 0
jne 0x41822e
xor eax, eax
jmp 0x418420
push 0x800
lea eax, [esp + 0x1020]
push 0
push eax
call fcn.0044e2b0
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x1024]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea edx, [esp + 0x20]
push 0
push edx
call fcn.0044e2b0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [esp + 0x1020]
push eax
lea ecx, [esp + 0x24]
push ecx
call esi
push 0x800
lea edx, [esp + 0x820]
push 0
push edx
call fcn.0044e2b0
add esp, 0xc
push 0x88
lea ecx, [esp + 0x18]
call fcn.00417f40
mov eax, dword [eax]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x824]
push ecx
call esi
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x4182ed
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4182ed
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044eec4
add esp, 4
push 0x8a
lea ecx, [esp + 0x18]
call fcn.00417f40
mov edi, dword [esp + 0x2030]
mov eax, dword [eax]
push edi
push 0
lea ecx, [esp + 0x824]
push ecx
push 0
push str.360Safe.exe
push eax
mov ecx, ebx
mov dword [esp + 0x2040], 0
call fcn.00416330
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
mov dword [esp + 0x2028], 0xffffffff
cmp edx, dword [0x484060]
je 0x41835d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41835d
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044eec4
add esp, 4
push 0x800
lea eax, [esp + 0x1820]
push 0
push eax
call fcn.0044e2b0
add esp, 0xc
push 0x89
lea ecx, [esp + 0x18]
call fcn.00417f40
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1824]
push edx
call esi
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x4183bd
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4183bd
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044eec4
add esp, 4
push 0x8b
lea ecx, [esp + 0x1c]
call fcn.00417f40
mov eax, dword [eax]
push edi
push 0
lea edx, [esp + 0x1824]
push edx
push 0
push str.SoftMgrSoftManager.exe
push eax
mov ecx, ebx
mov dword [esp + 0x2040], 1
call fcn.00416330
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41841b
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41841b
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0044eec4
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x2020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.0044e29c
add esp, 0x2018
ret 4
Function at 0x418ca0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x2008
call fcn.0044f1e0
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x2004], eax
push esi
push edi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044e2b0
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea edx, [esp + 0x1010]
push 0
push edx
call fcn.0044e2b0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1014]
push ecx
call esi
push 0x800
lea edx, [esp + 0x810]
push 0
push edx
call fcn.0044e2b0
add esp, 0xc
push 0x88
lea ecx, [esp + 0xc]
call fcn.00417f40
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1010]
push ecx
lea edx, [esp + 0x814]
push edx
call esi
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x418d79
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x418d79
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044eec4
add esp, 4
lea eax, [esp + 0x80c]
push eax
call fcn.00434360
push 0x800
lea ecx, [esp + 0x1814]
push 0
push ecx
call fcn.0044e2b0
add esp, 0x10
push 0x89
lea ecx, [esp + 0xc]
call fcn.00417f40
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1010]
push eax
lea ecx, [esp + 0x1814]
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x418de9
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x418de9
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
call fcn.0044eec4
add esp, 4
lea ecx, [esp + 0x180c]
push ecx
call fcn.00434360
mov ecx, dword [esp + 0x2010]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0044e29c
add esp, 0x2008
ret
Function at 0x418e10
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov eax, 0x1008
call fcn.0044f1e0
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1018]
push edi
push 0x800
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0044e2b0
push 0x800
lea ecx, [esp + 0x824]
push 0
push ecx
call fcn.0044e2b0
add esp, 0x18
push 0x8a
lea ecx, [esp + 0x14]
call fcn.00417f40
mov edx, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
call edi
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x418ea7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x418ea7
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044eec4
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00434a40
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 4
push 0x80
lea ecx, [esp + 0x18]
push ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x14]
push edx
call ebp
push 0xb2
lea ecx, [esp + 0x14]
call fcn.00417f40
mov eax, dword [eax]
push eax
push esi
lea ecx, [esp + 0x81c]
push ecx
call edi
mov eax, dword [esp + 0x10]
lea edx, [eax - 0xc]
cmp edx, dword [0x484060]
je 0x418f1c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x418f1c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044eec4
add esp, 4
lea ecx, [esp + 0x814]
push ecx
call fcn.00434a40
add esp, 4
push 0x80
lea edx, [esp + 0x818]
push edx
call ebx
lea eax, [esp + 0x814]
push eax
call ebp
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044e29c
add esp, 0x1008
ret 4

Function at 0x418f60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0044e2b0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 1
push 2
lea ecx, [esp + 0x10]
push ecx
push 0
call edi
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00418e10
push 1
push 0x17
lea eax, [esp + 0x10]
push eax
push 0
call edi
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00418e10
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.0044e29c
add esp, 0x804
ret
push esi
mov esi, ecx
call fcn.00418a20
mov ecx, esi
call fcn.00418ca0
mov ecx, esi
pop esi
jmp 0x418f60
Function at 0x418fe0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0044e2b0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 1
push 2
lea ecx, [esp + 0x10]
push ecx
push 0
call edi
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00418e10
push 1
push 0x17
lea eax, [esp + 0x10]
push eax
push 0
call edi
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00418e10
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.0044e29c
add esp, 0x804
ret
push esi
mov esi, ecx
call fcn.00418a20
mov ecx, esi
call fcn.00418ca0
mov ecx, esi
pop esi
jmp 0x418f60

Function at 0x419000
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWARE360softmgr
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.Software360Safe
push SysReAllocString
call esi
push 0x98
lea ecx, [esp + 8]
call fcn.00417f40
mov eax, dword [eax]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x484060]
je 0x41907d
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41907d
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.0044eec4
add esp, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SYSTEMCurrentControlSetServiceszhudongfangyu
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.Software360down
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SoftwareLiveupdate360
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SOFTWARE360Privacy
push reloc.OLEAUT32.dll_SysReAllocString
call esi
pop esi
pop ecx
ret
Function at 0x419710
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4683bb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485b90]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24c]
mov esi, dword [esp + 0x250]
mov ecx, dword [esp + 0x25c]
mov ebp, dword [esp + 0x248]
mov edi, dword [esp + 0x254]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], ecx
cmp esi, eax
je 0x419843
xor edx, edx
mov word [esi], dx
cmp edi, eax
je 0x41978b
mov dword [edi], eax
mov ebx, dword [0x484064]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x240], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x41981b
lea ecx, [esp + 0x20]
push ecx
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x41980f
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x36]
push eax
mov word [esp + 0x38], dx
call fcn.0044e2b0
mov edx, dword [esp + 0x2c]
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.004179a0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [ebx - 8], 0
jne 0x41984a
lea eax, [ebx - 0xc]
cmp eax, dword [0x484060]
je 0x419843
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x419843
push esi
call fcn.0044eec4
add esp, 4
xor eax, eax
jmp 0x4198d0
push str.Wininet.dll
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea ecx, [esp + 0x1c]
call fcn.004158e0
mov ecx, dword [esp + 0x14]
push ecx
call sub.KERNEL32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x4198a6
push str.InternetGetCookieExW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41989f
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x258]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edi
push esi
push edx
push ebp
call eax
mov dword [esp + 0x18], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x14]
lea eax, [esi - 0xc]
cmp eax, dword [0x484060]
je 0x4198cc
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4198cc
push esi
call fcn.0044eec4
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0044e29c
add esp, 0x230
ret
Function at 0x419ff0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x468496
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
mov eax, dword [0x485b90]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov eax, dword [0x484064]
mov esi, ecx
push 0x2712
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.00417e50
mov ebx, dword [esp + 0x18]
push ebx
mov dword [esp + 0x234], 0
call fcn.0044f181
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41a15e
mov ecx, dword [esi + 0xc]
call fcn.00432030
mov ecx, eax
call fcn.00420820
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x41a09e
mov esi, eax
lea ecx, [esi - 0xc]
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41a0b6
mov edx, dword [0x484064]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.004179a0
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], 0
mov byte [esp + 0x230], 1
jne 0x41a133
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.0044e2b0
push 0
push 0
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
push str.userid
push str.http:__my.360safe.com
mov dword [esp + 0x40], 0x100
call fcn.00419710
lea eax, [esp + 0x48]
add esp, 0x24
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a110
sub eax, edx
sar eax, 1
je 0x41a133
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.004179a0
mov esi, dword [esp + 0x10]
push esi
call fcn.0044f181
lea edx, [esi - 0xc]
add esp, 4
mov dword [esp + 0x14], eax
cmp edx, dword [0x484060]
je 0x41a15e
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x41a15e
push esi
call fcn.0044eec4
add esp, 4
cmp dword [esp + 0x14], 0
jbe 0x41a1ac
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.UserID
push str.Software360safe
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x41a1ac
lea ecx, [ebx - 0xc]
cmp ecx, dword [0x484060]
je 0x41a1a5
lea esi, [ebx - 0xc]
push esi
call ebp
test eax, eax
jg 0x41a1a5
push esi
call fcn.0044eec4
add esp, 4
mov eax, 1
jmp 0x41a1cc
lea edx, [ebx - 0xc]
cmp edx, dword [0x484060]
je 0x41a1ca
lea esi, [ebx - 0xc]
push esi
call ebp
test eax, eax
jg 0x41a1ca
push esi
call fcn.0044eec4
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0044e29c
add esp, 0x224
ret
Function at 0x41bdf0
Capabilities:
Delete file
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
sub esp, 0x20c
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x46f8dc
push 0x46f878
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0044e2b0
add esp, 0xc
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x41be60
push 0x46f858
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044e29c
add esp, 0x20c
ret

Function at 0x41be80
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.Start
push str.SYSTEMCurrentControlSetServicesPacket
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41bec6
xor eax, eax
add esp, 0xc
ret
cmp dword [esp], 3
jne 0x41befc
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push edx
push str.Start
push str.SYSTEMCurrentControlSetServicesPacket
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x41bec0
mov eax, 1
add esp, 0xc
ret
Function at 0x41bf10
Capabilities:
Check if file exists
Copy file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
push esi
test eax, eax
je 0x41c0b2
mov esi, dword [esp + 0x30]
test esi, esi
je 0x41c0b2
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bf30
sub eax, edx
push ebx
sar eax, 1
mov ebx, eax
push ebp
mov eax, esi
push edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bf50
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
xor ecx, ecx
lea eax, [ebx + ebx + 2]
mov edx, 2
xor esi, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043cabb
mov ebp, eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
lea eax, [eax + eax + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043cabb
add esp, 8
mov edi, eax
test ebp, ebp
je 0x41c099
test edi, edi
je 0x41c090
mov eax, dword [esp + 0x38]
mov edx, ebp
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41bfc0
xor eax, eax
mov word [ebp + ebx*2], ax
mov eax, dword [esp + 0x3c]
xor ecx, ecx
mov edx, edi
mov word [ebp + ebx*2 + 2], cx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x41bfe5
mov eax, dword [esp + 0x10]
xor edx, edx
xor ecx, ecx
mov word [edi + eax*2], dx
mov word [edi + eax*2 + 2], cx
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c010
sub eax, edx
sar eax, 1
je 0x41c035
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c035
push edi
call fcn.00434a40
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x30], ax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x2e], eax
lea eax, [esp + 0x14]
mov edx, 0x614
push eax
mov word [esp + 0x28], dx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebp
call fcn.0044eec4
add esp, 4
test edi, edi
je 0x41c0a6
push edi
call fcn.0044eec4
add esp, 4
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x24
ret 8
xor eax, eax
pop esi
add esp, 0x24
ret 8

Function at 0x41c100
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [ecx + 4]
sub esp, 0xc
test ecx, ecx
je 0x41c16b
call fcn.00431f20
test eax, eax
je 0x41c16b
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push str.modules360se_ph.exe
push eax
call edx
test eax, eax
je 0x41c16b
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.needrun
push str.Software360se_ph
push SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41c16b
mov eax, 1
cmp dword [esp], eax
je 0x41c16d
xor eax, eax
add esp, 0xc
ret
Function at 0x41c280
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x804
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push edi
mov edi, dword [esp + 0x814]
test esi, esi
je 0x41c345
test edi, edi
je 0x41c345
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0044e2b0
add esp, 0xc
push edi
push esi
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c345
push ebx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test bl, 1
je 0x41c306
and ebx, 0xfffffffe
push ebx
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
pop ebx
je 0x41c33a
cmp dword [esp + 0x818], 0
jne 0x41c345
lea edx, [esp + 8]
push edx
call fcn.00401d70
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0044e29c
add esp, 0x804
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.0044e29c
add esp, 0x804
ret
Function at 0x41c360
Capabilities:
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov eax, 0x1810
call fcn.0044f1e0
mov eax, dword [0x485b90]
xor eax, esp
mov dword [esp + 0x180c], eax
push ebx
mov ebx, dword [esp + 0x1820]
push ebp
mov ebp, dword [esp + 0x1828]
push esi
mov esi, dword [esp + 0x1820]
push edi
mov edi, dword [esp + 0x1828]
push 0x800
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0044e2b0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push str.libver
push 0x46fb98
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.0044f0d8
add esp, 8
test eax, eax
jge 0x41c456
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c3f7
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push str.libver
push 0x46fb98
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c430
sub eax, edx
sar eax, 1
add eax, eax
push eax
push edi
push 1
push str.libdate
push 0x46fb98
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x800
lea ecx, [esp + 0x820]
push 0
push ecx
call fcn.0044e2b0
add esp, 0xc
push str.updatecfg.ini
push ebx
lea edx, [esp + 0x824]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x800
lea eax, [esp + 0x1020]
push 0
push eax
call fcn.0044e2b0
add esp, 0xc
lea ecx, [esp + 0x81c]
push ecx
push 0x40
lea edx, [esp + 0x1024]
push edx
push 0x477478
push 0x47806c
push str.360lib
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x101c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c4d0
sub eax, edx
sar eax, 1
jne 0x41c4fa
lea eax, [esp + 0x81c]
push eax
push ebp
push 0x47806c
push str.360lib
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0x181c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044e29c
add esp, 0x1810
ret 0x10