joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x50cafc
lea eax, [ebp - 0x4c]
push eax
call fcn.00493b60
mov ecx, eax
call fcn.00493be0
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004185a0
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.004335b0
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
call fcn.0040ee70
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x499219
mov edx, dword [ebp + 8]
push edx
call fcn.004ebfed
add esp, 4
cmp eax, 0x3b6
ja 0x499219
mov dword [ebp - 0x44], 0
push 0x38
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x1440
mov dword [ebp - 0x38], str.open
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], 5
lea edx, [ebp - 0x44]
push edx
call fcn.00499c80
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x499219
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x49928b
lea ecx, [ebp - 0x48]
push ecx
call fcn.00499710
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49925b
lea edx, [ebp - 0x50]
push edx
call fcn.00499970
add esp, 4
push eax
lea ecx, [ebp - 0x48]
call fcn.00418390
lea ecx, [ebp - 0x50]
call fcn.004335b0
lea ecx, [ebp - 0x48]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x499283
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.0044ea20
push eax
call fcn.004992b0
add esp, 8
lea ecx, [ebp - 0x48]
call fcn.004335b0
mov dword [ebp - 0x54], 1
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x54]
mov esp, ebp
pop ebp
ret

Function at 0x499bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x499bc9
xor ecx, ecx
jne 0x499bc9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x499c10
mov eax, dword [ebp - 0xc]
jmp 0x499c6d
cmp dword [ebp - 4], 1
je 0x499c23
cmp dword [ebp - 4], 2
je 0x499c23
mov eax, 0xd
jmp 0x499c6d
cmp dword [ebp + 0xc], 0
je 0x499c61
cmp dword [ebp - 8], 0
je 0x499c59
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x499c50
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x499c57
mov eax, 0xd
jmp 0x499c6d
jmp 0x499c61
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x499ca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x499cc2
xor eax, eax
jmp 0x499d02
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0049a200
add esp, 8
test eax, eax
je 0x499d00
push 0x10
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00499d10
add esp, 0xc
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00418390
lea ecx, [ebp - 0x18]
call fcn.004335b0
mov eax, 1
jmp 0x499d02
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x49ad80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
je 0x49ada1
cmp dword [ebp + 0xc], 0
je 0x49ada1
cmp dword [ebp + 0x14], 0
je 0x49ada1
cmp dword [ebp + 0x10], 0
jne 0x49ada3
jmp 0x49ae07
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f510
lea ecx, [ebp - 0x10]
call fcn.0047ef80
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shl edx, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.0044ea20
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
call fcn.004335b0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49ae10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0xc], 0
je 0x49ae2b
cmp dword [ebp + 0x10], 0
je 0x49ae2b
cmp dword [ebp + 0x14], 0
jne 0x49ae40
push 0x52022c
mov ecx, dword [ebp + 8]
call fcn.0040f510
mov eax, dword [ebp + 8]
jmp 0x49af41
push 0x52022c
lea ecx, [ebp - 0x14]
call fcn.0040f510
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x10], 0
jne 0x49ae99
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov eax, dword [ebp + 8]
jmp 0x49af41
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 1
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e95f1
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49af2a
mov ecx, dword [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f550
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004ec873
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x14]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49b320
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00493b60
mov ecx, eax
call fcn.00493be0
push str.Config_newui_themesdefault360funpre_funpreConfig.xml
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.004185a0
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49b399
lea ecx, [ebp - 0x220]
call fcn.004335b0
lea ecx, [ebp - 0x21c]
call fcn.004335b0
jmp 0x49b4f6
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x220]
call fcn.0044ea20
push eax
call fcn.00421000
add esp, 0xc
push str.prexmlversion
push str.Software360Safe360Preview
push SysReAllocString
lea eax, [ebp - 8]
push eax
call fcn.0049cae0
add esp, 0x10
lea ecx, [ebp - 8]
call fcn.00418600
movzx ecx, al
test ecx, ecx
je 0x49b45d
call fcn.0049b510
mov dword [ebp - 4], eax
lea edx, [ebp - 0x218]
push edx
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push str.prexmlversion
push str.Software360Safe360Preview
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 0x220]
call fcn.004335b0
lea ecx, [ebp - 0x21c]
call fcn.004335b0
jmp 0x49b4f6
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0043f9a0
add esp, 8
test eax, eax
jg 0x49b499
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 0x220]
call fcn.004335b0
lea ecx, [ebp - 0x21c]
call fcn.004335b0
jmp 0x49b4f6
lea edx, [ebp - 0x218]
push edx
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push str.prexmlversion
push str.Software360Safe360Preview
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], 1
lea ecx, [ebp - 8]
call fcn.004335b0
lea ecx, [ebp - 0x220]
call fcn.004335b0
lea ecx, [ebp - 0x21c]
call fcn.004335b0
xor ecx, ecx
jne 0x49b33a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x49b510
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
cmp dword [0x5387b8], 0
jne 0x49b6ed
mov dword [ebp - 0x74], 0
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
push 0x51781c
lea eax, [ebp - 0xc]
push eax
call fcn.00493b60
mov ecx, eax
call fcn.00493db0
push str._HasNewId
lea ecx, [ebp - 0x6c]
call fcn.0040f510
lea ecx, [ebp - 0xc]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49b582
lea ecx, [ebp - 0x6c]
call fcn.004335b0
lea ecx, [ebp - 0xc]
call fcn.004335b0
jmp 0x49b6ed
lea ecx, [ebp - 0xc]
call fcn.0044ea20
push eax
call fcn.00417aa0
add esp, 4
test eax, eax
jne 0x49b5ac
lea ecx, [ebp - 0x6c]
call fcn.004335b0
lea ecx, [ebp - 0xc]
call fcn.004335b0
jmp 0x49b6ed
mov dword [ebp - 0x68], 0
push 0x40
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x68], 0x44
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x3c], 1
xor ecx, ecx
mov word [ebp - 0x38], cx
lea ecx, [ebp - 0x70]
call fcn.00418350
push 0x50d4a8
lea ecx, [ebp - 0x70]
call fcn.0040e800
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x70]
call fcn.0041d780
push 0x50d4a8
lea ecx, [ebp - 0x70]
call fcn.0040e800
push 0x50d558
lea ecx, [ebp - 0x70]
call fcn.0040e800
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0041d780
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.0044ea20
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49b682
cmp dword [ebp - 0x1c], 0
je 0x49b682
push 0x3e8
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 4]
push ecx
push str.previewhasnewid
push str.Software360Safe360Preview
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x74], 0
je 0x49b6c3
lea ecx, [ebp - 0x70]
call fcn.004335b0
lea ecx, [ebp - 0x6c]
call fcn.004335b0
lea ecx, [ebp - 0xc]
call fcn.004335b0
jmp 0x49b6ed
mov dword [0x532304], 0
lea ecx, [ebp - 0x70]
call fcn.004335b0
lea ecx, [ebp - 0x6c]
call fcn.004335b0
lea ecx, [ebp - 0xc]
call fcn.004335b0
xor edx, edx
jne 0x49b523
mov eax, dword [0x532304]
mov esp, ebp
pop ebp
ret
Function at 0x49b750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xb
push 0
call fcn.0049d6b0
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 4]
push edx
push str.insttime
push str.SOFTWARE360SafeCoop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49b813
lea eax, [ebp - 0x18]
push eax
call fcn.0049d690
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x49b813
push 0
push 0
push 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
lea ecx, [ebp - 0x28]
call fcn.00491f20
lea ecx, [ebp - 0x30]
call fcn.00491ef0
lea ecx, [ebp - 0x38]
push ecx
call fcn.00493450
add esp, 4
push eax
lea ecx, [ebp - 0x30]
call fcn.00492730
push 0x44
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x30]
call fcn.00492fd0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x49bf70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe74
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xc58]
call fcn.0049dbd0
mov dword [ebp - 0xc5c], 0
jmp 0x49bfa9
mov eax, dword [ebp - 0xc5c]
add eax, 1
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0xc5c], 3
jae 0x49c174
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xc60]
call fcn.00418370
mov edx, dword [ebp - 0xc5c]
imul edx, edx, 0x208
add edx, str.Utils360ExamineUIEx.dll
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x50cdb4
lea edx, [ebp - 0xc60]
push edx
call fcn.00418ae0
add esp, 0x10
lea ecx, [ebp - 0xc60]
call fcn.00418600
movzx eax, al
test eax, eax
jne 0x49c01a
lea ecx, [ebp - 0xc60]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49c080
push 1
lea ecx, [ebp - 0xc58]
call fcn.0049db70
push 1
push 0
mov ecx, dword [ebp - 0xc5c]
imul ecx, ecx, 0x208
add ecx, str.11.0.0.1190
push ecx
lea ecx, [ebp - 0xc60]
call fcn.0044ea20
push eax
lea ecx, [ebp - 0xc58]
call fcn.0049dcb0
mov dword [ebp - 0xe6c], 0
lea ecx, [ebp - 0xc60]
call fcn.004335b0
lea ecx, [ebp - 0xc58]
call fcn.0049dc90
mov eax, dword [ebp - 0xe6c]
jmp 0x49c18f
xor edx, edx
mov word [ebp - 0xe68], dx
push 0x206
push 0
lea eax, [ebp - 0xe66]
push eax
call fcn.004ebd80
add esp, 0xc
push 0x104
lea ecx, [ebp - 0xe68]
push ecx
lea ecx, [ebp - 0xc60]
call fcn.0044ea20
push eax
call fcn.00421000
add esp, 0xc
mov edx, dword [ebp - 0xc5c]
imul edx, edx, 0x208
add edx, str.11.0.0.1190
push edx
lea eax, [ebp - 0xe68]
push eax
call fcn.0043f9a0
add esp, 8
test eax, eax
jge 0x49c164
movzx ecx, word [ebp - 0xe68]
test ecx, ecx
je 0x49c10f
lea edx, [ebp - 0xe68]
push edx
lea ecx, [ebp - 0xc58]
call fcn.0049db90
push 0
lea ecx, [ebp - 0xc58]
call fcn.0049db70
push 1
push 0
mov eax, dword [ebp - 0xc5c]
imul eax, eax, 0x208
add eax, str.11.0.0.1190
push eax
lea ecx, [ebp - 0xc60]
call fcn.0044ea20
push eax
lea ecx, [ebp - 0xc58]
call fcn.0049dcb0
mov dword [ebp - 0xe70], 0
lea ecx, [ebp - 0xc60]
call fcn.004335b0
lea ecx, [ebp - 0xc58]
call fcn.0049dc90
mov eax, dword [ebp - 0xe70]
jmp 0x49c18f
lea ecx, [ebp - 0xc60]
call fcn.004335b0
jmp 0x49bf9a
mov dword [ebp - 0xe74], 1
lea ecx, [ebp - 0xc58]
call fcn.0049dc90
mov eax, dword [ebp - 0xe74]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x49c480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0x49c4a5
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jae 0x49c5a7
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
call fcn.00418370
mov edx, dword [ebp - 4]
imul edx, edx, 0x208
add edx, str.Utils360Preview.exe
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x50cdb4
lea edx, [ebp - 8]
push edx
call fcn.00418ae0
add esp, 0x10
lea ecx, [ebp - 8]
call fcn.00418600
movzx eax, al
test eax, eax
jne 0x49c504
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49c521
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x21c]
jmp 0x49c5ac
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 8]
call fcn.0044ea20
push eax
call fcn.00421000
add esp, 0xc
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x208
add ecx, str.11.0.0.1011
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.0043f9a0
add esp, 8
test eax, eax
jge 0x49c59a
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 8]
call fcn.004335b0
mov eax, dword [ebp - 0x220]
jmp 0x49c5ac
lea ecx, [ebp - 8]
call fcn.004335b0
jmp 0x49c49c
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret

Function at 0x49cae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x49caf8
cmp dword [ebp + 0x10], 0
je 0x49caf8
cmp dword [ebp + 0x14], 0
jne 0x49cb0d
push 0x52022c
mov ecx, dword [ebp + 8]
call fcn.0040f510
mov eax, dword [ebp + 8]
jmp 0x49cbc6
push 0x52022c
lea ecx, [ebp - 0x10]
call fcn.0040f510
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 8], 1
push 0x538e3c
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ef666
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49cbaf
mov ecx, dword [ebp - 0xc]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004ebd80
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f550
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004ec873
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00418370
lea ecx, [ebp - 0x10]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x49cbd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x49cbee
cmp dword [ebp + 0xc], 0
je 0x49cbee
cmp dword [ebp + 0x14], 0
je 0x49cbee
cmp dword [ebp + 0x10], 0
jne 0x49cbf0
jmp 0x49cc54
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f510
lea ecx, [ebp - 0x10]
call fcn.0047ef80
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shl edx, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.0044ea20
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
call fcn.004335b0
mov esp, ebp
pop ebp
ret

Function at 0x49ce30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x49ce45
cmp dword [ebp + 0xc], 0
je 0x49ce45
cmp dword [ebp + 0x10], 0
jne 0x49ce47
jmp 0x49ce6f
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ebfed
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ebp
ret

Function at 0x49d100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 8], eax
push str._safemon_saasver.dll
lea eax, [ebp - 4]
push eax
call fcn.00493b60
mov ecx, eax
call fcn.00493db0
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49d193
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 4]
call fcn.0044ea20
push eax
call fcn.00421000
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040f510
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp + 8]
jmp 0x49d1ab
push 0x52022c
mov ecx, dword [ebp + 8]
call fcn.0040f510
lea ecx, [ebp - 4]
call fcn.004335b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret
Function at 0x49d260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004ebd80
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.modules360Inst.exe
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call fcn.00417aa0
add esp, 4
test eax, eax
je 0x49d3c4
mov dword [ebp - 0x670], 0
push 0x40
push 0
lea eax, [ebp - 0x66c]
push eax
call fcn.004ebd80
add esp, 0xc
mov dword [ebp - 0x220], 0
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x670], 0x44
mov dword [ebp - 0x644], 1
mov edx, 5
mov word [ebp - 0x640], dx
push 0x400
push 0
lea eax, [ebp - 0x620]
push eax
call fcn.004ebd80
add esp, 0xc
push str._FORCECOVER__URL:http:__pinst.360.cn_360safebeta_safebeta_home_jisu.cab
lea ecx, [ebp - 0x210]
push ecx
push str.__s___s
push 0x200
lea edx, [ebp - 0x620]
push edx
call fcn.004ed64c
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x670]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x620]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
je 0x49d3c4
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret