joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e00
Capabilities:
Get file version info

Disassembly:
mov eax, 0x400c
call fcn.00422620
mov ax, word [0x42f1ac]
push esi
mov esi, dword [esp + 0x4014]
push edi
mov word [esp + 0x14], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push esi
stosw word es:[edi], ax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x404edc
cmp eax, 0x3fff
ja 0x404edc
lea edx, [esp + 0x14]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x404edc
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x42d69c
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x404edc
mov edx, dword [esp + 0x4020]
mov esi, dword [esp + 0x401c]
mov ecx, edx
push ebx
mov ebx, ecx
xor eax, eax
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
push ecx
xor ecx, ecx
mov cx, word [eax + 8]
mov eax, dword [eax + 8]
shr eax, 0x10
push ecx
push eax
dec edx
push str._d._d._d._d
push edx
push esi
call fcn.004025c0
add esp, 0x1c
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x400c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400c
ret

Function at 0x404ef0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
push eax
push ebx
xor ebp, ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x404f16
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x404f2e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x404f69
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x42d69c
push esi
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [esp + 0x20]
mov ebp, eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x404f80
Capabilities:
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425d68
push 0x422650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x834
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov word [ebp - 0x818], si
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edi
push str.__s_
push 0x800
lea eax, [ebp - 0x818]
push eax
call fcn.004025c0
add esp, 0x10
push 5
push esi
lea ecx, [ebp - 0x818]
push ecx
push str.Explorer
push 0x42f1ac
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x405016
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 0x81c], esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [ebp - 0x81c]
push edx
push 0x428054
push 0x15
push esi
push 0x428044
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x405134
mov eax, dword [ebp - 0x81c]
cmp eax, esi
je 0x405108
mov dword [ebp - 0x830], esi
mov ecx, dword [eax]
lea edx, [ebp - 0x830]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [ebp - 0x830]
cmp eax, esi
je 0x40508c
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
mov eax, dword [ebp - 0x830]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x4050fc
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x838], eax
mov word [ebp - 0x82c], si
mov word [ebp - 0x840], 8
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x840]
push edx
push eax
call dword [ecx + 0xd0]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x838]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405160
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
mov cx, word [esp + 0x68]
mov dword [esp + 0x10], eax
lea edx, [esp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x64]
push eax
push 0
push 0
push 0
mov word [esp + 0x5c], cx
mov ecx, dword [esp + 0x78]
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x4051d4
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x405320
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov ax, word [0x42f1ac]
push esi
push edi
mov word [esp + 0x10], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
xor esi, esi
stosw word es:[edi], ax
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x20], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [esp + 0x10], si
jne 0x4053b8
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0x10]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4053ac
lea edx, [esp + 0x10]
push str.....
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [esp + 0x10], 0
je 0x405468
mov esi, dword [esp + 0x224]
test esi, esi
je 0x405402
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x405402
mov ecx, dword [esp + 0x220]
mov edx, dword [esp + 0x21c]
lea eax, [esp + 0x10]
push esi
push eax
push str._s_s
push ecx
push edx
call fcn.004025c0
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x210
ret
mov ecx, dword [esp + 0x220]
shr ecx, 1
cmp ecx, 0x7fffffff
ja 0x40545a
mov eax, dword [esp + 0x21c]
mov edx, ecx
test ecx, ecx
je 0x40545a
lea esi, [esp + 0x10]
sub esi, eax
mov cx, word [esi + eax]
test cx, cx
je 0x40544e
mov word [eax], cx
add eax, 2
dec edx
jne 0x405426
sub eax, 2
pop edi
pop esi
mov word [eax], 0
mov eax, 1
add esp, 0x210
ret
test edx, edx
jne 0x405455
sub eax, 2
mov word [eax], 0
pop edi
mov eax, 1
pop esi
add esp, 0x210
ret
mov eax, esi
pop edi
pop esi
add esp, 0x210
ret

Function at 0x405520
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
lea eax, [esp]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x40553e
test byte [esp], 7
mov eax, 1
jne 0x405543
call fcn.00405480
pop ecx
ret
Function at 0x4056b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x20e]
mov word [esp + 0x20c], 0
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
pop edi
je 0x405756
lea ecx, [esp]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x405756
lea edx, [esp]
push str.param.ini
lea eax, [esp + 0x20c]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x405756
lea ecx, [esp + 0x208]
push ecx
push 0
push str.ProtectSelf
push 0x42d6f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x405756
mov eax, 2
add esp, 0x410
ret
xor eax, eax
add esp, 0x410
ret

Function at 0x405760
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x464
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40584e
lea ecx, [esp]
push edi
push ecx
push 0x3e8
push 1
push 0
push 0x65
push 0x591
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x262]
mov word [esp + 0x260], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x5a]
mov word [esp + 0x58], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x58]
push 0x104
push edx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
pop edi
je 0x40584e
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x40584e
lea ecx, [esp + 0x54]
push str.param.ini
lea edx, [esp + 0x260]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x40584e
lea eax, [esp + 0x25c]
lea ecx, [esp + 4]
push eax
push 0x28
push ecx
push 0
push str.StateARP
push 0x42d6f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40584e
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__wtol]
add esp, 4
add esp, 0x464
ret
xor eax, eax
add esp, 0x464
ret
Function at 0x405860
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x424
mov dx, word [0x42f1ac]
push ebx
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], dx
mov word [esp + 0x22c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22e]
push str.safemon360Tray.exe__start
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x28]
push 0x208
rep stosd dword es:[edi], eax
lea eax, [esp + 0x234]
mov dword [esp + 0x18], 1
push eax
mov dword [esp + 0x20], 0x208
call fcn.00405320
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push ecx
push edx
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x405914
lea ecx, [esp + 0x22c]
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
push str.SiteAccess
call fcn.00405a30
push str.ExecAccess
mov ebp, eax
call fcn.00405a30
mov esi, eax
push str.MonAccess
mov dword [esp + 0x2c], esi
call fcn.00405a30
mov edi, eax
push str.UDiskAccess
mov dword [esp + 0x2c], edi
call fcn.00405a30
add esp, 0x10
mov ebx, eax
test ebp, ebp
je 0x405963
test esi, esi
je 0x40597d
test edi, edi
je 0x40597d
test ebx, ebx
je 0x40597d
xor esi, esi
jmp 0x405989
test esi, esi
jne 0x405976
test edi, edi
jne 0x405976
test ebx, ebx
jne 0x405976
mov esi, 1
jmp 0x405989
mov esi, 2
jmp 0x405989
xor eax, eax
test ebx, ebx
setne al
add eax, 3
mov esi, eax
xor edi, edi
call fcn.00404c70
test eax, eax
jne 0x40599d
call fcn.00404c30
test eax, eax
je 0x4059ac
call fcn.004056b0
cmp eax, 2
jne 0x4059ac
mov edi, 1
mov eax, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push str.NoNotiLeak
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, 1
setne al
push eax
call fcn.00405760
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x440]
push edi
push ecx
push ebx
push ebp
push edx
push str.protect1_d_2_d_3_d_4_d_5_d_6_d_7_d
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret

Function at 0x405a30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
lea ecx, [esp]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
lea edx, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [esp]
xor eax, eax
test ecx, ecx
setne al
add esp, 0xc
ret
Function at 0x405a80
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x422b5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov ax, word [0x42f1ac]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x14], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
push 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push 0x208
push ecx
stosw word es:[edi], ax
call fcn.00405320
add esp, 0xc
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_4
mov ebp, dword [sym.imp.MSVCRT.dll_wcsrchr]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov dword [esp + 0x224], 0
mov ebx, 1
mov esi, 0x42d410
mov edx, dword [esi]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x20]
push edx
call fcn.00404d60
add esp, 0x14
test al, al
jne 0x405b44
mov eax, dword [esi]
push 0x5c
push eax
call ebp
add esp, 8
test eax, eax
je 0x405b33
add eax, 2
push eax
jmp 0x405b36
mov ecx, dword [esi]
push ecx
push str.Software360safeUpdate
push reloc.OLEAUT32.dll_SysReAllocString
call edi
xor ebx, ebx
add esi, 4
cmp esi, 0x42d454
jl 0x405af7
test ebx, ebx
jne 0x405b64
push str.libver
push str.Software360SafeLiveUp
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x224], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x405c60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x66c
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
push esi
push edi
push 0
push str.Q360SafeMainClass
call ebp
mov esi, eax
test esi, esi
je 0x405cb9
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x67c]
test eax, eax
jbe 0x405e85
push 0x168
push eax
push 0x52c
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
add esp, 0x66c
ret
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x26a]
mov word [esp + 0x268], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [0x42f1ac]
mov ecx, 0x81
mov word [esp + 0x60], ax
xor eax, eax
lea edi, [esp + 0x62]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0x60]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea edx, [esp + 0x60]
push 0x5c
push edx
call esi
add esp, 8
test eax, eax
je 0x405d7b
mov word [eax], 0
lea eax, [esp + 0x60]
push 0x5c
push eax
call esi
add esp, 8
test eax, eax
je 0x405d7b
mov edx, eax
lea ecx, [esp + 0x60]
sub edx, ecx
mov ecx, 0x208
sar edx, 1
sub ecx, edx
shr ecx, 1
cmp ecx, 0x7fffffff
ja 0x405d7b
test ecx, ecx
mov edx, ecx
je 0x405d7b
mov esi, 0x42d928
sub esi, eax
mov cx, word [esi + eax]
test cx, cx
je 0x405d6f
mov word [eax], cx
add eax, 2
dec edx
jne 0x405d5b
jmp 0x405d73
test edx, edx
jne 0x405d76
sub eax, 2
mov word [eax], 0
lea edx, [esp + 0x268]
push 0x410
lea eax, [esp + 0x64]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
ja 0x405dd0
lea edx, [esp + 0x60]
lea ecx, [esp + 0x268]
mov esi, 0x208
lea eax, [esp + 0x268]
sub edx, ecx
mov cx, word [edx + eax]
test cx, cx
je 0x405dc4
mov word [eax], cx
add eax, 2
dec esi
jne 0x405db0
jmp 0x405dc8
test esi, esi
jne 0x405dcb
sub eax, 2
mov word [eax], 0
lea edx, [esp + 0x268]
push edx
call fcn.00404d60
add esp, 4
test al, al
je 0x405e85
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0xc], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x38], eax
push eax
lea eax, [esp + 0x28c]
mov dword [esp + 0x40], 0x44
push eax
mov word [esp + 0x74], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405e85
mov esi, dword [esp + 0x67c]
test esi, esi
jbe 0x405e71
mov ecx, dword [esp + 0xc]
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push str.Q360SafeMainClass
call ebp
test eax, eax
je 0x405e71
push 0x168
push esi
push 0x52c
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop edi
pop esi
pop ebp
add esp, 0x66c
ret
Function at 0x405e90
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x405ea0
mov eax, 0x57
pop esi
ret
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add esp, 4
shl eax, 1
push eax
mov eax, dword [esp + 0x14]
push esi
push 1
push eax
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop esi
ret

Function at 0x405f40
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x208
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x405fa8
lea eax, [esp]
push str.360realpro.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x405fa8
lea ecx, [esp]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405fa8
mov edx, dword [esp + 0x20c]
push 5
lea eax, [esp + 4]
push edx
push eax
call fcn.004051e0
add esp, 0xc
add esp, 0x208
ret

Function at 0x405fb0
Capabilities:
Parse url

Disassembly:
sub esp, 0x3c
push esi
mov esi, dword [esp + 0x44]
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
push edx
push 0x10000000
push esi
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x3c
ret

Function at 0x406170
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x800
mov esi, 0x400
call sub.MFC42u.DLL_operatornew
mov ebx, dword [esp + 0x20]
add esp, 4
test ebx, ebx
mov edi, eax
jne 0x406195
mov ebx, 0x42f1ac
test edi, edi
je 0x4061d2
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebp
push esi
push edi
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esi - 2]
cmp eax, edx
jb 0x4061e1
push edi
call sub.MFC42u.DLL_operatordelete
add esi, esi
lea eax, [esi + esi]
push eax
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 8
test edi, edi
jne 0x40619d
mov ecx, dword [esp + 0x20]
push ebx
call sub.MFC42u.DLL_CString::operator_2
pop edi
pop esi
pop ebp
pop ebx
ret
test edi, edi
je 0x4061d2
mov ecx, dword [esp + 0x20]
push edi
call sub.MFC42u.DLL_CString::operator_2
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4062e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
test esi, esi
push edi
je 0x40641e
mov edi, dword [esp + 0x220]
test edi, edi
je 0x40641e
mov ebx, dword [esp + 0x224]
test ebx, ebx
je 0x40641e
push 4
push str.___
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x40638e
cmp ebx, 0x7fffffff
jbe 0x40634a
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x208
ret
xor ebp, ebp
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
mov cx, word [edx + eax]
test cx, cx
je 0x406367
mov word [eax], cx
add eax, 2
dec ebx
jne 0x406353
jmp 0x40636b
test ebx, ebx
jne 0x406373
sub eax, 2
mov ebp, 0x8007007a
mov word [eax], 0
mov eax, ebp
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x208
ret
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 0xc
push str._systemroot_
push esi
call ebp
test eax, eax
jne 0x4063ed
lea edx, [esp + 0x10]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40641e
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test eax, eax
je 0x40641e
add esi, 0x18
lea ecx, [esp + 0x10]
push esi
push ecx
push str._s_s
push ebx
push edi
call fcn.00406540
add esp, 0x14
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x208
ret
push 9
push str.system32_
push esi
call ebp
test eax, eax
jne 0x40641e
lea edx, [esp + 0x10]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40641e
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test eax, eax
jne 0x4063c8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
Function at 0x406430
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x414
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call edi
test eax, eax
jne 0x406534
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x406470
push eax
call esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push str.CLSIDB69F34DD_F0F9_42DC_9EDD_957187DA688D
push SysReAllocString
call edi
test eax, eax
jne 0x406534
mov eax, dword [esp + 8]
test eax, eax
je 0x40649c
push eax
call esi
mov dx, word [0x42f1ac]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], dx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x406526
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x406526
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0xc]
push str.safemon.dll
lea eax, [esp + 0x218]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x406526
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406534
pop edi
mov eax, 1
pop esi
add esp, 0x414
ret
pop edi
xor eax, eax
pop esi
add esp, 0x414
ret