joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c0ca
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ebx
lea esi, [ebx + 0x537a]
test esi, esi
je 0x41c236
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c236
push 0x55e650
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push esi
push eax
call fcn.005316d9
add esp, 0xc
cmp dword [ebp - 0xc], edi
je 0x41c236
push dword [ebp - 0xc]
call fcn.00531791
push eax
call fcn.00531e29
mov dword [ebp - 8], eax
lea eax, [ebx + 0x66b4]
push eax
call fcn.00524c40
push dword [ebp + 0x10]
mov ebx, eax
call fcn.00524c40
add ebx, dword [ebp - 8]
add ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.0051ce24
mov esi, eax
add esp, 0x14
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41c22d
push dword [ebp - 0xc]
push 1
push dword [ebp - 8]
push esi
call fcn.00530f2b
add esi, dword [ebp - 8]
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], esi
add eax, 0x66b4
je 0x41c194
push eax
call fcn.00524c40
inc eax
pop ecx
cmp eax, 0x3fffffff
jle 0x41c198
mov eax, edi
jmp 0x41c1ba
lea esi, [eax + eax]
mov eax, esi
call fcn.0051dc40
mov ecx, dword [ebp - 0x10]
mov eax, esp
push 3
push esi
add ecx, 0x66b4
push ecx
push eax
call fcn.00417f5c
mov esi, dword [ebp - 8]
push eax
push ebx
push esi
call fcn.0041cff5
mov eax, dword [ebp - 0x10]
add eax, 0x66b4
push eax
call fcn.00524c40
add esi, eax
pop ecx
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], edi
je 0x41c209
push dword [ebp + 0x10]
call fcn.00524c40
inc eax
pop ecx
cmp eax, 0x3fffffff
jg 0x41c209
lea esi, [eax + eax]
mov eax, esi
call fcn.0051dc40
mov eax, esp
push 3
push esi
push dword [ebp + 0x10]
push eax
call fcn.00417f5c
mov esi, dword [ebp - 8]
mov edi, eax
push edi
push ebx
push esi
call fcn.0041cff5
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
push dword [ebp + 8]
push ebx
push esi
call fcn.00436c78
xor edi, edi
push esi
inc edi
call fcn.0051ce2d
add esp, 0x14
push dword [ebp - 0xc]
call fcn.00530b28
pop ecx
mov eax, edi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d360
leave
ret 0xc
Function at 0x41c5c2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x578e]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41c5f9
push dword [ebp + 8]
lea eax, [edi + 0x5998]
push 0x55d98c
push 0x104
push eax
call fcn.00419d05
add esp, 0x10
inc esi
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x41d81d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
mov esi, ecx
push edi
mov byte [esi + 0x2c], al
call fcn.0041dd73
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x41d85d
push 0xe7
push str.DownloadMgr::Init
push str.__s__d___create_event_failed
call fcn.00402cc1
add esp, 0xc
xor al, al
jmp 0x41d88f
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push edi
push esi
push 0x41d5b2
push edi
push edi
call fcn.005282b1
add esp, 0x18
mov dword [esi + 0x28], eax
test eax, eax
jne 0x41d88d
push 0xee
push str.DownloadMgr::Init
push str.__s__d___create_thread_failed
jmp 0x41d851
mov al, 1
pop edi
pop esi
pop ebp
ret 4
Function at 0x4202e5
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x42030a
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420401
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x420327
mov eax, dword [esi]
xor ecx, ecx
push str..
mov word [eax], cx
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004014b0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x420346
mov eax, dword [eax]
lea ecx, [ebp - 0x26c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.004036e0
cmp edi, 0xffffffff
je 0x420401
lea eax, [ebp - 0x240]
push 0x562744
push eax
call fcn.00524c00
pop ecx
pop ecx
test eax, eax
je 0x4203e0
lea eax, [ebp - 0x240]
push 0x5626fc
push eax
call fcn.00524c00
pop ecx
pop ecx
test eax, eax
je 0x4203e0
test dword [ebp - 0x26c], 0x10
je 0x4203e0
cmp dword [esi + 0x10], 0
je 0x4203c4
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4203b1
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.00436f3f
pop ecx
pop ecx
test eax, eax
js 0x4203e0
lea eax, [ebp - 0x240]
push eax
call fcn.00524c40
pop ecx
push eax
lea eax, [ebp - 0x240]
mov ecx, esi
push eax
call fcn.0040389c
lea eax, [ebp - 0x26c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x420367
test edi, edi
je 0x420401
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051d360
leave
ret

Function at 0x42040f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x4204fc
mov ebx, 0x200
lea eax, [ebp - 0x204]
push ebx
push 0
push eax
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x204]
push eax
push 0x780
push str.ForegroundWndIsPPt
push str.__s__d__classname_is__s_
call fcn.00402cc1
add esp, 0x10
xor esi, esi
push dword [esi + 0x5cb2a8]
lea eax, [ebp - 0x204]
push eax
call fcn.00524c00
pop ecx
pop ecx
test eax, eax
je 0x4204f7
add esi, 4
cmp esi, 0x10
jb 0x42047f
push ebx
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x404]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x404]
push eax
push 0x78a
push str.ForegroundWndIsPPt
push str.__s__d__WindowText_is__s_
call fcn.00402cc1
lea eax, [ebp - 0x404]
push str.Microsoft_PowerPoint
push eax
call fcn.005214b3
add esp, 0x18
test eax, eax
je 0x4204fc
xor eax, eax
inc eax
jmp 0x4204fe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret
Function at 0x42085e
Capabilities:
Check if file exists

Disassembly:
push 0x258
mov eax, 0x54cd4b
call fcn.0051d3dc
mov eax, dword fs:[0x2c]
xor edi, edi
mov ecx, dword [0x5e7ba4]
mov ebx, 0x556c1c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x264], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5dc9d4]
cmp eax, dword [ecx + 4]
jg 0x420a47
push ebx
mov ecx, 0x5dc9bc
call fcn.00403554
test al, al
jne 0x4208c3
push 0x5dc9bc
mov ecx, esi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.0040342e
jmp 0x420a3f
push ebx
lea ecx, [ebp - 0x230]
call fcn.00401b4a
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
push str.InstallPath
push 0x55fbc4
push 0x80000001
call fcn.00437e0e
add esp, 0x10
test eax, eax
jne 0x420905
push ebx
mov ecx, esi
call fcn.00401b4a
jmp 0x420a34
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00520800
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
add esp, 0xc
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4209a7
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00520800
lea eax, [ebp - 0x248]
push eax
call fcn.004373d1
add esp, 0x10
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.360huabao_
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x248]
call fcn.004036e0
push ebx
lea ecx, [ebp - 0x260]
call fcn.00401b4a
cmp dword [ebp - 0x250], 0
mov byte [ebp - 4], 2
je 0x4209f8
push 0x55e000
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004014b0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4209e3
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [ebp - 0x248]
call fcn.004036e0
lea eax, [ebp - 0x218]
push eax
call fcn.00524c40
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ebx, 0x5dc9bc
push eax
mov ecx, ebx
call fcn.0040389c
and dword [esi + 0x10], 0
mov ecx, esi
and dword [esi + 0x14], 0
push ebx
call fcn.0040342e
lea ecx, [ebp - 0x260]
call fcn.004036e0
lea ecx, [ebp - 0x230]
call fcn.004036e0
mov eax, esi
call fcn.0051d386
ret
push 0x5dc9d4
call fcn.0051d26c
cmp dword [0x5dc9d4], 0xffffffff
pop ecx
jne 0x42089d
push ebx
mov ecx, 0x5dc9bc
mov dword [ebp - 4], edi
call fcn.00401b4a
push 0x555182
call fcn.0051d0b7
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5dc9d4
call fcn.0051d222
pop ecx
jmp 0x42089d
Function at 0x421d4e
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1d4
push str.GetProcessName
push str.__s__d___GetProcessName_begin
mov dword [ebp - 0x210], esi
call fcn.00402cc1
add esp, 0xc
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x421dfa
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x103
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x421de3
push 0x103
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x421e74
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
jmp 0x421e79
push str.QueryFullProcessImageNameW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x421e74
push ebx
xor ebx, ebx
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x421e74
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00520800
add esp, 0xc
mov dword [ebp - 0x214], 0x103
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [ebp - 0x210]
push edi
test eax, eax
jne 0x421de4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x556c1c
mov ecx, esi
call fcn.00401b4a
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret
Function at 0x4224f5
Capabilities:
Check if file exists

Disassembly:
push 0x228
mov eax, 0x54d038
call fcn.0051d3dc
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x5e7ba4]
mov edi, 0x556c1c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x234], esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5dca14]
cmp eax, dword [ecx + 4]
jg 0x422673
push edi
mov ecx, 0x5dc9fc
call fcn.00403554
test al, al
jne 0x42255a
push 0x5dc9fc
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040342e
jmp 0x42266b
push edi
lea ecx, [ebp - 0x230]
call fcn.00401b4a
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push 0x80000001
call fcn.00437e0e
add esp, 0x10
test eax, eax
jne 0x42259c
push edi
mov ecx, esi
call fcn.00401b4a
jmp 0x422660
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00520800
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
add esp, 0xc
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
push str.......
lea eax, [ebp - 0x218]
push eax
call edi
push str.components_sesvc_
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x422631
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....
lea eax, [ebp - 0x218]
push eax
call edi
push str.sesvc_
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call fcn.00524c40
pop ecx
push eax
lea eax, [ebp - 0x218]
mov edi, 0x5dc9fc
push eax
mov ecx, edi
call fcn.0040389c
push edi
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040342e
lea ecx, [ebp - 0x230]
call fcn.004036e0
mov eax, esi
call fcn.0051d386
ret
push 0x5dca14
call fcn.0051d26c
cmp dword [0x5dca14], 0xffffffff
pop ecx
jne 0x422534
push edi
mov ecx, 0x5dc9fc
mov dword [ebp - 4], ebx
call fcn.00401b4a
push 0x555196
call fcn.0051d0b7
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5dca14
call fcn.0051d222
pop ecx
jmp 0x422534
Function at 0x42278f
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00520800
lea eax, [ebp - 0x224]
push eax
call fcn.004373d1
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x224]
add esp, 0x10
cmp dword [ebp - 0x210], 8
cmovae eax, dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push str.360DesktopLiteDTFenceConfig.ini
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42280d
xor esi, esi
inc esi
jmp 0x42282e
lea eax, [ebp - 0x20c]
push eax
push 0
push str.EyeRest
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
lea ecx, [ebp - 0x224]
call fcn.004036e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0051d360
leave
ret
Function at 0x4229ec
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x2a4
mov eax, 0x54d0e8
call fcn.0051d3dc
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.00520800
add esp, 0xc
mov dword [ebp - 0x2b0], 1
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], esi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2b0]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x422c1e
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x422c1e
push str.360EntClient.exe
lea ecx, [ebp - 0x260]
call fcn.00401b4a
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0041fbac
add esp, 0xc
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
call fcn.004036e0
push str.deepscanQhEntInfo.dll
lea ecx, [ebp - 0x290]
call fcn.00401b4a
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0041fbac
add esp, 0xc
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 5
call fcn.004036e0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call esi
test eax, eax
je 0x422b19
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call esi
test eax, eax
jne 0x422bed
push str.360EntClient64.exe
lea ecx, [ebp - 0x278]
call fcn.00401b4a
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0041fbac
add esp, 0xc
lea ecx, [ebp - 0x248]
push eax
call fcn.00401e27
lea ecx, [ebp - 0x260]
call fcn.004036e0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 5
call fcn.004036e0
push str.deepscanQhEntInfo64.dll
lea ecx, [ebp - 0x2a8]
call fcn.00401b4a
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.0041fbac
add esp, 0xc
lea ecx, [ebp - 0x230]
push eax
call fcn.00401e27
lea ecx, [ebp - 0x278]
call fcn.004036e0
lea ecx, [ebp - 0x2a8]
call fcn.004036e0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call esi
test eax, eax
je 0x422c08
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call esi
test eax, eax
je 0x422c08
lea ecx, [ebp - 0x230]
call fcn.004036e0
lea ecx, [ebp - 0x248]
call fcn.004036e0
xor eax, eax
inc eax
jmp 0x422c20
lea ecx, [ebp - 0x230]
call fcn.004036e0
lea ecx, [ebp - 0x248]
call fcn.004036e0
xor eax, eax
call fcn.0051d386
ret
Function at 0x422c26
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
push 0
push eax
call fcn.00520800
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop esi
test eax, eax
jne 0x422ca6
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422ca6
xor eax, eax
inc eax
jmp 0x422ca8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d360
leave
ret

Function at 0x422cb4
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x244
mov eax, 0x54d126
call fcn.0051d3dc
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.00520800
add esp, 0xc
mov dword [ebp - 0x250], 1
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x24c], esi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x250]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, str.Is360SafeRegExistEx
test eax, eax
jne 0x422dce
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x422dce
push str.360Safe.exe
lea ecx, [ebp - 0x248]
call fcn.00401b4a
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0041fbac
add esp, 0xc
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.004036e0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0xca0
push ebx
push str.__s__d___file_path_exe___s
call fcn.00402cc1
add esp, 0x10
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae ecx, dword [ebp - 0x230]
push ecx
call esi
lea ecx, [ebp - 0x230]
test eax, eax
je 0x422dc5
call fcn.004036e0
xor eax, eax
inc eax
jmp 0x422de3
or dword [ebp - 4], 0xffffffff
call fcn.004036e0
push 0xca4
push ebx
push str.__s__d___Is360SafeRegExistEx_not_exist
call fcn.00402cc1
add esp, 0xc
xor eax, eax
call fcn.0051d386
ret
Function at 0x422de9
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x54d166
call fcn.0051d3dc
push str.360se.exe
lea ecx, [ebp - 0x58]
call fcn.00401b4a
lea eax, [ebp - 0x58]
xor esi, esi
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], esi
push eax
call fcn.00420ced
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.004036e0
push str.360secore.exe
lea ecx, [ebp - 0x70]
call fcn.00401b4a
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00420ced
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
call fcn.004036e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x422e8d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043bf37
pop ecx
test eax, eax
je 0x422e8d
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x422e8d
inc esi
lea ecx, [ebp - 0x28]
call fcn.004036e0
lea ecx, [ebp - 0x40]
call fcn.004036e0
mov eax, esi
call fcn.0051d386
ret
Function at 0x4236d7
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x230
mov eax, 0x54d2a0
call fcn.0051d3dc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov edi, 0x208
mov dword [ebp - 0x23c], esi
push edi
xor ebx, ebx
push ebx
push eax
call fcn.00520800
add esp, 0xc
mov dword [ebp - 0x238], 1
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], edi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x423822
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x423822
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401b4a
mov edi, str._netmon360WebIdentify.dll
mov dword [ebp - 4], ebx
push edi
call fcn.00524c40
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.004037f5
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x4237be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004036e0
jmp 0x423822
push str.GetWebIdentifyState
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4237df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.004036e0
jmp 0x423817
call eax
push 0x81a
mov esi, eax
push str.IsOBSRunningEx
push esi
push str.__d__s__d__
call fcn.00402cc1
xor ebx, ebx
lea ecx, [ebp - 0x230]
add esp, 0x10
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
call fcn.004036e0
mov esi, dword [ebp - 0x23c]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x423838
push esi
call fcn.00423840
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x423838
push esi
call fcn.00423a17
pop ecx
mov ebx, eax
mov eax, ebx
call fcn.0051d386
ret