joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d880
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x46c840
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x488d58]
mov edx, dword [eax + 0xc]
mov ecx, 0x488d58
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.00403300
add esp, 4
test eax, eax
jne 0x40d901
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d8fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40da2f
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esp + 0x28]
mov eax, ebp
call fcn.0040d6b0
test eax, eax
jne 0x40d928
mov dword [esp + 0x20], 0xffffffff
lea eax, [ebp - 0x10]
jmp 0x40d8e1
mov edx, dword [0x488d58]
mov eax, dword [edx + 0xc]
mov ecx, 0x488d58
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x24], 1
call fcn.00403300
mov esi, dword [esp + 0x2c]
add esp, 4
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [esp + 0x30], ebx
je 0x40d9a2
push ebx
push esi
push ebp
call fcn.0043d020
add esp, 0xc
test eax, eax
jge 0x40d9d2
lea eax, [esi - 0x10]
mov byte [esp + 0x20], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d992
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
lea eax, [ebp - 0x10]
jmp 0x40d8e1
cmp ebp, ebx
je 0x40d9bc
cmp esi, ebx
je 0x40d9bc
push esi
push 0x40da50
push ebx
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
cmp eax, ebx
jne 0x40d9d2
lea eax, [esi - 0x10]
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40d986
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x28]
call fcn.00402b70
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov byte [esp + 0x20], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x411900
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x46c7e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x1c], vtable.CResourceUnpack.0
mov edx, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [0x48a250]
push edx
mov edx, dword [ecx + 0x28]
push eax
push 0x48a250
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call edx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
cmp eax, ebx
jne 0x41197c
xor eax, eax
jmp 0x4119fd
mov eax, dword [0x488d58]
mov edx, dword [eax + 0xc]
mov ecx, 0x488d58
xor ebp, ebp
call edx
add eax, 0x10
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x34], 1
call fcn.00403300
mov esi, dword [esp + 0x48]
add esp, 4
test eax, eax
je 0x4119d3
mov eax, esi
lea edi, [esp + 0x1c]
call fcn.0040d6b0
test eax, eax
je 0x4119d3
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push esi
push eax
call edx
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x30], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4119fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
Function at 0x415690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push str.NetCheck
push str.SOFTWARE360Safe360Scan
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
call esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x46f690
push str.SOFTWARE360Safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
call esi
cmp dword [esp + 0x10], 0
pop edi
pop esi
je 0x415719
cmp dword [esp + 0xc], 0
je 0x415719
mov eax, 1
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x4157d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x288
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x284], eax
push esi
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x8a]
push ecx
mov word [esp + 0x8c], ax
call fcn.0044efc0
add esp, 0xc
mov ecx, 0x12
mov esi, str.Control_PanelDesktopWindowMetrics
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 8]
push edx
mov ecx, 8
mov esi, str.Shell_Icon_Size
lea edi, [esp + 0x1c]
lea eax, [esp + 0x84]
push eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x48]
push eax
push SysReAllocString
mov dword [esp + 0x20], 0x20a
mov dword [esp + 0x24], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4158f1
mov ecx, dword [0x46f6f8]
mov dx, word [0x46f6fc]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 6
lea eax, [esp + 0x14]
push eax
push 1
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x24]
mov word [esp + 0x20], dx
push ecx
lea edx, [esp + 0x48]
push edx
push SysReAllocString
call edi
test eax, eax
jne 0x4158f1
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push eax
push 0x1388
push 2
push eax
push 0x2a
push 0x1a
push 0xffff
call esi
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x48]
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x4158f1
push eax
push 0x1388
push 2
push eax
push 0x2a
push 0x1a
push 0xffff
call esi
push 0
push 0
push 0x1000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
xor ecx, esp
call fcn.0044efac
add esp, 0x288
ret
Function at 0x415930
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x808], eax
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0044efc0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 8]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4159a4
xor eax, eax
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0044efac
add esp, 0x80c
ret
cmp word [esp + 8], 0
je 0x41598d
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0044efac
add esp, 0x80c
ret

Function at 0x415b00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x994
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x990], eax
push ebx
mov ebx, dword [esp + 0x9a0]
push edi
mov edi, dword [esp + 0x9a0]
test edi, edi
je 0x415c2b
test ebx, ebx
je 0x415c2b
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415b40
sub eax, edx
sar eax, 1
cmp eax, 0x64
ja 0x415c2b
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415b60
sub eax, edx
sar eax, 1
cmp eax, 0x40
ja 0x415c2b
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp word [0x488820], cx
jne 0x415ba9
push 0x208
push 0x488820
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Drivers
push 0x488820
push 0x488820
call esi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044efc0
add esp, 0xc
push edi
push 0x488820
lea ecx, [esp + 0x14]
push ecx
call esi
mov ecx, 0x11
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x80c]
rep movsd dword es:[edi], dword [esi]
push 0x14a
lea edx, [esp + 0x856]
push 0
push edx
movsw word es:[edi], word [esi]
call fcn.0044efc0
push ebx
lea eax, [esp + 0x81c]
push 0xc8
push eax
call fcn.0044f60a
mov ecx, dword [esp + 0x9c4]
push ecx
lea edx, [esp + 0x828]
push edx
lea eax, [esp + 0x2c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.004367f0
add esp, 0x28
pop esi
jmp 0x415c2d
xor eax, eax
mov ecx, dword [esp + 0x998]
pop edi
pop ebx
xor ecx, esp
call fcn.0044efac
add esp, 0x994
ret 0xc
Function at 0x418120
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x834
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x830], eax
push esi
mov esi, ecx
call fcn.00417cb0
test eax, eax
je 0x4181ee
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0044efc0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.DefaultSkin
push str.Software360safe
push SysReAllocString
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4181b6
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00417e10
test eax, eax
je 0x4181b6
lea edx, [esp + 0xc]
push str.configdefaultskin
push edx
call fcn.0044fde8
add esp, 8
test eax, eax
jne 0x4181ee
push edi
mov ecx, 9
mov esi, str.config2012NewYear
lea edi, [esp + 0x810]
push 0x26
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x814]
push eax
push 1
push str.DefaultSkin
push str.Software360safe
push SysReAllocString
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
mov ecx, dword [esp + 0x834]
pop esi
xor ecx, esp
call fcn.0044efac
add esp, 0x834
ret
Function at 0x42dc50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x220], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0x14]
push esi
xor edi, edi
or eax, 0x2001f
push eax
push edi
push edx
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0xc]
mov esi, eax
cmp esi, edi
jne 0x42dcc6
xor eax, eax
cmp ecx, edi
je 0x42dcb4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov esi, eax
mov dword [esp + 0xc], ecx
cmp eax, edi
je 0x42dcd4
cmp ecx, edi
je 0x42dd72
push ecx
jmp 0x42dd6c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x42dd3c
lea esp, [esp]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.0042dc50
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0x42dd8b
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
push edx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x42dd00
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x42dd4f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebx]
push eax
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x42dd72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0044efac
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x42dd74
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044efac
mov esp, ebp
pop ebp
ret 4
Function at 0x430890
Capabilities:
Hide graphical window

Disassembly:
push ebp
push esi
push 6
mov esi, ecx
call fcn.004316d0
mov ecx, esi
call fcn.004315b0
mov ebp, eax
test ebp, ebp
je 0x43096f
push ebx
push edi
mov ecx, ebp
call fcn.00433f50
mov ecx, eax
call fcn.00415690
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4308ef
mov eax, dword [esi + 4]
push 0
push 0x3ff
push eax
call fcn.00422650
mov ecx, dword [esi + 4]
add esp, 0xc
push 0x3ff
push ecx
call ebx
push 0
push eax
call edi
mov ecx, ebp
call fcn.004342b0
test eax, eax
jne 0x43090c
mov ecx, ebp
call fcn.00434000
mov ecx, eax
call fcn.004218b0
test eax, eax
je 0x43093f
mov edx, dword [esi + 4]
push 0
push 0x3fe
push edx
call fcn.00422650
mov eax, dword [esi + 4]
add esp, 0xc
push 0x3fe
push eax
call ebx
push 0
push eax
call edi
mov ecx, dword [esi + 4]
push 0x416
push ecx
call ebx
push 5
push eax
call edi
mov ecx, ebp
call fcn.00434000
mov ecx, eax
call fcn.00421800
cmp dword [eax], 0
pop edi
pop ebx
jne 0x430966
mov ecx, ebp
call fcn.00434000
mov ecx, eax
call fcn.00421820
test eax, eax
je 0x43096f
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov ecx, esi
pop esi
pop ebp
jmp fcn.00431b70
Function at 0x4327d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x46a848
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004316a0
mov ecx, ebx
mov edi, eax
call fcn.004315b0
mov esi, eax
test edi, edi
je 0x43287b
test esi, esi
je 0x43287b
mov ecx, esi
call fcn.00434000
mov ecx, esi
call fcn.00433fe0
mov esi, eax
test esi, esi
je 0x43287b
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push esi
call ecx
test eax, eax
jne 0x43287b
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
push esi
call eax
test eax, eax
jne 0x43287b
mov ecx, edi
call fcn.00415930
test eax, eax
jne 0x43287b
mov ecx, edi
call fcn.004159d0
test eax, eax
je 0x43287b
mov ecx, dword [0x485064]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x10]
push edx
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.00419c40
test eax, eax
jne 0x432890
lea ecx, [esp + 0x10]
call fcn.00416500
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432872
push 5
mov ecx, ebx
call fcn.004315e0
lea ecx, [esp + 0x10]
call fcn.00416500
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x432e70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46a8d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00431860
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
or eax, 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0xc], 4
mov dword [esi + 0x4c], vtable.IExtractCallback.0
lea ecx, [esi + 0x58]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.CSetupProgressDialog.2.0
mov dword [esi + 0x10], vtable.CSetupProgressDialog.1.0
mov dword [esi + 0x4c], vtable.CSetupProgressDialog.0
call fcn.004274a0
mov eax, dword [0x485064]
mov dword [esi + 0x338], eax
mov ecx, dword [0x485064]
lea edx, [esi + 0x344]
mov dword [esi + 0x33c], ecx
push edx
mov dword [esi + 0x340], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x35c], ebx
mov dword [esi + 0x360], 0x50
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x434100
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0044efc0
add esp, 0xc
xor eax, eax
lea edx, [esp + 4]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
mov ecx, 5
mov word [esp + 0x60], cx
mov ecx, dword [esp + 0x78]
push 0
push ecx
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x43418a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x60]
mov dword [edx], eax
mov eax, esi
pop esi
add esp, 0x54
ret
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 4]
mov eax, esi
mov dword [ecx], edx
pop esi
add esp, 0x54
ret
Function at 0x4385e0
Capabilities:
Check if file exists

Disassembly:
call fcn.004048a0
test eax, eax
je 0x4385ef
mov eax, 1
ret
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x438632
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438632
push esi
call fcn.0044ee90
add esp, 4
test eax, eax
je 0x438632
push esi
call fcn.00404920
add esp, 4
test eax, eax
jne 0x438632
push 1
call fcn.0044eb40
push eax
push esi
call fcn.0044ed50
add esp, 0xc
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x438640
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.004385e0
add esp, 4
test eax, eax
jne 0x438654
pop esi
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push esi
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret

Function at 0x438a50
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x46afab
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x814]
mov dword fs:[0], eax
mov eax, dword [0x485064]
xor edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x81c], edi
call fcn.004315b0
cmp eax, edi
je 0x438b48
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.00434d10
push 0x800
lea edx, [esp + 0x14]
push edi
push edx
call fcn.0044efc0
mov eax, dword [esp + 0x18]
add esp, 0xc
push str.360ver.dll
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [0x48a244], edi
jne 0x438af0
lea edx, [esp + 0x10]
push edx
call fcn.00404850
jmp 0x438b20
call fcn.004048a0
test eax, eax
jne 0x438b15
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438b15
lea ecx, [esp + 0x10]
push ecx
call fcn.00404920
add esp, 4
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x438b48
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x438b41
call eax
test eax, eax
je 0x438b41
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x485060]
je 0x438b75
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x438b75
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0044fbd4
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x814]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0044efac
add esp, 0x814
ret
Function at 0x439c70
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46b10b
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x82c]
push 0x800
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0044efc0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x439d87
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.0041a210
lea ecx, [esp + 0xc]
mov dword [esp + 0x824], 0
call fcn.0041e380
push 0x22
lea ecx, [esp + 0x10]
call fcn.0041e450
lea ecx, [esp + 0xc]
call fcn.0041e3e0
push 0x22
lea ecx, [esp + 0x10]
call fcn.0041e4b0
mov esi, dword [esp + 0xc]
push 0x473174
push esi
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439d8b
lea ecx, [esi - 0xc]
cmp ecx, dword [0x485060]
je 0x439d87
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x439d87
push esi
call fcn.0044fbd4
add esp, 4
xor eax, eax
jmp 0x439dbe
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.004182b0
lea eax, [esi - 0xc]
cmp eax, dword [0x485060]
je 0x439db9
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x439db9
push esi
call fcn.0044fbd4
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044efac
add esp, 0x81c
ret 4