joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b6f3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b725
xor eax, eax
jmp 0x40b745
mov edx, dword [esi + 8]
mov ecx, dword [esi + 4]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
call fcn.0040b748
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x40b748
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0045fdc0
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xfa4]
push edi
mov edi, edx
mov dword [ebp - 0x7c], eax
test ecx, ecx
je 0x40b83e
test edi, edi
jle 0x40b83e
mov eax, edi
cdq
and edx, 0xfff
add eax, edx
mov esi, eax
sar esi, 0xc
and edi, 0x80000fff
jns 0x40b7ae
dec edi
or edi, 0xfffff000
inc edi
and dword [ebp - 0x70], 0
and dword [ebp - 0x78], 0
mov dword [ebp - 0x74], ecx
test esi, esi
jle 0x40b801
mov ebx, 0x1000
push ebx
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0043e250
add esp, 0xc
push 0
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b83e
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40b7f6
mov ecx, dword [ebp - 0x70]
add dword [eax], ecx
add dword [ebp - 0x74], ebx
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], esi
jl 0x40b7c2
test edi, edi
jle 0x40b839
push edi
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0043e250
add esp, 0xc
push 0
lea eax, [ebp - 0x70]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b83e
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40b839
mov ecx, dword [ebp - 0x70]
add dword [eax], ecx
xor eax, eax
inc eax
jmp 0x40b840
xor eax, eax
mov ecx, dword [ebp + 0xf94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b155
add ebp, 0xf98
leave
ret
Function at 0x40b871
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x46aff4
call fcn.00443747
mov edi, 0x485f6c
mov ecx, edi
lea esi, [ebp - 0x10]
call fcn.00402b4a
and dword [ebp - 4], 0
mov ebx, esi
call fcn.0040236e
test eax, eax
jne 0x40b8b0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004031f6
xor eax, eax
call fcn.0044381f
ret 0xc
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp + 8]
mov ecx, ebx
call fcn.0040b6f3
test eax, eax
jne 0x40b8cd
lea eax, [ebx - 0x10]
jmp 0x40b8a1
mov ecx, edi
lea esi, [ebp + 8]
call fcn.00402b4a
mov ebx, esi
mov byte [ebp - 4], 1
call fcn.0040236e
mov esi, dword [ebp + 8]
push esi
xor edi, edi
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [ebp + 0x10], edi
je 0x40b913
push edi
mov edi, dword [ebp - 0x10]
push esi
push edi
call fcn.004019f9
add esp, 0xc
test eax, eax
jge 0x40b943
lea eax, [esi - 0x10]
call fcn.004031f6
lea eax, [edi - 0x10]
jmp 0x40b8a1
cmp dword [ebp - 0x10], edi
je 0x40b923
push esi
push dword [ebp - 0x10]
call fcn.0040bb19
jmp 0x40b925
xor eax, eax
cmp eax, edi
jne 0x40b943
lea eax, [esi - 0x10]
call fcn.004031f6
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, edi
jmp 0x40b8a8
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 8]
call fcn.00402b81
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
inc edi
jmp 0x40b929

Function at 0x40b95c
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x46b88c
call fcn.00443747
mov edi, 0x485f6c
mov ecx, edi
lea esi, [ebp - 0x10]
call fcn.00402b4a
and dword [ebp - 4], 0
mov ebx, esi
call fcn.0040236e
test eax, eax
jne 0x40b99b
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004031f6
xor eax, eax
call fcn.0044381f
ret 8
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp + 8]
mov ecx, ebx
call fcn.0040b6f3
test eax, eax
jne 0x40b9b8
lea eax, [ebx - 0x10]
jmp 0x40b98c
mov ecx, edi
lea esi, [ebp + 8]
call fcn.00402b4a
mov ebx, esi
mov byte [ebp - 4], 1
call fcn.0040236e
mov esi, dword [ebp + 8]
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.00402ad3
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 2
call fcn.0040b2b8
mov edi, dword [ebp - 0x10]
push 0x488568
push esi
push edi
call fcn.004019f9
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 0xc]
jge 0x40ba2f
add eax, 0xfffffff0
call fcn.004031f6
lea eax, [esi - 0x10]
call fcn.004031f6
lea eax, [edi - 0x10]
call fcn.004031f6
mov eax, ebx
jmp 0x40b993
add eax, 0xfffffff0
call fcn.004031f6
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
jmp 0x40ba18
Function at 0x40bde6
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x7a0]
sub esp, 0x820
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0x79c], eax
mov eax, dword [ebp + 0x7a8]
push ebx
push edi
mov edi, ecx
push 1
push edi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edi
call dword [sym.imp.GDI32.dll_SetBkMode]
xor eax, eax
cmp dword [esi + 0x28], eax
jne 0x40be31
push eax
push eax
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x28], eax
push dword [esi + 0x28]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call ebx
push dword [esi + 0x24]
mov dword [ebp - 0x70], eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xfffffffffffffff0
push dword [esi + 4]
xor edi, edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
je 0x40be5e
inc edi
jmp 0x40be65
test al, 2
je 0x40be65
push 2
pop edi
lea eax, [ebp - 0x80]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push eax
call fcn.0043e1d0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x64]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
or edi, 0x20
push edi
lea eax, [ebp - 0x80]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x70]
push dword [ebp - 0x68]
call ebx
push dword [ebp - 0x6c]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp + 0x79c]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop ebx
call fcn.0043b155
add ebp, 0x7a0
leave
ret 4
Function at 0x40c41c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push edi
lea eax, [ebp - 0x820]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
push 0x7fe
mov word [ebp - 0x80c], ax
xor edi, edi
lea eax, [ebp - 0x80a]
push edi
push eax
call fcn.0043e1d0
add esp, 0xc
push dword [esi + 0x64]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x400
lea eax, [ebp - 0x80c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x40c512
push 1
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBkMode]
push edi
push edi
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp + 8]
call ebx
push 0xfffffffffffffff0
push dword [esi + 4]
mov dword [ebp - 0x810], eax
inc edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x300
je 0x40c4cc
xor edi, edi
inc edi
jmp 0x40c4e1
test eax, 0x100
je 0x40c4d7
xor edi, edi
jmp 0x40c4e1
test eax, 0x200
je 0x40c4e1
push 2
pop edi
mov eax, dword [esi + 0x74]
sub dword [ebp - 0x81c], eax
or edi, 0x24
push edi
lea eax, [ebp - 0x820]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x810]
push dword [ebp + 8]
call ebx
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043b155
leave
ret 4
Function at 0x40dc76
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0xb0]
test eax, eax
jne 0x40dcb2
mov eax, dword [esi + 0x84]
jmp 0x40dcbd
cmp eax, 1
jne 0x40dccc
mov eax, dword [esi + 0x88]
cmp eax, 0xffffffff
jne 0x40dccf
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x40dccf
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [esi + 0x24]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
call ebx
push dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jle 0x40dd52
lea eax, [edi + edi + 2]
call fcn.0044da50
mov dword [ebp - 0x10], esp
inc edi
push edi
push dword [ebp - 0x10]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40dd52
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor ecx, ecx
test al, 1
je 0x40dd2b
inc ecx
jmp 0x40dd32
test al, 2
je 0x40dd32
push 2
pop ecx
test al, 0xb
je 0x40dd39
push 0x24
pop ecx
or ecx, 0x210
push ecx
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0xc]
push dword [ebp + 8]
call ebx
lea esp, [ebp - 0x2c]
pop edi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043b155
leave
ret 4
Function at 0x40f781
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00410151
lea edi, [esi + 0x80]
mov eax, dword [edi]
test eax, eax
je 0x40f7aa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
lea edi, [esi + 0x90]
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x18]
call fcn.00410b3c
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x18]
call fcn.00410b3c
mov eax, dword [esp + 0x10]
xor ebx, ebx
cmp eax, ebx
je 0x40f7e8
cmp eax, dword [esp + 0x18]
je 0x40f7ed
call fcn.00440b75
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jae 0x40f80f
lea esi, [esp + 0x10]
call fcn.00410898
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00410b5c
jmp 0x40f7cc
mov eax, edi
call fcn.0041068c
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
cmp eax, ebx
je 0x40f844
push dword [esi + 0x74]
push eax
call edi
push dword [esi + 0x60]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esi + 0x70]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x60], ebx
mov dword [esi + 0x70], ebx
mov eax, dword [esi + 0x64]
cmp eax, ebx
je 0x40f869
push dword [esi + 0x6c]
push eax
call edi
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esi + 0x68]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.USER32.dll_SetRect]
pop edi
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], 0xffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f8b1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [esi + 0x5c], edi
je 0x40f8ed
mov ecx, esi
call fcn.00410361
test eax, eax
je 0x40f8f2
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x40fd08
push edi
push edi
call fcn.0043eaf5
add esp, 0x18
mov dword [esi + 0x78], eax
cmp eax, edi
je 0x40f8ed
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
leave
ret
mov eax, dword [esi + 0x80]
cmp eax, edi
je 0x40f8ed
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x80]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x80]
push edi
mov ecx, dword [eax]
neg edx
push edx
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push dword [esi + 0x38]
push dword [esi + 0x34]
push edi
push edi
push dword [esi + 0x60]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x40f8ed
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
inc eax
jmp 0x40f8ef

Function at 0x40fa02
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x475314
push 0xeb
push dword [0x485f90]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40fab6
push esi
push dword [0x485f90]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40fab6
push esi
push dword [0x485f90]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40faaf
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40faa8
cmp dword [ebp - 4], 0
je 0x40faa8
push edi
push eax
push dword [ebp - 4]
call fcn.0043e250
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push edi
push esi
call fcn.0040f471
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
jmp 0x40fab8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4119cf
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46b490
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x483260]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360DrvMgr
push ebp
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, 0x485f6c
lea esi, [esp + 0x14]
call fcn.00402b4a
and dword [esp + 0x28], 0
push 0x4755f0
mov eax, esi
push 0x475100
push eax
call fcn.00402e53
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx - 0xc]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esp, 0xc
add eax, eax
push eax
push ebx
push 1
push str.DisplayName
push ebp
push edi
call esi
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.DisplayIcon
push ebp
push edi
call esi
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x30]
add ecx, 0x20
push 0x474fcc
push eax
mov dword [esp + 0x24], ecx
call fcn.0040bc02
lea ecx, [esp + 0x20]
push str.drv_uninst.exe
push ecx
mov ecx, eax
mov byte [esp + 0x38], 1
call fcn.0040bc02
mov eax, dword [esp + 0x40]
add esp, 0x10
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.UninstallString
push ebp
push edi
call esi
push 0x488190
call fcn.0043eca9
pop ecx
add eax, eax
push eax
push 0x488190
push 1
push str.DisplayVersion
push ebp
push edi
call esi
push str.http:__www.360.cn_qudongdashi_
call fcn.0043eca9
pop ecx
add eax, eax
push eax
push str.http:__www.360.cn_qudongdashi_
push 1
push str.URLInfoAbout
push ebp
push edi
call esi
push 0x4765d8
call fcn.0043eca9
pop ecx
add eax, eax
push eax
push 0x4765d8
push 1
push str.Publisher
push ebp
push edi
call esi
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.InstallLocation
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004031f6
lea eax, [ebx - 0x10]
call fcn.004031f6
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x411b56
Capabilities:
Persist via app paths registry key
Set registry value

Disassembly:
push 0xc
mov eax, 0x46af72
call fcn.00443747
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax - 0xc]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add ecx, ecx
push ecx
push eax
push 1
mov ebx, 0x474f2c
push ebx
push str.Software360DrvMgrInstallPath
push SysReAllocString
call edi
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push ebx
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360DrvMgr.exe
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov eax, dword [esi + 0x20]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.Path
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, dword [esi + 0x20]
sub esi, 0x10
mov eax, esi
call fcn.00402cca
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea esi, [ebp - 0x14]
call fcn.0040bbe9
cmp eax, 0xffffffff
je 0x411c0e
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
push ecx
xor ecx, ecx
call fcn.00406916
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.PathSub
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea eax, [esi - 0x10]
call fcn.004031f6
mov esi, 0x4755f0
push esi
call fcn.0043eca9
pop ecx
add eax, eax
push eax
push esi
push 1
push str.product
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, 0x485f6c
lea esi, [ebp - 0x10]
call fcn.00402b4a
push ebx
push str.MACHINE
mov eax, esi
push 0x475124
push eax
mov byte [ebp - 4], 1
call fcn.00402e53
mov eax, dword [ebp - 0x10]
add esp, 0x10
push dword [eax - 0xc]
call fcn.0040315e
push eax
call fcn.004026bc
mov eax, dword [ebp - 0x10]
pop ecx
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004031f6
call fcn.0044381f
ret

Function at 0x411c82
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push 0x214
mov eax, 0x46af3a
call fcn.004437b0
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
xor ebx, ebx
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.0043e1d0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push ebx
push 0x17
lea eax, [ebp - 0x21c]
push eax
push ebx
call edi
mov ecx, 0x485f6c
lea esi, [ebp - 0x220]
call fcn.00402b4a
mov dword [ebp - 4], ebx
mov ebx, 0x4755f0
push ebx
lea eax, [ebp - 0x21c]
push eax
mov eax, esi
push 0x475124
push eax
call fcn.00402e53
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
push dword [ebp - 0x220]
call esi
test eax, eax
je 0x411d22
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x411d22
push dword [ebp - 0x220]
call fcn.0041684f
pop ecx
push 0
push 0x10
lea eax, [ebp - 0x21c]
push eax
push 0
call edi
push ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push str._s_s.lnk
push eax
call fcn.00402e53
mov edi, dword [ebp - 0x220]
add esp, 0x10
push edi
call esi
cmp eax, 1
jne 0x411d62
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [edi - 0x10]
call fcn.004031f6
call fcn.00443833
ret
Function at 0x411d70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x483260]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x46b458
call fcn.00443747
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x18], eax
xor eax, eax
push 0x206
mov word [ebp], ax
xor edi, edi
lea eax, [ebp + 2]
push edi
push eax
call fcn.0043e1d0
add esp, 0xc
push edi
push 0x17
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x485f6c
lea esi, [ebp - 0x10]
call fcn.00402b4a
push 0x4755f0
mov dword [ebp - 4], edi
mov edi, 0x4765d8
push edi
lea eax, [ebp]
push eax
mov ebx, 0x476734
mov eax, esi
push ebx
push eax
call fcn.00402e53
mov eax, dword [ebp - 0x10]
add esp, 0x14
push dword [eax - 0xc]
call fcn.0040315e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x411e21
mov esi, dword [ebp - 0x10]
push esi
call fcn.00416706
pop ecx
test eax, eax
jne 0x411e21
lea eax, [esi - 0x10]
jmp 0x411eee
push 0x476748
push edi
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00402e53
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push 0x474fcc
add ecx, 0x20
push eax
call fcn.0040bc02
lea ecx, [ebp - 0x14]
push str.drv_uninst.exe
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040bc02
add esp, 0x24
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004031f6
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
call fcn.00418d1b
push 0x476774
push 0x4765d8
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00402e53
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx + 0x1c]
add esp, 0x14
call fcn.00418d1b
xor eax, eax
cmp dword [0x484d74], eax
je 0x411ee0
push eax
push 0x19
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4755f0
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push str._s_s.lnk
push eax
call fcn.00402e53
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx + 0x1c]
add esp, 0x10
call fcn.00418d1b
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004031f6
lea eax, [edi - 0x10]
call fcn.004031f6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0043b155
add ebp, 0x20c
leave
ret 4