joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454660
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4badef
mov eax, dword fs:[0]
push eax
sub esp, 0x898
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x454698
xor eax, eax
jmp 0x454844
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4546a9
xor eax, eax
jmp 0x454844
mov edx, dword [ebp + 8]
push edx
call fcn.00482238
add esp, 4
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0x104
jl 0x4546ce
xor eax, eax
jmp 0x454844
push 0x410
push 0
lea eax, [ebp - 0x894]
push eax
call fcn.00482260
add esp, 0xc
push 0x4c5914
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x894]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0xffffffff
je 0x45473e
mov ecx, dword [ebp - 0x89c]
and ecx, 1
je 0x45473e
mov edx, dword [ebp - 0x89c]
and edx, 0xfffffffe
mov dword [ebp - 0x89c], edx
mov eax, dword [ebp - 0x89c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x47c]
call fcn.0040ab80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x894]
push edx
lea ecx, [ebp - 0x47c]
call fcn.0040aa00
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0
je 0x45480b
lea ecx, [ebp - 0x47c]
call fcn.0040a970
test eax, eax
je 0x454797
lea ecx, [ebp - 0x47c]
call fcn.0040a900
mov dword [ebp - 0x898], eax
jmp 0x454768
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x47c]
call fcn.00454c70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x47c]
call fcn.0040a950
test eax, eax
je 0x4547d2
lea ecx, [ebp - 0x8a0]
call fcn.00402e20
push eax
call fcn.00454660
add esp, 4
jmp 0x4547e6
lea ecx, [ebp - 0x8a0]
call fcn.00402e20
push eax
call fcn.004545b0
add esp, 4
lea ecx, [ebp - 0x47c]
call fcn.0040a900
mov dword [ebp - 0x898], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8a0]
call fcn.00404680
jmp 0x454768
lea ecx, [ebp - 0x47c]
call fcn.0040ab20
mov ecx, dword [ebp + 8]
push ecx
call fcn.00453ef0
add esp, 4
mov dword [ebp - 0x8a4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.0040ab50
mov eax, dword [ebp - 0x8a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x45aa80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x154], ecx
cmp dword [0x4e5530], 0
jl 0x45aab3
xor eax, eax
cmp dword [0x4e5530], 0
setne al
jmp 0x45ab76
mov dword [0x4e5530], 0
push 0x24
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00482260
add esp, 0xc
push 0x11c
push 0
lea ecx, [ebp - 0x150]
push ecx
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x150], 0x11c
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45ab22
mov dword [ebp - 0x150], 0x114
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x45ab22
xor eax, eax
jmp 0x45ab76
push 0x4c5b00
push 0x4c5b14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45ab4b
lea ecx, [ebp - 0x2c]
push ecx
call dword [ebp - 8]
jmp 0x45ab4f
xor eax, eax
jmp 0x45ab76
movzx edx, word [ebp - 0x2c]
cmp edx, 9
je 0x45ab61
movzx eax, word [ebp - 0x2c]
cmp eax, 6
jne 0x45ab74
mov dword [0x4e5530], 1
mov eax, 1
jmp 0x45ab76
xor eax, eax
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x4601e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4601f4
jmp 0x46024f
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406f70
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.call_exe_begin__path__s__cmd__s_
call fcn.00449630
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004076b0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
push str.call_exe_return___d___path__s___cmd__s___sync__d_
call fcn.00449630
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x4603c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4603cc
jmp 0x460413
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4603dc
jmp 0x460413
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x460403
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00460540
add esp, 8
jmp 0x460413
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00460710
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x460420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbab6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x224], 0x104
lea ecx, [ebp - 0x220]
call fcn.00404750
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x4c5f70
push 0x4c5f78
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00482238
add esp, 4
test eax, eax
jbe 0x4604f0
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x220]
call fcn.00404490
lea ecx, [ebp - 0x220]
call fcn.00402a80
lea ecx, [ebp - 0x220]
call fcn.00402ad0
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.004041c0
mov ecx, dword [ebp - 0x228]
or ecx, 1
mov dword [ebp - 0x228], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00404680
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x460710
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbb24
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4e7d04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x460779
mov ecx, dword [ebp - 0x18]
and ecx, 0x10
je 0x460779
mov dword [ebp - 0x14], 1
mov edx, dword [ebp + 8]
push edx
call fcn.00453ef0
add esp, 4
test eax, eax
je 0x460777
jmp 0x4607f4
jmp 0x46079a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x46079a
mov ecx, dword [ebp + 8]
push ecx
push 0x4c5fa8
call fcn.00449630
add esp, 8
jmp 0x4607f4
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4607ec
cmp dword [ebp - 0x14], 0
jne 0x4607d4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4607d4
mov ecx, dword [ebp + 8]
push ecx
push str.DeleteFile:_s_suceesss
call fcn.00449630
add esp, 8
jmp 0x4607f4
cmp dword [ebp - 0x14], 0
je 0x4607ec
mov edx, dword [ebp + 8]
push edx
call fcn.00453ef0
add esp, 4
test eax, eax
je 0x4607ec
jmp 0x4607f4
xor eax, eax
jne 0x46073c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x460836
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00403ac0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040bbf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404680
xor eax, eax
jmp 0x46083b
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x460fa0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbbc7
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], 0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a500
mov dword [ebp - 4], 1
push 0x208
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.00482260
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x254]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Ludashi_switch.json
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x254]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x461039
jmp 0x46114b
lea ecx, [ebp - 0x4c]
call fcn.00422cd0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x254]
push eax
call fcn.00461190
add esp, 8
test eax, eax
je 0x46106b
lea ecx, [ebp - 0x4c]
call fcn.004535d0
movzx ecx, al
test ecx, ecx
je 0x46107c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040a730
jmp 0x46114b
lea ecx, [ebp - 0x4c]
call fcn.0040a7f0
push eax
call fcn.00470b10
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x461137
mov ecx, dword [ebp + 0xc]
call fcn.0040a7f0
push eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.004720f0
add esp, 8
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x4610d8
mov eax, dword [ebp - 0x30]
push eax
call fcn.00470a70
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040a730
jmp 0x46114b
mov ecx, dword [ebp + 0x10]
call fcn.0040a7f0
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call fcn.004720f0
add esp, 8
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x461119
mov edx, dword [ebp - 0x30]
push edx
call fcn.00470a70
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040a730
jmp 0x46114b
mov eax, dword [ebp - 0x258]
mov ecx, dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00453990
mov edx, dword [ebp - 0x30]
push edx
call fcn.00470a70
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040a730
xor eax, eax
jne 0x460fe8
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040a500
mov edx, dword [ebp - 0x260]
or edx, 1
mov dword [ebp - 0x260], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0040a730
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x4614c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbc70
mov eax, dword fs:[0]
push eax
mov eax, 0x222c
call fcn.00484d50
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00482260
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x461530
jmp 0x46168d
push 0x2000
push 0
lea edx, [ebp - 0x2224]
push edx
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x2228], 0x1000
lea eax, [ebp - 0x2228]
push eax
lea ecx, [ebp - 0x2224]
push ecx
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe_file_pe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x46158c
jmp 0x46168d
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 0x10], eax
push str..dll
mov edx, dword [ebp - 0x10]
push edx
call fcn.00488d8f
add esp, 8
test eax, eax
jne 0x4615d3
push 1
lea eax, [ebp - 0x2224]
push eax
push str.Uninst
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00460130
add esp, 0x10
jmp 0x46168d
push str..exe
mov edx, dword [ebp - 0x10]
push edx
call fcn.00488d8f
add esp, 8
test eax, eax
jne 0x46168d
lea eax, [ebp - 0x2224]
push eax
lea ecx, [ebp - 0x222c]
call fcn.00403ac0
mov dword [ebp - 4], 0
push str.__uninstall__productbizhi
lea ecx, [ebp - 0x222c]
push ecx
lea edx, [ebp - 0x2230]
push edx
call fcn.00402c80
add esp, 0xc
mov dword [ebp - 0x2234], eax
mov eax, dword [ebp - 0x2234]
mov dword [ebp - 0x2238], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2238]
push ecx
lea ecx, [ebp - 0x222c]
call fcn.004027b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2230]
call fcn.00404680
push 0xc350
push 1
push 1
lea ecx, [ebp - 0x222c]
call fcn.00402e20
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.004601e0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x222c]
call fcn.00404680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x4619f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbcc5
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x254
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 1
push 0x208
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x22c], 0x104
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x18]
push eax
push str.unistdate
push str.Software360WallPaperEver
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x461a87
mov dword [ebp - 0x14], 1
jmp 0x461c70
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x23c]
push eax
push 0x4c6594
lea ecx, [ebp - 0x228]
push ecx
call fcn.004888d1
add esp, 0x20
cmp eax, 6
jne 0x461c52
cmp dword [ebp - 0x23c], 0x76c
jge 0x461b27
mov dword [ebp - 0x23c], 0x76c
cmp dword [ebp - 0x238], 1
jl 0x461b39
cmp dword [ebp - 0x238], 0xc
jle 0x461b43
mov dword [ebp - 0x238], 1
cmp dword [ebp - 0x230], 1
jl 0x461b55
cmp dword [ebp - 0x230], 0x1f
jle 0x461b5f
mov dword [ebp - 0x230], 1
cmp dword [ebp - 0x244], 0
jl 0x461b71
cmp dword [ebp - 0x244], 0x17
jle 0x461b7b
mov dword [ebp - 0x244], 0
cmp dword [ebp - 0x240], 0
jl 0x461b8d
cmp dword [ebp - 0x240], 0x3b
jle 0x461b97
mov dword [ebp - 0x240], 0
cmp dword [ebp - 0x234], 0
jl 0x461ba9
cmp dword [ebp - 0x234], 0x3b
jle 0x461bb3
mov dword [ebp - 0x234], 0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x254]
call fcn.00462410
lea edx, [ebp - 0x24c]
push edx
call fcn.004623d0
mov eax, dword [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
lea edx, [ebp - 0x264]
push edx
lea ecx, [ebp - 0x24c]
call fcn.004625d0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00462310
mov ecx, dword [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
lea ecx, [ebp - 0x264]
call fcn.00462390
movzx eax, al
test eax, eax
je 0x461c52
mov dword [ebp - 0x14], 0
jmp 0x461c61
mov dword [ebp - 4], 0xffffffff
xor ecx, ecx
jne 0x461a29
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x461c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 1
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x214]
push eax
push 0x4c65d0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403ac0
mov edx, dword [ebp - 0x21c]
or edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret

Function at 0x461d30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
call fcn.00461c90
add esp, 4
push 0x208
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00482260
add esp, 0xc
push str.360safe.exe
lea ecx, [ebp - 0x214]
call fcn.00402e20
push eax
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x214]
call fcn.00404680
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret

Function at 0x461dc0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
call fcn.00461d30
test eax, eax
je 0x461de8
jmp 0x461e76
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x218], 0x104
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x214]
push eax
push str.InstallDir
push str.SoftwareTencentQQPCMgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x461e42
jmp 0x461e76
push str.QQPCMgr.exe
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x461e67
jmp 0x461e76
mov dword [ebp - 4], 0
xor eax, eax
jne 0x461dda
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x466e70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x466ef4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x466ecb
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x466ec2
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, 1
jmp 0x466ef6
mov edx, dword [ebp - 8]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.004677e0
mov ecx, dword [ebp - 8]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x467090
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x244], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0x4670d7
jmp 0x4671ab
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x46712a
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4671ab
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x238]
je 0x467187
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.00488d8f
add esp, 8
test eax, eax
jne 0x467187
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x248]
call fcn.004671c0
test eax, eax
je 0x467187
mov edx, dword [ebp - 0x238]
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00467a20
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x46713a
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret 8
Function at 0x46bbd0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc378
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x46bca9
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x46bca9
cmp dword [ebp + 0xc], 0
je 0x46bc37
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x46bc8b
xor ecx, ecx
mov word [ebp - 0x424], cx
push 0x40e
push 0
lea edx, [ebp - 0x422]
push edx
call fcn.00482260
add esp, 0xc
push 0
push 0
push 0x104
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
jl 0x46bc89
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x10], 1
jmp 0x46bca9
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jl 0x46bca9
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 0x10]
call fcn.0046cd30
test eax, eax
je 0x46bcc1
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp + 0x10]
call fcn.0046ce30
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0040ce90
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret 0x28