joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
lea edx, [esp + 4]
push ecx
push edx
push str.path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
pop ecx
ret

Function at 0x41b620
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48d2d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x208
mov ebx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x14], ebx
call fcn.004020c0
add esp, 8
push str.SDVersion.dll
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x444], esi
call sub.MFC42u.DLL_operator_2
mov esi, dword [esp + 0x440]
mov eax, dword [eax]
push esi
push eax
mov byte [esp + 0x440], bl
call fcn.0041da70
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete bl
mov byte [esp + 0x438], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x438], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test bl, bl
je 0x41b723
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x4b06a0
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::operator_1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x228]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x4b0c4c
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x228]
push eax
call sub.MFC42u.DLL_CString::operator_1
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x430
ret

Function at 0x41c5e0
Capabilities:
Create process on windows

Disassembly:
push 0x4ba8f0
call fcn.0041cdf0
mov ecx, eax
call fcn.0041cea0
push 1
push 0
push 0
push str.http:__avc.360.cn_index.html_a6353
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
ret
Function at 0x41cbb0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x48d51c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
push ebp
mov ebp, dword [esp + 0x27c]
push esi
push ebp
lea ecx, [esp + 0x14]
call fcn.00436102
xor esi, esi
push 0x4b00bc
lea ecx, [esp + 0x14]
mov dword [esp + 0x27c], esi
call fcn.0043613e
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x41cc37
lea ecx, [esp + 0x10]
mov dword [esp + 0x278], eax
call sub.MFC42u.DLL_CString::CString
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
add esp, 0x274
ret
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
mov dword [esp + 0x1c], esi
mov ebx, 1
lea edx, [esp + 0x54]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42u.DLL_CString::CString_2
push 0x4b00b8
lea eax, [esp + 0x28]
push ebp
push eax
mov byte [esp + 0x28c], bl
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x54]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x28c], 2
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
mov byte [esp + 0x280], 4
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
push 0x4b0b78
push eax
call edi
add esp, 8
test eax, eax
je 0x41cd30
mov ecx, dword [esp + 0x10]
push 0x4b0b84
push ecx
call edi
add esp, 8
test eax, eax
je 0x41cd30
test byte [esp + 0x28], 0x10
je 0x41ccde
lea edx, [esp + 0x14]
push edx
call fcn.0041cbb0
add esp, 4
test eax, eax
jne 0x41cd6d
jmp 0x41cd30
mov esi, dword [sym.imp.MSVCRT.dll_wcsstr]
lea eax, [esp + 0x54]
push str..vir
push eax
call esi
add esp, 8
test eax, eax
jne 0x41cd6d
lea ecx, [esp + 0x54]
push 0x4b0710
push ecx
call esi
add esp, 8
test eax, eax
jne 0x41cd6d
lea edx, [esp + 0x54]
push str..bkup
push edx
call esi
add esp, 8
test eax, eax
jne 0x41cd6d
lea eax, [esp + 0x54]
push str..dat
push eax
call esi
add esp, 8
test eax, eax
jne 0x41cd6d
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x280], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x280], 0
call sub.MFC42u.DLL_CString::CString
test esi, esi
jne 0x41cc48
jmp 0x41cd92
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x280], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x280], 0
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
mov dword [esp + 0x280], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x278]
mov eax, dword [esp + 0x1c]
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x274
ret
Function at 0x41cea0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
lea ecx, [esi + 4]
call sub.MFC42u.DLL_CString::operator
cmp dword [esi], 0
jne 0x41ced7
push 0
push 0
push esi
push 0x41cf10
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x41d520
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
xor edi, edi
push eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [esi], eax
je 0x41d5ef
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AVCacheCreate
push eax
call edi
mov ecx, dword [esi]
push str.AVCacheClose
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.AVCacheQuery
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.AVNetQuery
push eax
call edi
mov ecx, dword [esi]
push str.AVInsertWhite
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.AVDeleteWhite
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.AVNetQueryCancel
push eax
call edi
mov ecx, dword [esi]
push str.MisKillCreate
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.MisKillClose
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.MisKillJudgeWhite
push eax
call edi
mov ecx, dword [esi]
push str.MisKillJudgeWhiteOnlyFile
push ecx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x41d890
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push esi
mov dword [esi], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41d953
push edi
mov ecx, 0xf
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x68], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x41d926
movsx eax, byte [esp + 8]
lea ecx, [esp + 0xa]
sub eax, 0x30
push ecx
mov dword [esi + 0x10], 2
mov dword [esi + 4], eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [esi + 8], eax
mov eax, 1
pop esi
add esp, 0x44
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
mov eax, 4
and edx, 0xff
cmp eax, ecx
mov dword [esi + 4], ecx
sbb ecx, ecx
mov dword [esi + 8], edx
neg ecx
inc ecx
mov dword [esi + 0x10], ecx
mov eax, 1
pop esi
add esp, 0x44
ret

Function at 0x41d9a0
Capabilities:
Get file version info

Disassembly:
mov eax, 0x400c
call fcn.004365f0
mov ax, word [0x4b9760]
push esi
mov esi, dword [esp + 0x4014]
push edi
mov word [esp + 0x14], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push esi
stosw word es:[edi], ax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x41da64
cmp eax, 0x3fff
ja 0x41da64
lea edx, [esp + 0x14]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41da64
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x4b00b8
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41da64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x401c]
pop edi
pop esi
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov word [edx], cx
mov edx, dword [esp + 0x4018]
mov cx, word [eax + 8]
mov word [edx], cx
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x401c]
shr ecx, 0x10
mov word [edx], cx
mov ecx, dword [esp + 0x4020]
mov ax, word [eax + 0xc]
mov word [ecx], ax
mov eax, 1
add esp, 0x400c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400c
ret
Function at 0x41db00
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push ebx
mov ebx, dword [esp + 0x238]
push esi
mov ecx, ebx
call sub.MFC42u.DLL_CString::Empty
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x41db31
pop esi
xor eax, eax
pop ebx
add esp, 0x22c
ret
push ebp
push edi
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22c
push eax
push esi
xor edi, edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41db7b
mov ebp, dword [esp + 0x240]
cmp dword [esp + 0x18], ebp
je 0x41db77
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41db60
jmp 0x41db7b
mov edi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
call fcn.0041dba0
add esp, 8
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x22c
ret

Function at 0x41dba0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x21c]
push esi
mov ecx, ebx
call sub.MFC42u.DLL_CString::Empty
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x41dc37
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41dc37
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 4
push ecx
push esi
mov dword [esp + 0x20], 0
call sub.PSAPI.DLL_EnumProcessModules
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call sub.MFC42u.DLL_CString::operator_1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov edx, dword [ebx]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [edx - 8]
test ecx, ecx
setg al
add esp, 0x210
ret

Function at 0x41dc50
Capabilities:
Get process image filename

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push ebp
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x41dcf3
push ebx
mov ebx, dword [esp + 0x218]
push esi
push edi
mov edi, dword [esp + 0x224]
push edi
push ebx
push 0
push ebp
call sub.PSAPI.DLL_GetModuleFileNameExW
mov esi, eax
test esi, esi
jne 0x41dcdf
push edi
push ebx
push ebp
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov esi, eax
test esi, esi
je 0x41dcdf
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
push ebx
stosw word es:[edi], ax
call fcn.0041dd00
mov edx, dword [esp + 0x230]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x18
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x208
ret
xor eax, eax
pop ebp
add esp, 0x208
ret
Function at 0x41dd00
Capabilities:
Get disk information

Disassembly:
sub esp, 0x3a0
push ebx
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x220]
push eax
push 0xc7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41de20
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
mov dx, word [0x4b2ce0]
mov ebx, dword [esp + 0x3b4]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4b2cdc]
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
stosw word es:[edi], ax
mov dword [esp + 0x10], ecx
mov word [esp + 0x14], dx
lea edi, [esp + 0x220]
mov ax, word [edi]
lea ecx, [esp + 0x18]
push 0x104
lea edx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1c], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41ddcc
lea eax, [esp + 0x18]
push eax
call ebp
mov esi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov word [esp + esi*2 + 0x18], 0x5c
inc esi
push esi
push ecx
push ebx
mov word [esp + esi*2 + 0x24], 0
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x41ddea
mov dx, word [edi]
add edi, 2
test dx, dx
je 0x41dde2
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41ddd7
cmp word [edi], 0
je 0x41de20
jmp 0x41dd7f
mov eax, dword [esp + 0x3bc]
lea ecx, [ebx + esi*2]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x3bc]
push edx
push 0x4b0680
push eax
push ecx
call fcn.0040c760
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a0
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3a0
ret
Function at 0x41de80
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48d5b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x290
push ebx
push ebp
mov ebp, dword [esp + 0x2a8]
push esi
push edi
push str.00000000000000000000000000000000
mov ecx, ebp
call sub.MFC42u.DLL_CString::operator_1
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
xor ebx, ebx
call fcn.0041dff0
add esp, 8
push str.360verify.dll
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x2b4], edi
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a8], 2
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x41df4e
push str.GetCIDW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
cmp edx, edi
je 0x41df41
mov word [esp + 0x20], di
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push 0x40
push eax
call edx
test eax, eax
je 0x41df41
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call sub.MFC42u.DLL_CString::operator_1
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
cmp ebx, edi
jne 0x41dfba
mov word [esp + 0xa0], di
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xa2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
lea eax, [esp + 0xa0]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x4b2d14
push str.SOFTWARE360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x200
mov dword [esp + 0x30], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41dfba
lea edx, [esp + 0xa0]
mov ecx, ebp
push edx
mov word [esp + 0xe4], ax
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2a0]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x29c
ret

Function at 0x41e530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push esi
mov esi, dword [esp + 0x21c]
mov ecx, esi
call sub.MFC42u.DLL_CString::Empty
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x20019
push 0
push 0x496cc0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e5dd
push edi
mov ecx, 0x81
lea edi, [esp + 0x16]
mov word [esp + 0x14], ax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosw word es:[edi], ax
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x496d40
push ecx
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x14]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi]
xor eax, eax
pop edi
pop esi
mov edx, dword [ecx - 8]
test edx, edx
setne al
add esp, 0x214
ret
xor eax, eax
pop esi
add esp, 0x214
ret
Function at 0x41e5f0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x48d5e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 4]
mov dword [esp + 0x14], 0
push eax
call fcn.0041e530
add esp, 4
test eax, eax
je 0x41e65e
lea ecx, [esp + 4]
push str._safemon360tray.exe
lea edx, [esp + 0xc]
push ecx
push edx
call sub.MFC42u.DLL_operator_2
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x41e65e
mov esi, 1
jmp 0x41e660
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41e690
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x48d608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 4]
mov dword [esp + 0x14], 0
push eax
call fcn.0041e530
add esp, 4
test eax, eax
je 0x41e6fe
lea ecx, [esp + 4]
push str.360leakfixer.exe
lea edx, [esp + 0xc]
push ecx
push edx
call sub.MFC42u.DLL_operator_2
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x41e6fe
mov esi, 1
jmp 0x41e700
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41e730
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
call fcn.0041de30
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
neg eax
sbb eax, eax
mov dword [esp + 0x18], ecx
and eax, str.runas
lea ecx, [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
push ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
xor esi, esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41e7d9
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x41e7c3
mov ecx, dword [esp + 0x40]
push eax
push ecx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x3c
ret
mov eax, esi
pop edi
pop esi
add esp, 0x3c
ret
Function at 0x41e7f0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edx, 0x103
sub edx, eax
lea eax, [esp + 8]
push edx
push str.Internet_Exploreriexplore.exe
push eax
call dword [sym.imp.MSVCRT.dll_wcsncat]
mov ecx, dword [esp + 0x220]
add esp, 0x10
lea edx, [esp + 4]
push 5
push 0
push ecx
push edx
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
add esp, 0x208
ret

Function at 0x41e870
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x828
push ebx
push esi
push edi
push str.360sd
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ax, word [0x4b9760]
mov ecx, 0x103
mov word [esp + 0x424], ax
xor eax, eax
lea edi, [esp + 0x426]
lea edx, [esp + 0x424]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x424]
mov dword [esp + 0xc], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0x410
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [esp + 0x424], 0
je 0x41e9e7
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push str.SoftMgr_somextrainfo.ini
call ebx
push eax
lea ecx, [esp + 0x42c]
push str.SoftMgr_somextrainfo.ini
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncat]
mov dx, word [0x4b9760]
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], dx
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x424]
lea ecx, [esp + 0x14]
push eax
push 0x208
push ecx
push 0
push 0x4b2e24
push str.AllRuns
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, dword [sym.imp.MSVCRT.dll_wcsstr]
lea edx, [esp + 0x14]
push str.360sd
push edx
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x41e9e7
push 0x4b2e0c
push esi
call edi
mov edi, eax
add esp, 8
test edi, edi
lea eax, [esp + 0x14]
je 0x41e9b7
push eax
call ebx
mov ecx, edi
lea edx, [esp + 0x18]
sub ecx, edx
add edi, 6
sar ecx, 1
sub eax, ecx
push eax
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x10
jmp 0x41e9ca
cmp esi, eax
jne 0x41e9c4
mov word [esp + 0x14], 0
jmp 0x41e9ca
mov word [esi - 6], 0
lea ecx, [esp + 0x424]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x4b2e24
push str.AllRuns
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x828
ret