joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401920
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [ebx]
push edi
test eax, eax
mov dword [ebp - 4], esi
je 0x401942
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebx], 0
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x401956
push 0x47a15c
jmp 0x401987
lea esi, [eax + 1]
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00454ff0
mov edx, dword [ebp - 4]
mov edi, esp
push esi
push edi
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x401986
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
lea esp, [ebp - 0x10]
test eax, eax
setne cl
pop edi
mov dword [ebx], eax
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401cf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
push esi
push edi
mov ecx, 0x47
xor eax, eax
lea edi, [esp + 8]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x401d3f
lea ecx, [esp + 8]
mov dword [esp + 8], 0x114
push ecx
call edi
test eax, eax
jne 0x401d3f
pop edi
xor ax, ax
pop esi
add esp, 0x11c
ret
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x401e10
dec eax
je 0x401dc4
dec eax
je 0x401d60
xor esi, esi
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x401d6e
mov esi, 4
cmp eax, 5
jne 0x401da6
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401d8c
mov esi, 5
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
cmp eax, 1
jne 0x401e15
mov esi, 6
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
cmp eax, 6
jne 0x401e15
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401e15
mov esi, 7
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
cmp dword [esp + 0xc], 4
jne 0x401e15
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401de4
mov esi, 2
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
cmp eax, 0xa
jne 0x401dfa
mov esi, 2
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
cmp eax, 0x5a
jne 0x401e15
mov esi, 3
pop edi
mov ax, si
pop esi
add esp, 0x11c
ret
mov esi, 1
mov ax, si
pop edi
pop esi
add esp, 0x11c
ret

Function at 0x401e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
xor esi, esi
push eax
push 1
push esi
push str.SystemCurrentControlSetControlWindows
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401e8f
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.CSDVersion
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401e84
mov esi, dword [esp + 0xc]
and esi, 0xffff
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
shr eax, 8
add esp, 0xc
ret
Function at 0x401ea0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x410
lea eax, [esp]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401ef3
lea ecx, [esp]
push str.Internet_ExplorerIEXPLORE.EXE
lea edx, [esp + 0x20c]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x401ef3
mov eax, dword [esp + 0x414]
push 0xa
push 0
lea ecx, [esp + 0x210]
push eax
push ecx
call fcn.00403b80
add esp, 0x10
mov eax, 1
add esp, 0x410
ret
Function at 0x402170
Capabilities:
Get file version info

Disassembly:
mov eax, 0x400c
call fcn.00454ff0
mov ax, word [0x47a15c]
push esi
mov esi, dword [esp + 0x4014]
push edi
mov word [esp + 0x14], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push esi
stosw word es:[edi], ax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40221e
lea edx, [esp + 0x14]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40221e
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x46f520
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40221e
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
mov eax, dword [esp + 0x4024]
shr edx, 0x10
push ecx
push edx
push str._d._d._d._d
push eax
call fcn.004076f0
add esp, 0x18
mov eax, 1
pop edi
pop esi
add esp, 0x400c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400c
ret
Function at 0x402230
Capabilities:
Get file version info

Disassembly:
sub esp, 0x90
lea eax, [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0xa0]
push eax
push edi
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x40225d
pop edi
pop esi
pop ebx
add esp, 0x90
ret
push ebp
push esi
call fcn.0045525f
add esp, 4
mov ebp, eax
mov dword [esp + 0x10], ebp
push ebp
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4023cb
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push str.VarFileInfoTranslation
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4023cb
mov esi, dword [esp + 0xa8]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
test esi, esi
je 0x402332
mov eax, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
push ecx
push edx
push str.StringFileInfo_04x_04xFileDescription
lea eax, [esp + 0x2c]
push 0x80
push eax
call fcn.00401c00
add esp, 0x14
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x402332
mov eax, dword [esp + 0x18]
push eax
mov ebx, eax
call ebp
inc eax
cmp eax, 0x7fffffff
ja 0x402332
test eax, eax
mov edi, eax
mov ecx, esi
je 0x402332
mov edx, ebx
sub edx, esi
mov ax, word [edx + ecx]
test ax, ax
je 0x402326
mov word [ecx], ax
add ecx, 2
dec edi
jne 0x402312
jmp 0x40232a
test edi, edi
jne 0x40232d
sub ecx, 2
mov word [ecx], 0
mov edi, dword [esp + 0xac]
test edi, edi
je 0x4023c2
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [eax]
mov cx, word [eax]
shr edx, 0x10
push edx
push ecx
push 0x46f524
lea edx, [esp + 0x2c]
push 0x80
push edx
call fcn.00401c00
add esp, 0x14
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4023c2
mov eax, dword [esp + 0x18]
push eax
mov ebx, eax
call ebp
inc eax
cmp eax, 0x7fffffff
ja 0x4023c2
test eax, eax
mov esi, eax
mov ecx, edi
je 0x4023c2
mov edx, ebx
sub edx, edi
mov ax, word [edx + ecx]
test ax, ax
je 0x4023b6
mov word [ecx], ax
add ecx, 2
dec esi
jne 0x4023a2
jmp 0x4023ba
test esi, esi
jne 0x4023bd
sub ecx, 2
mov word [ecx], 0
mov ebp, dword [esp + 0x10]
mov ebx, 1
push ebp
call fcn.00455176
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
Function at 0x4029c0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x461080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x46f42c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
push ecx
call fcn.00408910
add esp, 4
mov ebx, dword [eax]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], 1
mov esi, 0x3e8
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x402a1a
cmp dword [eax - 4], esi
jge 0x402a60
mov edi, dword [eax - 8]
cmp edi, esi
jle 0x402b67
test edi, edi
mov esi, edi
jne 0x402b67
mov eax, dword [0x46f42c]
lea ecx, [edi + edi + 2]
lea edx, [ebp + 0xc]
push ecx
lea ecx, [esi + esi + 2]
push edx
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00407060
mov edx, dword [esp + 0x20]
add esp, 0x10
push ebp
mov dword [edx - 8], edi
call fcn.00408420
mov eax, dword [esp + 0x10]
push ebx
push 0x3e8
push eax
push 0x47a15c
push str.lasttime
push 0x46f628
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x20], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402ab2
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x402ab2
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
lea esi, [eax - 0xc]
mov eax, dword [eax - 0xc]
cmp eax, 1
jle 0x402afc
lea ecx, [esp + 0x10]
call fcn.004083e0
mov ecx, dword [esi + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.00408040
test eax, eax
je 0x402afc
mov edx, dword [esi + 4]
add esi, 0xc
lea eax, [edx + edx + 2]
push eax
mov eax, dword [esp + 0x14]
push esi
mov ecx, dword [eax - 4]
lea edx, [ecx + ecx + 2]
push edx
push eax
call fcn.00407060
add esp, 0x10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x10]
push eax
call fcn.0045514d
mov edx, dword [0x46f430]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402b52
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x402b52
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
lea edx, [esi + esi + 0xe]
push edx
call fcn.00455403
add esp, 4
test eax, eax
je 0x402b93
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
jmp 0x402a34
xor eax, eax
jmp 0x402a60
Function at 0x402c80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4610c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x46f42c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
push ecx
call fcn.00408910
add esp, 4
mov ebx, dword [eax]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], 1
mov esi, 0x3e8
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x402cda
cmp dword [eax - 4], esi
jge 0x402d20
mov edi, dword [eax - 8]
cmp edi, esi
jle 0x402e27
test edi, edi
mov esi, edi
jne 0x402e27
mov eax, dword [0x46f42c]
lea ecx, [edi + edi + 2]
lea edx, [ebp + 0xc]
push ecx
lea ecx, [esi + esi + 2]
push edx
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00407060
mov edx, dword [esp + 0x20]
add esp, 0x10
push ebp
mov dword [edx - 8], edi
call fcn.00408420
mov eax, dword [esp + 0x10]
push ebx
push 0x3e8
push eax
push 0x47a15c
push str.lasttime
push str.leak
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x20], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402d72
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x402d72
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
lea esi, [eax - 0xc]
mov eax, dword [eax - 0xc]
cmp eax, 1
jle 0x402dbc
lea ecx, [esp + 0x10]
call fcn.004083e0
mov ecx, dword [esi + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.00408040
test eax, eax
je 0x402dbc
mov edx, dword [esi + 4]
add esi, 0xc
lea eax, [edx + edx + 2]
push eax
mov eax, dword [esp + 0x14]
push esi
mov ecx, dword [eax - 4]
lea edx, [ecx + ecx + 2]
push edx
push eax
call fcn.00407060
add esp, 0x10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x10]
push eax
call fcn.0045514d
mov edx, dword [0x46f430]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402e12
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x402e12
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
lea edx, [esi + esi + 0xe]
push edx
call fcn.00455403
add esp, 4
test eax, eax
je 0x402e53
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
jmp 0x402cf4
xor eax, eax
jmp 0x402d20
Function at 0x402f40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x461100
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x46f42c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
push ecx
call fcn.00408910
add esp, 4
mov ebx, dword [eax]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], 1
mov esi, 0x3e8
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x402f9a
cmp dword [eax - 4], esi
jge 0x402fe0
mov edi, dword [eax - 8]
cmp edi, esi
jle 0x4030e7
test edi, edi
mov esi, edi
jne 0x4030e7
mov eax, dword [0x46f42c]
lea ecx, [edi + edi + 2]
lea edx, [ebp + 0xc]
push ecx
lea ecx, [esi + esi + 2]
push edx
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00407060
mov edx, dword [esp + 0x20]
add esp, 0x10
push ebp
mov dword [edx - 8], edi
call fcn.00408420
mov eax, dword [esp + 0x10]
push ebx
push 0x3e8
push eax
push 0x47a15c
push str.Flag
push str.PopWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x20], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x403032
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x403032
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
lea esi, [eax - 0xc]
mov eax, dword [eax - 0xc]
cmp eax, 1
jle 0x40307c
lea ecx, [esp + 0x10]
call fcn.004083e0
mov ecx, dword [esi + 4]
push ecx
lea ecx, [esp + 0x14]
call fcn.00408040
test eax, eax
je 0x40307c
mov edx, dword [esi + 4]
add esi, 0xc
lea eax, [edx + edx + 2]
push eax
mov eax, dword [esp + 0x14]
push esi
mov ecx, dword [eax - 4]
lea edx, [ecx + ecx + 2]
push edx
push eax
call fcn.00407060
add esp, 0x10
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x10]
push eax
call fcn.0045514d
mov edx, dword [0x46f430]
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4030d2
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x4030d2
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
lea edx, [esi + esi + 0xe]
push edx
call fcn.00455403
add esp, 4
test eax, eax
je 0x403113
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
jmp 0x402fb4
xor eax, eax
jmp 0x402fe0

Function at 0x403200
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x208
lea eax, [esp]
push str.360Safe.exe
push 0x47adb8
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x208
ret
Function at 0x403230
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x461146
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
push edi
push 0
push str.360ActDefWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [esp + 0x224]
mov esi, eax
cmp edi, 0xbc3
jne 0x40332a
test esi, esi
je 0x4032a2
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4032a2
push edi
push 0x65
push 0x497
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4033df
push str.360safebox.exe
lea eax, [esp + 0x10]
push 0x47a9a8
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [0x46f42c]
mov dword [esp + 8], ecx
push 0x65
lea edx, [esp + 0xc]
push str._ct__d
push edx
mov dword [esp + 0x228], 0
call fcn.004076f0
mov eax, dword [esp + 0x14]
push 5
push 0x47a15c
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00403b80
mov eax, dword [esp + 0x24]
mov ecx, dword [0x46f430]
add esp, 0x1c
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4033df
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4033df
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
jmp 0x4033d7
test esi, esi
je 0x40335d
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40335d
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push 0x497
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4033df
push str.360safebox.exe
lea ecx, [esp + 0x10]
push 0x47a9a8
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [0x46f42c]
mov dword [esp + 8], edx
push edi
lea eax, [esp + 0xc]
push str._ct__d
push eax
mov dword [esp + 0x228], 1
call fcn.004076f0
mov ecx, dword [esp + 0x14]
push 5
push 0x47a15c
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.00403b80
mov eax, dword [esp + 0x24]
mov edx, dword [0x46f430]
add esp, 0x1c
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4033df
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4033df
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov ecx, dword [esp + 0x214]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x403a80
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x410
mov dx, word [0x47a15c]
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x20e]
mov word [esp + 0x20c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x46f7c8
lea eax, [esp + 0x210]
push 0x47a9a8
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x47a9a8
push str.__sSafeBoxTray.exe___r
lea ecx, [esp + 0xc]
push 0x208
push ecx
call fcn.00401c00
mov eax, dword [esp + 0x428]
add esp, 0x10
test eax, eax
pop edi
je 0x403b4e
push 0
push 0x9f
push 0x9e
push 0xae
push 0x79
push 0
call fcn.00408ba0
add esp, 0x18
cmp eax, 1
jne 0x403b33
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [esp + 4]
push eax
jmp 0x403b61
push 0
push str.CheckRun
push str.main
call fcn.00408ac0
add esp, 0xc
add esp, 0x410
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
lea edx, [esp]
push eax
push edx
push 1
push str.360Safebox
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esp, 0x410
ret
Function at 0x403e10
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
call fcn.00403200
test eax, eax
push 0
jne 0x403e5f
push 0x9f
push 0x9e
push 0x9a
push 0x79
push 0
call fcn.00408ba0
add esp, 0x18
cmp eax, 1
jne 0x403f4c
push str.http:__www.360.cn
call fcn.00401ea0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push str.Q360SafeMainClass
call ebx
mov esi, eax
test esi, esi
je 0x403ead
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x218]
test eax, eax
jbe 0x403f4c
push 0x168
push eax
push 0x52c
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
mov ax, word [0x47a15c]
mov ecx, 0x81
mov word [esp + 0xc], ax
xor eax, eax
lea edi, [esp + 0xe]
push str.360safe.exe
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x47adb8
push ecx
stosw word es:[edi], ax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403f4c
push 5
push 0
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00403b80
mov edi, eax
add esp, 0x10
test edi, edi
je 0x403f4c
push ebp
mov ebp, dword [esp + 0x21c]
test ebp, ebp
jbe 0x403f44
push 0x3e8
push edi
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push str.Q360SafeMainClass
call ebx
mov esi, eax
test esi, esi
je 0x403f44
push 0x168
push ebp
push 0x52c
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x403f60
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, 4
lea ecx, [esp]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
lea edx, [esp + 8]
push eax
push ecx
push edx
push str.EnableLUA
push str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esp]
test eax, eax
jne 0x403fb0
xor eax, eax
add esp, 0x214
ret
mov ax, word [0x47a15c]
push edi
mov word [esp + 0x10], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
push 0
lea ecx, [esp + 0x14]
push 0x1c
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x403ffc
lea edx, [esp + 0x12]
push str.UsersAdministratorAppDataLocal
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403ffc
add esp, 0x214
ret
mov eax, 1
add esp, 0x214
ret