joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41090c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov esi, ecx
xor ecx, ecx
cmp byte [ebp + 0x10], bl
mov dword [ebp - 8], ebx
sete cl
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
dec ecx
and ecx, 0x100
add ecx, 0x20006
cmp dword [eax + 0x14], 8
jb 0x41093f
mov eax, dword [eax]
push ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
call fcn.0044ef9e
mov edi, eax
cmp edi, ebx
jne 0x41097d
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x41095d
mov esi, dword [esi]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
jb 0x410968
mov ecx, dword [ecx]
lea eax, [eax + eax + 1]
push eax
push esi
push 2
push ebx
push ecx
push dword [ebp - 0xc]
call dword [0x52b01c]
mov edi, eax
lea esi, [ebp - 0xc]
call fcn.0044effe
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410eca
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
xor eax, eax
cmp byte [ebp + 0xc], bl
push esi
sete al
push edi
mov dword [ebp - 4], ebx
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
lea edi, [eax - 1]
and edi, 0x100
add edi, 0x20006
call fcn.0044effe
mov eax, esi
push eax
push edi
push ebx
push str.softwareclassesCLSIDD5E8041D_920F_45e9_B8FB_B1DEB82C6E5E
push dword [ebp + 8]
call dword [0x52b010]
mov edi, eax
cmp edi, ebx
jne 0x410f26
push str.TreatAs
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edi, eax
lea esi, [ebp - 8]
call fcn.0044effe
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41101c
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00506540
add esp, 0xc
push ebx
push 0x26
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41118d
lea edi, [ebp - 0x210]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x411074
push 0x10
pop ecx
lea eax, [ebp - 0x210]
mov esi, str.internet_exploreriexplore.exe
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41118d
xor eax, eax
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x248]
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], ebx
call fcn.0040204f
lea esi, [ebp - 0x22c]
lea ecx, [ebp - 0x248]
call fcn.0040a198
test al, al
je 0x411171
mov ecx, esi
call fcn.00434dd0
mov dword [ebp - 0x268], eax
cmp eax, ebx
je 0x411171
push str.10.0.0.0
lea esi, [ebp - 0x264]
call fcn.0040204f
mov ecx, esi
call fcn.00434dd0
push 1
xor edi, edi
mov ebx, eax
call fcn.004021a4
mov esi, dword [ebp - 0x268]
mov eax, esi
mov ecx, ebx
call fcn.00434d24
test al, al
jne 0x41115d
test ebx, ebx
je 0x411135
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 1
xor edi, edi
lea esi, [ebp - 0x248]
call fcn.004021a4
push 1
lea esi, [ebp - 0x22c]
call fcn.004021a4
mov al, 1
jmp 0x41118f
test ebx, ebx
je 0x411169
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 1
xor edi, edi
lea esi, [ebp - 0x248]
call fcn.004021a4
push 1
lea esi, [ebp - 0x22c]
call fcn.004021a4
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
Function at 0x411233
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
mov ebx, 0x543da0
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
mov edi, 0x104
push 0x80000002
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x624], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4112c0
xor al, al
jmp 0x411376
xor eax, eax
push esi
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.00506540
add esp, 0xc
push str.360seURL
push str._s_shellopencommand
lea eax, [ebp - 0x418]
push 0x103
push eax
call fcn.004ff336
xor eax, eax
push esi
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.00506540
add esp, 0x1c
lea eax, [ebp - 0x210]
push eax
push str.__s_____1_
lea eax, [ebp - 0x620]
push edi
push eax
call fcn.004ff336
lea eax, [ebp - 0x620]
push eax
push ebx
lea edi, [ebp - 0x418]
mov esi, 0x80000000
call fcn.0041138d
add esp, 0x18
test al, al
je 0x4112b9
call fcn.00452c1a
cmp dword [eax], 3
push str.360seURL
jl 0x411385
push str.Progid
mov edi, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
inc esi
call fcn.0041138d
pop ecx
pop ecx
test al, al
je 0x4112b9
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
push ebx
mov edi, str..html
jmp 0x411365

Function at 0x41138d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a4]
push ebx
mov ebx, dword [ebp + 0x1a0]
mov dword [ebp - 0x7c], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x80], 0x207
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop ebx
test eax, eax
jne 0x411414
cmp ax, word [ebp - 0x74]
je 0x411414
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
call fcn.004ff138
pop ecx
pop ecx
test eax, eax
jne 0x411414
mov al, 1
jmp 0x411416
xor al, al
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
call fcn.004fe191
add ebp, 0x198
leave
ret
Function at 0x411c83
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], 0
push esi
mov esi, ecx
je 0x411d45
push str.repairsedefbrow
mov ecx, edi
call fcn.0040c540
test eax, eax
jne 0x411cc2
call fcn.0041142b
test al, al
je 0x411d45
jmp 0x411cdb
push str.setsedefbrow
mov ecx, edi
call fcn.0040c540
test eax, eax
jne 0x411d45
call fcn.004117de
test al, al
jne 0x411d45
cmp dword [esi + 0x14], 8
jb 0x411ce5
mov eax, dword [esi]
jmp 0x411ce7
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411d45
xor eax, eax
push 0x81e
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.00506540
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x411d18
mov esi, dword [esi]
push str.__make_default_browser
push esi
push str.__s___s
push 0xffffffffffffffff
lea eax, [ebp - 0x828]
push 0x410
push eax
call fcn.004ff4db
lea eax, [ebp - 0x828]
push eax
call fcn.00406fec
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004fe191
leave
ret
Function at 0x411d9f
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
cmp ax, word [0x6c82d8]
jne 0x411dc9
call fcn.00412414
mov edi, eax
jmp 0x411dce
mov edi, 0x6c82d8
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.00506540
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00506540
add esp, 0xc
push edi
push str.__s_____1_
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004ff336
push str.IEXPLORE.EXE
push str.SOFTWAREClientsStartMenuInternet
push 0x5462f8
lea eax, [ebp - 0x628]
push 0x103
push eax
call fcn.004ff336
add esp, 0x24
push str.LocalizedString
lea eax, [ebp - 0x628]
push eax
mov ebx, 0x80000002
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x218]
push eax
mov ecx, str.htmlfile_shell
call fcn.0041230e
lea eax, [ebp - 0x218]
push eax
mov ecx, str.InternetShortcut_shell
call fcn.0041230e
lea eax, [ebp - 0x218]
push eax
mov ecx, str.mhtmlfile_shell
call fcn.0041230e
lea eax, [ebp - 0x218]
push eax
mov ecx, str.xhtmlfile_shell
call fcn.0041230e
call fcn.00452c1a
cmp dword [eax], 3
jl 0x411fd2
and dword [ebp - 0x62c], 0
mov esi, str.open
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x638], str.IE.FTP
mov dword [ebp - 0x634], str.IE.HTTP
mov dword [ebp - 0x630], str.IE.HTTPS
mov edi, 0x543da0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00506540
mov eax, dword [ebp - 0x62c]
add esp, 0xc
push dword [ebp + eax*4 - 0x638]
lea eax, [ebp - 0x420]
push str.SoftwareClasses_s_shell
push 0x104
push eax
call fcn.0040c242
lea eax, [ebp - 0x10]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x411f31
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push edi
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00506540
mov eax, dword [ebp - 0x62c]
add esp, 0xc
push dword [ebp + eax*4 - 0x638]
lea eax, [ebp - 0x420]
push str.SoftwareClasses_s_shellopencommand
push 0x104
push eax
call fcn.0040c242
lea eax, [ebp - 0x218]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x411f99
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push edi
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
inc dword [ebp - 0x62c]
cmp dword [ebp - 0x62c], 3
jb 0x411ee7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret
Function at 0x411fe3
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x58569c]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
xor eax, eax
push esi
push edi
cmp ax, word [0x6c82d8]
jne 0x41200f
call fcn.00412414
mov esi, eax
jmp 0x412014
mov esi, 0x6c82d8
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.00506540
push esi
push str.__s_____1_
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.004ff336
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
mov ecx, str.http_shell
call fcn.0041230e
lea eax, [esp + 0x10]
push eax
mov ecx, str.https_shell
call fcn.0041230e
lea eax, [esp + 0x10]
push eax
mov ecx, str.ftp_shell
call fcn.0041230e
push 0x208
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00506540
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esp, 0xc
push 0x10
mov ebp, str.htmlfile
push ebp
push 1
mov ebx, 0x543da0
push ebx
push str..htm
mov edi, 0x80000000
push edi
call esi
push 0x10
push ebp
push 1
push ebx
push str..html
push edi
call esi
push 0x10
push ebp
push 1
push ebx
push str..shtm
push edi
call esi
push 0x10
push ebp
push 1
push ebx
push str..shtml
push edi
call esi
push 0x12
mov ebp, str.mhtmlfile
push ebp
push 1
push ebx
push str..mht
push edi
call esi
push 0x12
push ebp
push 1
push ebx
push str..mhtm
push edi
call esi
push 0x12
push ebp
push 1
push ebx
push str..mhtml
push edi
call esi
push 0x12
mov ebp, str.xhtmlfile
push ebp
push 1
push ebx
push str..xht
push edi
call esi
push 0x12
push ebp
push 1
push ebx
push str..xhtml
push edi
call esi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fe191
add esp, 0x20c
ret
Function at 0x41230e
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push esi
push edi
push 8
push str.open
push 1
mov esi, ecx
push 0x543da0
push esi
push 0x80000000
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], eax
call ebx
lea eax, [ebp - 0x78]
mov ecx, esi
sub eax, esi
movzx edx, word [ecx]
mov word [eax + ecx], dx
add ecx, 2
test dx, dx
jne 0x41235d
lea edi, [ebp - 0x78]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x412372
mov eax, dword [ebp - 0x7c]
push 7
pop ecx
mov esi, str.opencommand
rep movsd dword es:[edi], dword [esi]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41238e
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0x7c]
mov edi, 0x543da0
push 1
push edi
lea eax, [ebp - 0x78]
push eax
mov esi, 0x80000000
push esi
call ebx
push str.open
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push str._s_scommand
push 0x104
push eax
call fcn.004ff336
mov eax, dword [ebp - 0x7c]
add esp, 0x14
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4123db
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push 1
push edi
push eax
push esi
call ebx
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
add ebp, 0x194
leave
ret 4

Function at 0x412414
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
push esi
push edi
push 0
push 0x26
mov ebx, 0x6c82d8
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41242c
push 0x10
pop ecx
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x413739
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea esi, [ebp - 8]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0044effe
mov eax, esi
push eax
push 0x20006
push edi
mov edi, dword [0x52b010]
push 0x543da0
mov ebx, 0x80000000
push ebx
call edi
test eax, eax
jne 0x4137d4
push str..crx
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x4137d4
call fcn.0044effe
mov eax, esi
push eax
push 0x20006
xor esi, esi
push esi
push 0x543da0
push ebx
call edi
test eax, eax
jne 0x4137d4
push str.crxfile
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x4137d4
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov bl, 1
lea esi, [ebp - 8]
call fcn.0044effe
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
xor bl, bl
jmp 0x4137c5
Function at 0x415e0a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
mov ebx, dword [ebp + 0x1a8]
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 0x52b7fc
xor esi, esi
push 1
push esi
push 0x52b85c
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], esi
call dword [0x52b698]
test eax, eax
js 0x415f11
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x50]
xor eax, eax
push 0x206
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push esi
push eax
call fcn.00506540
mov eax, edi
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, si
jne 0x415e87
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.004ffe99
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x70]
push edx
push eax
call dword [ecx + 0x24]
cmp ebx, esi
je 0x415ec9
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 0xfffffffffffffffc
push edi
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x78]
push edx
push 0x52b87c
push eax
call dword [ecx]
test eax, eax
js 0x415f11
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push 2
push dword [ebp - 0x7c]
push eax
call dword [ecx + 0x18]
test eax, eax
js 0x415f11
push esi
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 1
push 5
push 2
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0x78]
cmp eax, esi
je 0x415f1e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x74]
cmp eax, esi
pop esi
pop ebx
je 0x415f2d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x198]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
call fcn.004fe191
add ebp, 0x19c
leave
ret

Function at 0x416ef5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.00452c1a
cmp dword [eax], 3
jge 0x416f09
xor al, al
leave
ret
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call fcn.00506540
mov eax, dword [ebp + 8]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x400
mov dword [ebp - 0x30], str.taskbarunpin
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
dec eax
neg eax
sbb al, al
inc al
leave
ret
Function at 0x4189a2
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xcc
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x74], eax
and dword [ebp + 0x4c], 0
push ebx
push esi
push edi
xor eax, eax
push str.360se_3.exe
lea esi, [ebp + 0x58]
mov dword [ebp + 0x50], 7
mov word [ebp + 0x3c], ax
call fcn.0040204f
lea eax, [ebp + 0x3c]
push eax
mov ecx, esi
call fcn.004178cf
pop ecx
push 1
xor edi, edi
mov bl, al
call fcn.004021a4
test bl, bl
je 0x418ae1
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x58]
call fcn.0044a559
push str.UnInst360SE.exe
lea esi, [ebp + 0x20]
call fcn.0040204f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 4]
call fcn.0044a8ff
push eax
mov ecx, esi
call fcn.0044abc8
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.0044a59f
xor ebx, ebx
inc ebx
push ebx
lea esi, [ebp - 0x18]
call fcn.004021a4
push ebx
lea esi, [ebp + 4]
call fcn.004021a4
push ebx
lea esi, [ebp + 0x20]
call fcn.004021a4
lea eax, [ebp + 0x58]
call fcn.00449a3d
test al, al
je 0x418ad6
cmp dword [ebp + 0x6c], 8
mov eax, dword [ebp + 0x58]
jae 0x418a68
lea eax, [ebp + 0x58]
push eax
mov edx, str.SE5_Uninstaller
mov ecx, 0x546fac
call fcn.0044f6dc
pop ecx
test eax, eax
je 0x418ad6
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x418a91
lea ecx, [ebp + 0x58]
call fcn.00407d63
jmp 0x418ad6
push 0x38
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00506540
mov eax, dword [ebp + 0x58]
add esp, 0xc
cmp dword [ebp + 0x6c], 8
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x48], str.runas
jae 0x418ac2
lea eax, [ebp + 0x58]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x38], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push ebx
xor edi, edi
lea esi, [ebp + 0x58]
call fcn.004021a4
push 1
xor edi, edi
lea esi, [ebp + 0x3c]
call fcn.004021a4
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
add ebp, 0x78
leave
ret
Function at 0x419e0f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x58569c]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
xor esi, esi
push edi
mov dword [esp + 0x1c], eax
mov byte [esp + 0xe], 0
cmp dword [ebx + 0x10], esi
je 0x419f59
cmp dword [ebx + 0x14], 8
jb 0x419e5e
mov eax, dword [ebx]
jmp 0x419e60
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x419f59
push 7
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x6c], eax
xor eax, eax
xor ecx, ecx
mov word [esp + 0x58], ax
lea eax, [ebx + 0x38]
cmp dword [eax + 0x14], 8
mov dword [esp + 0x30], esi
mov word [esp + 0x20], cx
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], cx
mov dword [esp + 0x68], esi
mov dword [esp + 0x14], eax
jb 0x419eac
mov eax, dword [eax]
push eax
lea esi, [esp + 0x7c]
call fcn.0040204f
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0041a128
push 1
xor edi, edi
mov byte [esp + 0x13], al
call fcn.004021a4
cmp byte [esp + 0xf], 0
je 0x419f2f
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x419ee5
lea eax, [esp + 0x58]
xor esi, esi
cmp eax, esi
je 0x419f2f
cmp dword [esp + 0x74], esi
je 0x419f2f
lea edx, [esp + 0x3c]
mov ecx, ebx
call fcn.0041a291
test al, al
je 0x419f2f
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push esi
push ebx
call fcn.004020dc
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x60]
push eax
mov eax, dword [esp + 0x1c]
call fcn.004020dc
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov byte [esp + 0xe], 1
jmp 0x419f4f
cmp dword [ebx + 0x14], 8
jb 0x419f37
mov ebx, dword [ebx]
mov esi, dword [0x52b288]
push ebx
call esi
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x14], 8
jb 0x419f4c
mov eax, dword [eax]
push eax
call esi
lea eax, [esp + 0x20]
push eax
call fcn.00419f74
mov ecx, dword [esp + 0x94]
mov al, byte [esp + 0xe]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fe191
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x64], 0
push esi
push edi
mov dword [ebp - 0xa0], ebx
je 0x41a117
add ebx, 0x54
cmp dword [ebx + 0x14], 8
jb 0x419fd6
mov eax, dword [ebx]
jmp 0x419fd8
mov eax, ebx
push eax
call dword [0x52b288]
cmp dword [ebx + 0x14], 8
jb 0x419fe9
mov eax, dword [ebx]
jmp 0x419feb
mov eax, ebx
push eax
lea esi, [ebp - 0x24]
call fcn.0040204f
push str.http:__seupdate.360safe.com_se6_upto6.cab
lea esi, [ebp - 0x98]
call fcn.0040204f
mov eax, esi
push eax
lea ecx, [ebp - 0x24]
call fcn.004067a9
pop ecx
push 1
xor edi, edi
call fcn.004021a4
push 1
lea esi, [ebp - 0x24]
call fcn.004021a4
cmp dword [ebx + 0x14], 8
jb 0x41a02d
mov eax, dword [ebx]
jmp 0x41a02f
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41a117
push 7
pop eax
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x6c], ecx
mov word [ebp - 0x7c], dx
mov dword [ebp - 0x50], ecx
mov word [ebp - 0x60], dx
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x44], ax
jb 0x41a06f
mov eax, dword [ebx]
jmp 0x41a071
mov eax, ebx
push eax
lea esi, [ebp - 0x24]
call fcn.0040204f
lea eax, [ebp - 0x7c]
push eax
mov ecx, esi
call fcn.0041a128
push 1
xor edi, edi
mov byte [ebp - 0x99], al
call fcn.004021a4
cmp byte [ebp - 0x99], 0
je 0x41a10e
mov edi, dword [ebp - 0xa0]
lea eax, [ebp - 0x7c]
lea esi, [edi + 0x1c]
push eax
mov ecx, esi
call fcn.00406636
pop ecx
lea edx, [ebp - 0x60]
mov ecx, esi
call fcn.0041a291
test al, al
je 0x41a0ff
cmp dword [edi + 0x14], 8
jb 0x41a0ca
mov eax, dword [edi]
jmp 0x41a0cc
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x41a0d4
mov esi, dword [esi]
push 3
push eax
push esi
mov esi, dword [0x52b120]
call esi
test eax, eax
je 0x41a10e
lea eax, [edi + 0x38]
cmp dword [eax + 0x14], 8
jb 0x41a0ef
mov eax, dword [eax]
cmp dword [ebx + 0x14], 8
jb 0x41a0f7
mov ebx, dword [ebx]
push 3
push eax
push ebx
call esi
jmp 0x41a10e
cmp dword [esi + 0x14], 8
jb 0x41a107
mov esi, dword [esi]
push esi
call dword [0x52b288]
lea eax, [ebp - 0x7c]
push eax
call fcn.00419f74
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret 4