joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x18
mov eax, 0x4b244f
call fcn.004764b0
mov edi, ecx
call fcn.00459c63
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
and dword [ebp - 4], 0
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push eax
call fcn.00475410
mov ecx, dword [edi + 8]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.004600b7
test eax, eax
jne 0x459e89
push esi
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4d288c
push 0x4d2898
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x459f14
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push 0x4d54a4
push eax
call fcn.00403b17
add esp, 0xc
lea esi, [edi + 0x10]
mov eax, dword [esi + 0xc]
push esi
push eax
lea ecx, [ebp - 0x18]
call fcn.00447cb4
mov eax, dword [esi + 0x10]
push esi
push eax
jmp 0x459efc
lea ecx, [ebp - 0x18]
call fcn.004474e3
push dword [eax]
lea eax, [ebp + 0x208]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x459f14
lea ecx, [ebp - 0x18]
call fcn.004474e3
push dword [eax + 4]
lea eax, [ebp + 0x208]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040260e
mov ecx, edi
call fcn.00458b2a
test eax, eax
jne 0x459ef0
mov ecx, 0x4f7c20
call fcn.0043a044
lea ecx, [ebp - 0x18]
call fcn.004588cf
push esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x24]
call fcn.00447cb4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.0043105d
test al, al
je 0x459ea0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x414
leave
ret
Function at 0x45a984
Capabilities:
Create thread

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x45a9a0
push eax
push eax
push ecx
push 0x45a972
push eax
push eax
call fcn.00475fc9
add esp, 0x18
jmp 0x45a9a5
call fcn.00459f42
ret 4

Function at 0x45abec
Capabilities:
Hide graphical window

Disassembly:
jmp method.CSetupPageImpl_class_CCustomSetupDialog__1_.virtual_8
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
ret

Function at 0x45b338
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0x400]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x4b4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret

Function at 0x45b41b
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x4b255c
call fcn.004764b0
mov esi, ecx
push 0
mov ecx, 0x4f7c20
call fcn.0043a00a
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
lea edi, [esi + 0x39c]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45b456
push 0
push dword [edi]
call ebx
cmp dword [esi - 0x58], 0
jne 0x45b460
xor eax, eax
jmp 0x45b4b9
xor ebx, ebx
inc ebx
mov edi, 0x4f7cd0
test byte [0x4f7ccc], bl
jne 0x45b49b
or dword [0x4f7ccc], ebx
mov ecx, dword [esi - 0x58]
mov eax, dword [ecx]
and dword [ebp - 4], 0
call dword [eax]
push eax
push dword [esi - 0x58]
mov ecx, edi
call fcn.00459b65
push 0x4b6d0e
call fcn.004779f0
or dword [ebp - 4], 0xffffffff
pop ecx
push dword [esi - 0x60]
mov ecx, edi
call fcn.004308e3
push 0
mov ecx, edi
call fcn.0045955f
mov ecx, dword [esi - 0x58]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x20]
mov eax, ebx
call fcn.00476588
ret

Function at 0x45b669
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00402231
test eax, eax
je 0x45b67b
xor eax, eax
inc eax
leave
ret
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x45b6b7
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45b6bb
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.0040239b
pop ecx
pop ecx
test eax, eax
jne 0x45b6bb
cmp dword [ebp - 4], eax
jne 0x45b6b7
push 1
push 0x4eef30
push esi
call fcn.00402097
add esp, 0xc
xor eax, eax
jmp 0x45b6be
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x45c15f
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x4b2693
call fcn.004764b0
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea eax, [ebx - 5]
push eax
lea ecx, [esi + 0x35c]
call fcn.00450a80
push 0x4f9e00
lea ecx, [ebp + 0x10]
call fcn.0040293e
and dword [ebp - 4], 0
mov ecx, 0x4f7c20
call fcn.0043a0af
test eax, eax
je 0x45c1a7
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
jmp 0x45c1a9
xor eax, eax
neg eax
sbb eax, eax
add eax, 0x104
push ebx
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.004411b1
add esp, 0xc
cmp ebx, 0x63
mov eax, 0x4c15ac
jge 0x45c1cd
mov eax, dword [ebp + 0x10]
push eax
push dword [esi + 0x358]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi - 0x54]
test ecx, ecx
je 0x45c241
mov eax, dword [ecx]
push 0
push ebx
mov edi, 0xe15
push edi
call dword [eax + 0x28]
cmp dword [ebp + 0x14], 0x64
jl 0x45c241
cmp ebx, 0x5f
jl 0x45c241
mov ecx, dword [esi - 0x54]
test ecx, ecx
je 0x45c241
mov eax, dword [ecx]
push 0
push dword [ebp + 0x14]
push edi
call dword [eax + 0x28]
lea ebx, [esi + 0x39c]
mov ecx, ebx
call fcn.0046f2a2
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x350], 0
push 0
push dword [esi + 0x358]
call edi
push 0
push dword [esi + 0x360]
call edi
mov ecx, ebx
call fcn.0046f255
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402963
call fcn.00476588
ret 0x10
Function at 0x45e68d
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x80
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edi, edi
push edi
push esi
push 2
push edi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45e6e4
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [ebp - 4], edi
push esi
sete al
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45e7c3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00475410
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x10], esi
push 5
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x54], 0x44
push esi
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
cmp dword [ebp - 0xc], esi
je 0x45e824
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45e90d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
and dword [esi], 0
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x45e93c
xor eax, eax
jmp 0x45e994
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x45e960
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45e938
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x228]
je 0x45e97e
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45e960
jmp 0x45e986
mov eax, dword [ebp - 0x218]
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esi], eax
setne al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047548a
leave
ret 8
Function at 0x45e9a4
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor esi, esi
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x45ea12
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x45ea0b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x45ea0b
push eax
push edi
call fcn.004756c6
mov esi, eax
neg esi
pop ecx
sbb esi, esi
pop ecx
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
leave
ret 8

Function at 0x45ea2c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
call fcn.0045e797
xor ebx, ebx
cmp eax, ebx
je 0x45ea4b
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
jne 0x45ea4b
pop ebx
leave
ret
push esi
push edi
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebx
je 0x45eaa5
push 0x34
push str.360FsFlt
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x45ea93
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x45ea93
cmp dword [ebp - 0x24], 4
jne 0x45ea93
xor ebx, ebx
inc ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, ebx
pop esi
jmp 0x45ea48
mov edi, dword [ebp - 4]
jmp 0x45ea93

Function at 0x45eaaa
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x45eae2
xor eax, eax
jmp 0x45eb23
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45eb11
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004756c6
pop ecx
pop ecx
test eax, eax
je 0x45eb17
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45eaf1
jmp 0x45eb1a
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
leave
ret 4
Function at 0x45ecb1
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xea4]
sub esp, 0xf24
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0xea0], eax
push ebx
push esi
mov esi, dword [ebp + 0xeac]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x990], ax
lea eax, [ebp + 0x992]
push eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], esi
call fcn.00475410
push dword [esi]
mov ebx, 0x104
lea eax, [ebp + 0x990]
push ebx
push eax
call fcn.00478194
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x18
push str.uninst.exe
lea eax, [ebp + 0x990]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp + 0x990]
push eax
call edi
test eax, eax
jne 0x45ed3b
xor eax, eax
jmp 0x45eea0
xor eax, eax
push 0x206
push eax
mov word [ebp + 0xc98], ax
lea eax, [ebp + 0xc9a]
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp + 0xc98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0xfe
mov word [ebp + 0xb98], ax
xor ebx, ebx
lea eax, [ebp + 0xb9a]
push ebx
push eax
call fcn.00475410
mov ecx, dword [ebp - 0x7c]
add esp, 0xc
call fcn.0045e781
mov ecx, dword [eax]
push 0x80
lea edx, [ebp + 0xb98]
push edx
push eax
call dword [ecx + 0x34]
lea eax, [ebp + 0xb98]
push eax
lea eax, [ebp + 0xc98]
push eax
call esi
lea eax, [ebp + 0xc98]
push eax
call edi
test eax, eax
je 0x45edcb
lea eax, [ebp + 0xc98]
push eax
call fcn.00430ecb
pop ecx
push ebx
lea eax, [ebp + 0xc98]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Au_.exe
lea eax, [ebp + 0xc98]
push eax
lea eax, [ebp + 0x788]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
lea eax, [ebp + 0x788]
push eax
lea eax, [ebp + 0x990]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x45ed34
lea eax, [ebp + 0x788]
push eax
mov esi, 0x400
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [ebp - 0x7c], ebx
call fcn.00478194
push 0x4c1e10
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.004767fa
mov eax, dword [ebp - 0x80]
push dword [eax]
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.004767fa
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0045e7c3
add esp, 0x2c
test eax, eax
je 0x45ed34
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x7c]
call esi
mov edi, 0x102
jmp 0x45ee7f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [ebp - 0x7c]
call esi
cmp eax, edi
je 0x45ee71
lea eax, [ebp + 0x788]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0xc98]
push eax
call fcn.00430ecb
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0xea0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
add ebp, 0xea4
leave
ret 4
Function at 0x45f1c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00476b30
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00475410
mov esi, 0x800
push esi
lea eax, [ebp - 0x1004]
push 0x4d2940
push eax
call fcn.004753b9
push esi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.00476ed3
push esi
lea eax, [ebp - 0x1004]
push 0x4d2948
push eax
call fcn.00476ed3
push esi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.00476ed3
push esi
lea eax, [ebp - 0x1004]
push 0x4d2974
push eax
call fcn.00476ed3
add esp, 0x48
push esi
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.00476ed3
push esi
lea eax, [ebp - 0x1004]
push 0x4d2998
push eax
call fcn.00476ed3
push esi
lea eax, [ebp - 0x1004]
push 0x4c1e48
push eax
call fcn.00476ed3
add esp, 0x24
push 0x14
push edi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x45f2db
call fcn.00401f95
test eax, eax
je 0x45f2c4
call fcn.00401fb2
test eax, eax
je 0x45f2c4
push 5
xor eax, eax
push eax
push eax
push 0x4ef930
jmp 0x45f2cf
push 5
xor eax, eax
push eax
push eax
push 0x4ef798
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0x10], 0
je 0x45f2e8
push 0
call fcn.00476e3b
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
leave
ret 0xc

Function at 0x45f2fb
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f311
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x45f315
xor eax, eax
inc eax
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
jne 0x45f33a
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x45f33f
push edi
call esi
test eax, eax
je 0x45f33f
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x45f390
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
push edi
mov edi, ecx
test eax, eax
jne 0x45f3b7
xor eax, eax
jmp 0x45f3fb
cmp eax, 0x104
jge 0x45f3b3
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00475410
add esp, 0xc
push str.360leakfixer.exe
push dword [esi]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [edi + 0x1d4], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047548a
leave
ret 4
Function at 0x45f40b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x45f486
cmp eax, 0x104
jge 0x45f486
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00475410
add esp, 0xc
push 0x4bfd68
push dword [esi]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f486
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0040239b
pop ecx
pop ecx
test eax, eax
je 0x45f486
xor eax, eax
inc eax
jmp 0x45f488
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047548a
leave
ret 4

Function at 0x45f4bf
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.0045e797
cmp eax, edi
je 0x45f597
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
test eax, eax
je 0x45f597
push 0x800
lea eax, [ebp - 0x884]
push edi
push eax
call fcn.00475410
add esp, 0xc
push 0x400
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.crypt32.dll
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f597
mov ecx, esi
call fcn.0045ec1e
mov esi, eax
cmp esi, edi
je 0x45f597
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push edi
push eax
call fcn.00475410
mov eax, dword [esi]
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x884]
push ecx
push esi
call dword [eax + 0x64]
test eax, eax
je 0x45f597
lea eax, [ebp - 0x84]
push str.6.1.7601.24382
push eax
call fcn.00448df0
pop ecx
pop ecx
test eax, eax
jge 0x45f597
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047548a
leave
ret
Function at 0x45fbba
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1108
call fcn.00476b30
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1108], eax
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x104
jle 0x45fbf4
xor eax, eax
jmp 0x45fcb6
push esi
mov esi, 0x800
push esi
lea eax, [ebp - 0x1104]
push 0
push eax
call fcn.00475410
push esi
xor esi, esi
lea eax, [ebp - 0x904]
push esi
push eax
call fcn.00475410
push dword [edi]
lea eax, [ebp - 0x1104]
push 0x400
push eax
call fcn.00478194
add esp, 0x24
cmp ebx, esi
je 0x45fc46
cmp word [ebx], si
je 0x45fc46
push ebx
lea eax, [ebp - 0x1104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00401000
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1104]
push eax
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x904]
push str..tmp
push eax
call fcn.00477a07
pop ecx
pop ecx
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45fcc4
inc esi
cmp esi, 0xa
jl 0x45fc5b
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0047548a
leave
ret
mov ecx, dword [ebp - 0x1108]
lea eax, [ebp - 0x904]
push eax
call fcn.00402894
xor eax, eax
inc eax
jmp 0x45fcb5

Function at 0x460243
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4b1d33
call fcn.004764b0
mov esi, ecx
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004600b7
push str.360DiagnoseScan.exe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403a22
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402963
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov eax, esi
call fcn.00476588
ret
Function at 0x4602ab
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x4b2b57
call fcn.004764b0
mov esi, ecx
mov dword [ebp - 0x1c], esi
and dword [ebp - 0x18], 0
cmp dword [esi + 0x10c], 0
je 0x460361
mov edi, 0x4f9e00
push edi
lea ecx, [ebp - 0x14]
call fcn.0040293e
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004600b7
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], 0
je 0x460359
push edi
lea ecx, [ebp - 0x10]
call fcn.0040293e
push esi
lea eax, [ebp - 0x10]
push str._s360leakfixer.exe
push eax
mov byte [ebp - 4], 1
call fcn.00403b17
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push ebx
call edi
test eax, eax
je 0x460351
push esi
lea eax, [ebp - 0x10]
push str._s_safemonFreeSaaS.tpi
push eax
call fcn.00403b17
mov ebx, dword [ebp - 0x10]
add esp, 0xc
push ebx
call edi
test eax, eax
je 0x460351
mov ecx, dword [ebp - 0x1c]
call fcn.0045e8ea
test eax, eax
jne 0x460351
mov dword [ebp - 0x18], 1
lea ecx, [ebx - 0x10]
call fcn.00402963
lea ecx, [esi - 0x10]
call fcn.00402963
mov eax, dword [ebp - 0x18]
call fcn.00476588
ret

Function at 0x46036a
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x4b2b7a
call fcn.004764b0
mov esi, ecx
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004600b7
push str.antiarp
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004161c9
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040b33f
push 0x208
lea eax, [ebp]
push 0
push eax
call fcn.00475410
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.miniui.dll
push ebx
lea eax, [ebp]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x460411
lea eax, [ebp]
push eax
call fcn.0046b107
pop ecx
push str.360NetUL.dll
push ebx
lea eax, [ebp]
push eax
call esi
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x460431
lea eax, [ebp]
push eax
call fcn.0046b107
pop ecx
lea ecx, [ebx - 0x10]
call fcn.00402963
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x20c
leave
ret