joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401300
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x214], eax
push 0x20a
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0xc], 0
call fcn.00446040
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 8]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Game.exe
push SysReAllocStringLen
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [esp + 8], 0
je 0x40139b
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40139b
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00401720
mov eax, esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0044331b
add esp, 0x218
ret
xor eax, eax
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
push 0x468f5c
mov ecx, esi
mov word [esi + 4], ax
call fcn.00401790
mov ecx, dword [esp + 0x214]
xor ecx, esp
mov eax, esi
call fcn.0044331b
add esp, 0x218
ret

Function at 0x4013e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x628
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
mov ebx, dword [esp + 0x630]
push edi
xor eax, eax
push 0x208
mov edi, ecx
push eax
lea ecx, [esp + 0x222]
push ecx
mov dword [esp + 0x14], 0
mov word [esp + 0x224], ax
call fcn.00446040
add esp, 0xc
lea edx, [esp + 0x218]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00446040
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0
push 0x468f5c
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 0xc]
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x468dc8
push str.main
call edi
lea edx, [esp + 0xc]
push edx
push ebx
push str.title
push str.main
call edi
mov eax, dword [esp + 0x638]
push eax
lea ecx, [esp + 0x428]
push 0x468f60
push ecx
mov ecx, 0x104
call fcn.004027d0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x428]
push eax
push str.iconid
push str.main
call edi
xor ecx, ecx
lea eax, [esp + 0xc]
pop edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], cx
lea edx, [eax + 2]
pop ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4014f0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00401790
mov ecx, dword [esp + 0x624]
xor ecx, esp
mov eax, esi
call fcn.0044331b
add esp, 0x628
ret
Function at 0x401530
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45c97b
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x67c], eax
push esi
push edi
mov eax, dword [0x4773f0]
xor eax, esp
push eax
lea eax, [esp + 0x690]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x76]
push ecx
mov word [esp + 0x78], ax
call fcn.00446040
mov eax, dword [0x4a05a4]
add esp, 0xc
push 0x104
lea edx, [esp + 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....UtilsModuleUpdate.exe
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4016f0
lea edi, [esp + 0x6c]
call fcn.00402490
test eax, eax
je 0x4016f0
mov eax, dword [0x4788a4]
mov dword [esp + 0x10], eax
mov ecx, edi
push ecx
push str.__s___updateid360game__SECTIONID360game__NOTIFYWINDOW__NAME__UPDATETYPEPRODUCT__execarg___S__autorun__pidws_jsq__360GameCmd__fromws_jsq__
lea ecx, [esp + 0x18]
mov dword [esp + 0x6a0], 0
call fcn.004021e0
push 0x40
lea edx, [esp + 0x34]
push 0
push edx
call fcn.00446040
add esp, 0x14
xor eax, eax
xor ecx, ecx
push 0x40e
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push ecx
lea edx, [esp + 0x27e]
mov eax, 5
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x30], 0x44
mov word [esp + 0x60], ax
mov word [esp + 0x280], cx
call fcn.00446040
mov esi, dword [esp + 0x1c]
add esp, 0xc
push esi
lea eax, [esp + 0x278]
push 0x208
push eax
call fcn.00443690
mov esi, dword [esi - 8]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [esp + 0x34]
call fcn.00402ca0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00402a70
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov dword [esi - 8], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x4016ce
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
lea ecx, [esi - 0xc]
cmp ecx, dword [0x4788a0]
je 0x4016f0
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4016f0
push esi
call fcn.00443685
add esp, 4
mov ecx, dword [esp + 0x690]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x67c]
xor ecx, esp
call fcn.0044331b
mov esp, ebp
pop ebp
ret
Function at 0x4022c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00446040
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402344
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044331b
add esp, 0x814
ret
push str.360ver.dll
lea edx, [esp + 0x14]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402328
lea edi, [esp + 0x10]
call fcn.00402260
mov esi, eax
test esi, esi
je 0x402328
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x814]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0044331b
add esp, 0x814
ret

Function at 0x4023b0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1008
call fcn.00455930
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
mov ebx, dword [esp + 0x1010]
push edi
push 0x1000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00446040
add esp, 0xc
push 0x469070
lea edi, [esp + 0xc]
call fcn.00402200
push esi
call fcn.00402200
push 0x469078
call fcn.00402200
push esi
call fcn.00402200
push str.vL
call fcn.00402200
push ebx
call fcn.00402200
push 0x4690c8
call fcn.00402200
push 0x14
push esi
mov ecx, edi
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x402484
push 0xc8
push 0x468f78
push str.http:__down.360safe.com_setup.exe
call fcn.004472de
add esp, 0xc
test eax, eax
jne 0x40246c
call fcn.004022c0
test eax, eax
je 0x40246c
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x402477
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call fcn.00443a90
int3

Function at 0x402490
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
push esi
call fcn.00402920
test eax, eax
je 0x4024dc
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040a1f0
add esp, 4
test eax, eax
jne 0x4024d2
push edi
push 0x4a1c28
lea esi, [esp + 0x10]
call fcn.0040a320
test eax, eax
je 0x4024dc
cmp dword [esp + 8], 3
je 0x4024dc
mov eax, 1
pop esi
add esp, 8
ret
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4024ec
pop esi
add esp, 8
ret
push edi
mov esi, 0x4788a8
call fcn.004023b0
int3
Function at 0x402500
Capabilities:
Create process on windows

Disassembly:
push ecx
call fcn.00402920
test eax, eax
je 0x40253f
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040a1f0
add esp, 4
test eax, eax
jne 0x402543
push esi
push edi
push 0x4a1c28
lea esi, [esp + 0xc]
call fcn.0040a320
pop esi
test eax, eax
je 0x40253f
cmp dword [esp], 3
jne 0x402543
xor eax, eax
pop ecx
ret
push 5
push 0
push str._funnameqinglilaji
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ecx
ret
Function at 0x406130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x406140
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406150
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406630
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x4066aa
xor eax, eax
cmp ecx, ebp
je 0x406692
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x4066b8
cmp ecx, ebp
je 0x40674b
push ecx
jmp 0x406745
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x40671a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00406630
mov ebx, eax
cmp ebx, ebp
jne 0x406768
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x4066e0
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x40672d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.004067e0
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x40674b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044331b
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x406777
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40674d
Function at 0x407280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x45c2e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4773f0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov esi, dword [ebp + 0x414]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
jne 0x4072ff
call fcn.00405a70
mov esi, eax
jmp 0x4073e1
mov eax, dword [ebp - 0x14]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x40731b
call fcn.00405a70
jmp 0x4073d8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x407334
call fcn.00405a70
jmp 0x4073d8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x14], eax
cmp ecx, eax
jae 0x407368
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x407356
lea eax, [ebp]
call fcn.00401bd0
lea esi, [ebp - 0x1c]
call fcn.00406180
mov eax, 0x8007000e
jmp 0x4073f3
mov eax, ecx
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.00405a30
mov dword [ebp - 4], 1
jmp 0x407391
mov ecx, dword [ebp]
cmp ecx, ebx
jne 0x40739f
mov esi, 0x8007000e
jmp 0x4073da
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
push eax
push ecx
push eax
push edx
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x4073bd
call fcn.00405a70
jmp 0x4073d8
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.00407130
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x4073f1
lea eax, [ebp]
call fcn.00401bd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0044331b
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407fe0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
lea eax, [esp + 0x10]
push eax
push ebp
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x408004
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push esi
call fcn.00443d41
mov edi, eax
add esp, 4
test edi, edi
jne 0x40801c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push esi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x408057
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x469e84
push edi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
push edi
call fcn.0044332a
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
Function at 0x4084f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x19c
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x198], eax
xor eax, eax
push 0x18e
push eax
lea ecx, [esp + 0x12]
mov dword [esp + 8], 0
push ecx
mov word [esp + 0x14], ax
call fcn.00446040
add esp, 0xc
lea edx, [esp]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationsFtpUserChoice_
push SysReAllocStringLen
mov dword [esp + 0x18], 0xc8
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00402760
mov ecx, dword [esp + 0x198]
xor ecx, esp
mov eax, esi
call fcn.0044331b
add esp, 0x19c
ret
Function at 0x408890
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x45c8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
mov eax, dword [0x4773f0]
xor eax, esp
push eax
lea eax, [esp + 0x424]
mov dword fs:[0], eax
mov dword [esp + 0x42c], 0
mov eax, dword [esp + 0x434]
cmp dword [eax - 8], 0
je 0x408a47
push 0x208
lea eax, [esp + 0x21c]
push 0
push eax
call fcn.00446040
mov edx, dword [0x4a05a4]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x21c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x218]
push eax
call esi
lea ecx, [esp + 0x218]
push ecx
call esi
push 0x469dd4
lea edx, [esp + 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00446040
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x4089dd
cmp dword [esp + 8], 1
jne 0x4089dd
lea edx, [esp + 0x10]
push edx
call fcn.00409d40
add esp, 4
test eax, eax
je 0x4089dd
lea eax, [esp + 0x218]
push eax
call fcn.00409f00
add esp, 4
test eax, eax
je 0x4089dd
mov ecx, dword [esp + 0x434]
push 0
lea edx, [esp + 0x14]
call fcn.00409d90
add esp, 4
lea ecx, [esp + 0x434]
call fcn.00402dc0
jmp 0x408a73
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x408a40
cmp dword [esp + 8], 1
jne 0x408a40
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408a40
lea edx, [esp + 0x218]
push edx
call fcn.00409f00
add esp, 4
test eax, eax
je 0x408a40
mov ecx, dword [esp + 0x434]
push str.open
lea edx, [esp + 0x14]
call fcn.00409d90
add esp, 4
mov eax, dword [esp + 0x434]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4788a0]
je 0x408a73
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x408a73
mov edx, dword [esp + 0x434]
add edx, 0xfffffff4
push edx
call fcn.00443685
add esp, 4
mov ecx, dword [esp + 0x424]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0044331b
add esp, 0x428
ret
Function at 0x408ad0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x408aa0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x408b16
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
push 0
push str.360NetmonWindowClass364B97E2_D014_4e2f_88C7_482B040F0D31
call dword [sym.imp.USER32.dll_FindWindowW]
pop esi
pop ecx
ret
Function at 0x408b90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x14e4
call fcn.00455930
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x14e0], eax
push esi
push edi
push 0x208
lea eax, [esp + 0x214]
push 0
push eax
call fcn.00446040
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360SafeTrashAutoScan.ini
lea edx, [esp + 0x214]
push edx
call esi
push 0x10ce
lea eax, [esp + 0x41c]
push str.ie_chachesysid3210sysid3075sysid3205sysid3106sysid3103sysid3204sysid3102sysid6004sysid3201sysid6003sysid3008sysid3002sysid6009sysid5999sysid3208sysid6002sysid3005sysid3209sysid6000sysid3009sysid6008sysid4011sysid3207sysid3203sysid3107sysid3206sysid3202sysid6001sysid4067sysid3000sysid4070sysid2004sysid3403sys_quick_timesysid7003sysid7000sysid3402sysid4069sysid4083sysid3129sysid4022sys_360_loudongsysid3046sysid7004sysid7005sys_adobe_airsys_adobe_photoshopsys_apple_updatesys_avastsys_avgsys_antivir_desktopsys_daemon_toolssysid4012sysid4013sysid4057sysid4020sysid2040sys_flash_cachesysid3404sysid4064sysid4004sys_office_filessysid3406sys_office_recentsysid3020sysid4062sys_ms_silverlightsysid4065sysid4009sysid4099sysid4005sysid3052sysid6007sysid3105sysid6006sysid4006sysid4082sysid4014sysid4063sysid2009sysid3023sys_ms_windefendersys_ms_livesysid3022sysid3014sysid4002sysid4003sysid3024sysid3007sysid3004sysid3003sysid4084sysid4097sysid3051sysid7001sysid7009sysid3025sysid3405sysid3048sysid4016sysid2018sysid4061sysid3401sys_ks_loudongsysid3011sysid4010sysid3016sysid3018sysid3050sysid3130sysid4101sys_lu_loudongsysid3600sysid3012sysid3070sysid3128sys_nortonsysid3019sysid4095sysid7002sysid3104sys_qq_loudongsysid3079sysid4001sysid3043sysid3067sysid3044sysid3021sysid3045sysid3015sysid3013sys_tmpsys_thumbsys_mem_zhuanchusys_win_err_reportsys_update_filessys_iis_logssysid3131sysid3073sys_win_pre_readsysid3078sysid3072sys_logssys_invalid_lnksys_update_uninstall_filessysid3101sysid4030sysid4031sysid4032sysid4033sysid4034sysid4035sysid4024sysid4025sysid4026sysid4027sysid4028sysid4029sysid4023sysid3074sysid3076sysid3211sysid4036sysid4037sysid4038sysid4053sysid4054sysid4055sysid4056sysid4039sysid4059sysid4040sysid4041sysid4042sysid4043sysid4045sysid4046sysid4047sysid4048sysid4049sysid4050sysid4051sysid4052
push eax
call fcn.004467e0
add esp, 0xc
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0x41c]
push edx
push str.checked
push str.autoscan
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00446040
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....360Safe.exe
lea edx, [esp + 0xc]
push edx
call esi
lea edi, [esp + 8]
call fcn.00402500
mov ecx, dword [esp + 0x14e8]
pop edi
pop esi
xor ecx, esp
call fcn.0044331b
add esp, 0x14e4
ret