joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f110
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x670], eax
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x43f25b
test edi, edi
je 0x43f25b
test esi, esi
je 0x43f25b
push 0x208
lea eax, [ebp - 0x41c]
push ebx
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x41c]
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x43f193
push 0x35d
push str.base::RivalMonitor::IsFileInDir
push str.__s__d___PathCombine_error.
call fcn.0041f720
add esp, 0xc
jmp 0x43f25b
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43f25b
test byte [ebp - 0x66c], 0x10
je 0x43f237
cmp word [ebp - 0x640], 0x2e
jne 0x43f1e0
mov ax, word [ebp - 0x63e]
test ax, ax
je 0x43f237
cmp ax, 0x2e
jne 0x43f1e0
cmp word [ebp - 0x63c], bx
je 0x43f237
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
push edi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x43f237
push dword [ebp - 0x670]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43f237
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43f24f
lea eax, [ebp - 0x66c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43f1b2
jmp 0x43f254
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43f270
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4407b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
movzx eax, word [esi + 0x14]
add eax, 0x18
add eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [eax + 0xc]
lea ecx, [eax + 0xc]
jae 0x4407dc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
movzx ebx, word [esi + 6]
xor eax, eax
test ebx, ebx
je 0x44082a
lea edx, [eax + 1]
cmp edx, ebx
jne 0x4407f3
mov esi, dword [esi + 0x50]
jmp 0x4407f6
mov esi, dword [ecx + 0x28]
mov edi, dword [ecx]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
cmp edi, dword [ecx]
jb 0x440806
cmp edi, esi
jb 0x440814
mov eax, edx
add ecx, 0x28
cmp eax, ebx
jae 0x44082a
mov esi, dword [ebp - 4]
jmp 0x4407e7
mov ecx, dword [ebp - 8]
lea eax, [eax + eax*4]
pop ebx
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, dword [ebp - 0xc]
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440d00
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
mov eax, edx
push 1
push SysReAllocString
push ecx
mov dword [eax], 0
mov dword [ebp - 0xc], eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x440d8b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
test eax, eax
je 0x440dd1
cmp eax, 0xffffffff
je 0x440dd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x440dd1
mov eax, dword [esi]
add eax, 8
push 0x555d5a
push eax
call fcn.004be2af
mov ebx, dword [ebp - 0xc]
mov ecx, eax
add esp, 8
mov dword [ebx], ecx
test ecx, ecx
jne 0x440d9e
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, 8
push eax
push 0
push ecx
call fcn.004c05c0
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push 0
push eax
push dword [esi]
push dword [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 8]
xor ebx, ebx
cmp ecx, dword [esi]
sete bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x440df0
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0xc], esi
test ebx, ebx
je 0x440eec
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x440eec
test esi, esi
je 0x440eec
mov eax, dword [0x54ccd8]
push edi
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str._s.write_cache
push eax
call fcn.00441af0
mov esi, dword [ebp - 8]
add esp, 0xc
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x440eb7
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
push ecx
push edi
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 8], edi
sete al
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x440eb7
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi - 0xc]
cmp ecx, 0x54ccdc
je 0x440ed9
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x440ed9
push esi
call fcn.004bdb09
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x443530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push edi
call sym.360huabaosetup.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetInstance_struct_HINSTANCE____
add esp, 4
push 0x50b340
push 0x99
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x443595
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push esi
test ebx, ebx
jne 0x443576
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x443594
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call sym.360huabaosetup.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceZip_void___unsigned_int__wchar_t_const__
add esp, 0xc
pop ebx
pop edi
pop esi
ret
Function at 0x448d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.004104e0
cmp eax, 5
je 0x448da1
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
push eax
push str.install_model
push str.Software360360huabao
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp byte [esi + 0x80d], 0
je 0x448db2
cmp dword [ebp - 8], 1
jne 0x448dfe
cmp dword [esi + 0x704], 8
lea edx, [esi + 0x6f0]
jb 0x448d87
mov edx, dword [edx]
cmp dword [esi + 0x71c], 8
lea ecx, [esi + 0x708]
jb 0x448d98
mov ecx, dword [ecx]
call fcn.00410930
test eax, eax
js 0x448dfe
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00448e10
test al, al
je 0x448dfe
cmp dword [ebp - 8], 1
jne 0x448dfe
mov eax, dword [esi + 0x720]
cmp eax, 2
je 0x448dd3
cmp eax, 9
jne 0x448de4
push 0x2a
push str.remote_version_is_lower_than_local_version
mov ecx, 0x553068
call fcn.00403e30
push 1
mov ecx, esi
call fcn.0044e0d0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x4504d0
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ebp + 0x1c], 0
push ebx
push edi
jne 0x45068e
mov eax, dword [ebp + 0xc]
cmp eax, 0x113
jne 0x45061a
mov eax, dword [ebp + 0x10]
lea ebx, [ecx - 4]
cmp eax, 0x2711
jne 0x450589
push eax
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x289
push 0x50e8c8
push str.__s__d___UnInstallFrame::OnTimer_is_close
call fcn.0041f720
add esp, 0xc
cmp byte [0x558a52], 0
jne 0x45066c
mov ecx, dword [ebx + 0x50]
test ecx, ecx
je 0x450556
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
je 0x450547
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov dword [ebx + 0x50], 0
call fcn.00450940
cmp byte [0x558a51], 0
je 0x45056b
mov ecx, ebx
call fcn.004535f0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x67
jne 0x45066c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 2
movzx edi, ax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
or ax, di
mov ecx, 0xf
bt ax, cx
jb 0x4505d4
push 0x67
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.USER32.dll_GetMessagePos]
mov ecx, dword [ebx + 0x50]
movsx edx, ax
sub edx, dword [ebx + 0x48]
shr eax, 0x10
cwde
sub eax, dword [ebx + 0x4c]
test ecx, ecx
je 0x45066c
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov eax, dword [ecx]
push edx
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x10
jne 0x450652
mov ecx, dword [ecx + 0x4c]
test ecx, ecx
je 0x45066c
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
add ecx, 0xfffffffc
cmp eax, 0x4a
jne 0x450682
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0x451
jne 0x45066c
push 0xa
call fcn.00452820
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x5f4
jne 0x45068e
push dword [ebp + 0x10]
jmp 0x450667
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4535f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x40], 0
push edi
je 0x453840
lea edi, [ecx + 0x30]
push 0x50e8a8
mov edx, edi
lea ecx, [ebp - 0x258]
call fcn.004048c0
add esp, 4
lea ecx, [ebp - 0x228]
mov edx, edi
push str.user_data
call fcn.004048c0
add esp, 4
lea eax, [ebp - 0x258]
cmp dword [ebp - 0x244], 8
cmovae eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45367d
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4537ab
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [0x558a30], 0
jne 0x4536c3
lea ecx, [ebp - 0x210]
call fcn.00440840
test eax, eax
je 0x4537ab
push edi
mov edx, str.__clean
lea ecx, [ebp - 0x240]
call fcn.00404760
add esp, 4
mov dword [ebp - 0x294], 0x3c
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x210]
mov dword [ebp - 0x284], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x240]
movlpd qword [ebp - 0x270], xmm0
cmovae eax, dword [ebp - 0x240]
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x294]
push eax
movlpd qword [ebp - 0x268], xmm0
movlpd qword [ebp - 0x260], xmm0
mov dword [ebp - 0x290], 0x40
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x22c]
cmp edx, 8
jb 0x4537ab
mov ecx, dword [ebp - 0x240]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4537a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45384f
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x214]
cmp edx, 8
jb 0x4537e7
mov ecx, dword [ebp - 0x228]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4537dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x453854
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [ebp - 0x244]
xor eax, eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
cmp edx, 8
jb 0x453840
mov ecx, dword [ebp - 0x258]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x453836
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x453854
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
int3
Function at 0x454070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x71c], 8
lea eax, [esi + 0x708]
jb 0x454094
mov eax, dword [eax]
push str.__force
push eax
call fcn.004bfc5b
add esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.install_model
push str.SOFTWARE360360huabao
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 8], 2
je 0x454106
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x14
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.__uninstall___byuser
mov word [ecx], ax
call fcn.00403e30
push 0
jmp 0x45413d
push 0x3a
push str.UnInstallUtil::BeginUninstall
push str.__s__d___Regvalue_is_2__call_original_uninstall_wnd
call fcn.0041f720
sub esp, 0xc
xor eax, eax
mov ecx, esp
push 0x14
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.__uninstall___byuser
mov word [ecx], ax
call fcn.00403e30
push 1
mov ecx, esi
call fcn.00454160
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 4
Function at 0x454160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push edi
dec esi
mov byte [0x558a53], 1
neg esi
mov edi, ecx
push 0x7c
sbb esi, esi
push 0
push eax
add esi, 2
call fcn.004c05c0
sub esp, 0xc
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00402f60
push esi
lea ecx, [ebp - 0xa4]
call fcn.00450a10
sub esp, 0x18
lea eax, [ebp - 0xa4]
mov ecx, esp
mov dword [0x5592ac], eax
xor eax, eax
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.chrome.dll
mov word [ecx], ax
call fcn.00403e30
lea ecx, [ebp - 0x20]
call fcn.00412460
add esp, 0x18
lea eax, [ebp - 0x20]
cmp dword [ebp - 0xc], 8
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x454278
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x20]
cmp ecx, 8
cmovae eax, edx
cmp dword [0x558a30], 0
jne 0x45422c
mov ecx, eax
call fcn.00440840
test eax, eax
je 0x454278
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
cmp ecx, 8
lea eax, [ebp - 0x20]
push 8
cmovae eax, edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x454278
push str.ChromeShell
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x454266
push eax
push eax
push 0x10
push dword [ebp - 0x9c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x45429f
push 0x558a80
push dword [0x558a38]
call eax
add esp, 8
jmp 0x45429f
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
push 0x5b
push str.UnInstallUtil::ShowUninstallFrameWnd
push str.__s__d___Chrome_dll_check_failed__path_is__s__call_original_uninstall_wnd
call fcn.0041f720
add esp, 0x10
mov ecx, edi
call fcn.00454350
mov edx, dword [ebp - 0xc]
cmp edx, 8
jb 0x4542d5
mov ecx, dword [ebp - 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4542cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45433c
push edx
push ecx
call fcn.004bdd39
add esp, 8
xor eax, eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
call fcn.00450c70
mov edx, dword [ebp + 0x20]
cmp edx, 8
jb 0x45432a
mov ecx, dword [ebp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454320
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45433c
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004c8da3
int3
Function at 0x454350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov byte [0x558a53], 0
cmp dword [edi + 0x71c], 8
lea eax, [edi + 0x708]
mov dword [ebp - 8], 0
jb 0x454382
mov eax, dword [eax]
push str.__byuser
push eax
call fcn.004bfc5b
add esp, 8
test eax, eax
je 0x4543f6
push 0
push 0xb8
push 0x190
push 0
push 0
push 0
push 0x96c80000
push 0x5010a0
push 0
mov ecx, edi
call sym.360huabaosetup.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____
mov ecx, edi
call sym.360huabaosetup.exe_public:_void___thiscall_DuiLib::CWindowWnd::CenterWindow_void_
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call sym.360huabaosetup.exe_public:_unsigned_int___thiscall_DuiLib::CWindowWnd::ShowModal_void_
cmp eax, 1
jne 0x45441a
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x4564a0
push 0
push 0
call fcn.004ce8e1
add esp, 0x18
push 0x2bf20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x4576a0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x50f724
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004d03e0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x45dfa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x54c384]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, ecx
lea ecx, [esp + 0x24]
call fcn.00413d80
sub esp, 0x18
lea eax, [esi + 0xc0]
mov ecx, esp
push eax
call fcn.004032f0
lea ecx, [esp + 0x24]
call fcn.00402070
add esp, 0x18
lea edx, [esp + 0xc]
cmp dword [esp + 0x20], 8
lea ecx, [esp + 0x24]
cmovae edx, dword [esp + 0xc]
cmp dword [esp + 0x38], 8
cmovae ecx, dword [esp + 0x24]
call fcn.00410930
test eax, eax
jns 0x45e045
push 0x2c1
push str.UpgradeMgr::DownloadRenderEngineDll
push str.__s__d___DownloadRenderEngineDll_async_start
call fcn.0041f720
add esp, 0xc
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x45eb70
push 0
push 0
call fcn.004ce8e1
add esp, 0x18
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x20]
cmp edx, 8
jb 0x45e07d
mov ecx, dword [esp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45e073
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45e0dc
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov edx, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
cmp edx, 8
jb 0x45e0cc
mov ecx, dword [esp + 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45e0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45e0dc
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov ecx, dword [esp + 0x3c]
pop esi
xor ecx, esp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
int3