joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42158e
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 4
mov eax, 0x48794e
call fcn.004677c7
mov edi, dword [ebp + 0x80c]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
jne 0x4215e7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret 4
cmp word [edi], bx
je 0x4215c0
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call fcn.0044d477
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x42161a
lea ecx, [eax - 0x10]
call fcn.004023e9
jmp 0x4215c0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x42162f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
jmp 0x421613
push 0x800
lea eax, [ebp]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push edi
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call esi
test eax, eax
jne 0x42166b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov eax, ebx
jmp 0x4215c2
xor ebx, ebx
inc ebx
jmp 0x421659

Function at 0x42175c
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.00467130
push 0xffffffffffffffff
push 0x487a0e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [esi + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044d477
mov esi, 0x800
push esi
lea eax, [ebp + 0x800]
push 0
push eax
call fcn.004670a0
push esi
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0x18
push str.deepscan
push dword [ebp - 0x10]
lea eax, [ebp + 0x800]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp + 0x800]
push eax
call fcn.00453537
pop ecx
lea eax, [ebp + 0x800]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42182b
lea eax, [ebp + 0x800]
push eax
call fcn.0041f5eb
pop ecx
test eax, eax
jne 0x42182b
push 4
push eax
lea eax, [ebp + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x1004
leave
ret
Function at 0x421f59
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 8
mov eax, 0x487a71
call fcn.004677c7
mov edi, ecx
cmp dword [edi + 8], 0
jne 0x421f8c
xor eax, eax
jmp 0x42202a
mov esi, 0x4c4f30
push esi
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [edi + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0044d477
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push str.safemon360Tray.exe
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
lea ecx, [ebp - 0x14]
call fcn.00401ce4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push str.__s___start
push eax
mov byte [ebp - 4], 1
call fcn.00404c90
mov esi, dword [ebp - 0x14]
mov eax, dword [esi - 0xc]
add esp, 0xc
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push str.360Safetray
push 0x4914e8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [esi - 0x10]
call fcn.004023e9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret
Function at 0x42204d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.00467130
push 0xffffffffffffffff
push 0x487aa9
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 8], edi
jne 0x422099
xor eax, eax
jmp 0x422214
mov esi, 0x800
push esi
lea eax, [ebp]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push 1
push 0x10
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea eax, [ebp + 0x800]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push 0x88
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x800]
push eax
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
push 0x8a
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [ebp + 0x100c]
mov eax, dword [eax]
push edi
lea ecx, [ebp + 0x800]
push ecx
push edi
push 0x4910f8
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.0042062b
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebx + 8]
call fcn.0044c754
mov ecx, eax
call fcn.0042dd19
cmp eax, edi
jne 0x4221b5
push 0x370
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [eax]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x800]
push eax
call esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
push 0x371
lea ecx, [ebp - 0x14]
call fcn.00421f25
push dword [ebp + 0x100c]
mov eax, dword [eax]
push edi
lea ecx, [ebp + 0x800]
push ecx
push str._startdesktop
push str.SoftMgrSoftManager.exe
push eax
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.0042062b
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebx + 8]
call fcn.0044c754
mov ecx, eax
call fcn.0042dd3f
test eax, eax
je 0x422211
mov ecx, dword [ebx + 8]
call fcn.0044c6cf
mov ecx, dword [eax]
push str.360DiagnoseScan.exe
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x422211
push 0x4915b0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x800]
push eax
call esi
push dword [ebp + 0x100c]
lea eax, [ebp + 0x800]
push edi
push eax
push edi
push str.360DiagnoseScan.exe
push 0x49159c
mov ecx, ebx
call fcn.0042062b
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x1004
leave
ret 4
Function at 0x422239
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x2004]
mov eax, 0x2004
call fcn.00467130
push 0xffffffffffffffff
push 0x487ae1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x2000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp dword [eax + 8], ebx
jne 0x422289
xor eax, eax
jmp 0x4223c6
mov esi, 0x800
push esi
lea eax, [ebp]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea eax, [ebp + 0x1800]
push ebx
push eax
call fcn.004670a0
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp]
push eax
lea eax, [ebp + 0x1800]
push eax
call edi
push esi
lea eax, [ebp + 0x800]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push 0x88
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0x1800]
push eax
lea eax, [ebp + 0x800]
push eax
call edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
push 0x8a
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [ebp + 0x200c]
mov eax, dword [eax]
push ebx
lea ecx, [ebp + 0x800]
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
push 0x4910f8
push eax
mov dword [ebp - 4], ebx
call fcn.0042062b
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
push esi
lea eax, [ebp + 0x1000]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push 0x370
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0x1800]
push eax
lea eax, [ebp + 0x1000]
push eax
call edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
push 0x371
lea ecx, [ebp - 0x18]
call fcn.00421f25
push dword [ebp + 0x200c]
lea ecx, [ebp + 0x1000]
push ebx
push ecx
mov ecx, dword [ebp - 0x14]
push ebx
push str.SoftMgrSoftManager.exe
push dword [eax]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.0042062b
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2000]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x2004
leave
ret 4
Function at 0x4223eb
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xf88]
mov eax, 0x1008
call fcn.00467130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0xf84], eax
push esi
mov esi, 0x800
push esi
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push 1
push 0x10
lea eax, [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea eax, [ebp + 0x784]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push 0x88
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
pop ecx
push 0x89
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
lea ecx, [ebp - 0x80]
mov dword [esp], 0x370
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
pop ecx
push 0xb3
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
pop ecx
push 0xb5
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
pop ecx
push 0xb6
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
pop ecx
push 0xb7
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
mov dword [esp], 0x4915b0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x784]
push eax
call esi
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
pop ecx
mov ecx, dword [ebp + 0xf84]
xor ecx, ebp
pop esi
call fcn.0046711a
add ebp, 0xf88
leave
ret
Function at 0x4225ea
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0xa08
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0xa08], eax
push 4
mov eax, 0x487b11
call fcn.004677c7
xor edi, edi
push edi
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [esi + 8], edi
je 0x4226b3
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], edi
call fcn.0044d477
push 0x800
lea eax, [ebp]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push 0x4910f8
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x208
lea eax, [ebp + 0x800]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x800]
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00421c4f
test eax, eax
je 0x4226a8
push edi
push edi
push edi
lea eax, [ebp + 0x800]
push eax
push str.taskbarunpin
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.0046711a
add ebp, 0xa0c
leave
ret

Function at 0x4226dc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x2788]
mov eax, 0x2808
call fcn.00467130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x2784], eax
push ebx
push esi
push edi
mov esi, 0x800
push esi
xor ebx, ebx
lea eax, [ebp + 0x1784]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp + 0x1784]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea eax, [ebp + 0x1f84]
push ebx
push eax
call fcn.004670a0
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp + 0x1784]
push eax
lea eax, [ebp + 0x1f84]
push eax
call edi
push esi
lea eax, [ebp + 0xf84]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push 0x88
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0x1f84]
push eax
lea eax, [ebp + 0xf84]
push eax
call edi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0xf84]
push eax
call fcn.00452ebd
push esi
lea eax, [ebp + 0x784]
push ebx
push eax
call fcn.004670a0
add esp, 0x10
push 0x89
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0x1f84]
push eax
lea eax, [ebp + 0x784]
push eax
call edi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x784]
push eax
call fcn.00452ebd
push esi
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.004670a0
add esp, 0x10
push 0x370
lea ecx, [ebp - 0x80]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0x1f84]
push eax
lea eax, [ebp - 0x7c]
push eax
call edi
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp - 0x7c]
push eax
call fcn.00452ebd
pop ecx
mov ecx, dword [ebp + 0x2784]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x2788
leave
ret
Function at 0x422839
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1f8c]
mov eax, 0x200c
call fcn.00467130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1f88], eax
push ebx
mov ebx, dword [ebp + 0x1f94]
push esi
push edi
mov esi, 0x800
push esi
xor edi, edi
lea eax, [ebp + 0x1788]
push edi
push eax
mov dword [ebp - 0x80], ebx
call fcn.004670a0
push esi
lea eax, [ebp + 0xf88]
push edi
push eax
call fcn.004670a0
push esi
lea eax, [ebp + 0x788]
push edi
push eax
call fcn.004670a0
push esi
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.004670a0
add esp, 0x30
push 0x8a
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
lea eax, [ebp + 0x1788]
push eax
call esi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x1788]
push eax
call fcn.00453537
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ecx
push 0x80
lea eax, [ebp + 0x1788]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp + 0x1788]
push eax
call ebx
push 0xb2
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0xf88]
push dword [ebp - 0x80]
push eax
call esi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0xf88]
push eax
call fcn.00453537
pop ecx
push 0x80
lea eax, [ebp + 0xf88]
push eax
call edi
lea eax, [ebp + 0xf88]
push eax
call ebx
mov ecx, dword [ebp + 0x1f88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x1f8c
leave
ret 4

Function at 0x422961
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 0x80], ecx
call fcn.004670a0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 1
push 2
lea eax, [ebp - 0x78]
push eax
push 0
call esi
mov ebx, 0x256
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x78]
push eax
push eax
call edi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call fcn.00422839
push 1
push 0x17
lea eax, [ebp - 0x78]
push eax
push 0
call esi
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
lea eax, [ebp - 0x78]
push eax
push eax
call edi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call fcn.00422839
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x78c
leave
ret
Function at 0x422a32
Capabilities:
Delete registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
push str.SOFTWARE360Safe
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
push str.SOFTWARE360softmgr
push edi
call esi
push 0x4a0a38
push edi
call esi
push 0x4908cc
lea ebx, [edi - 1]
push ebx
call esi
push 0x98
lea ecx, [ebp - 4]
call fcn.00421f25
push dword [eax]
push edi
call esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push edi
call esi
push str.SYSTEMCurrentControlSetServiceszhudongfangyu
push edi
call esi
push str.Software360down
push edi
call esi
push str.SoftwareLiveupdate360
push edi
call esi
push str.SOFTWARE360Privacy
push edi
call esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun360AutoDeamon
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x422ab9
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x178c]
mov eax, 0x180c
call fcn.00467130
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1788], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1794]
mov esi, 0x800
push esi
lea eax, [ebp + 0xf88]
push 0
push eax
mov dword [ebp - 0x80], edi
call fcn.004670a0
push esi
lea eax, [ebp + 0x788]
push 0
push eax
call fcn.004670a0
add esp, 0x18
push 0x8a
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
lea eax, [ebp + 0xf88]
push eax
call esi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0xf88]
push eax
call fcn.00453537
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ecx
push 0x80
lea eax, [ebp + 0xf88]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp + 0xf88]
push eax
call ebx
push 0xb2
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0x788]
push dword [ebp - 0x80]
push eax
call esi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp + 0x788]
push eax
call fcn.00453537
pop ecx
push 0x80
lea eax, [ebp + 0x788]
push eax
call edi
lea eax, [ebp + 0x788]
push eax
call ebx
push 0x255
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0xf88]
push dword [ebp - 0x80]
push eax
call esi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
push 0x800
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push 0x8a
lea ecx, [ebp - 0x7c]
call fcn.00421f25
push dword [eax]
lea eax, [ebp + 0xf88]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp - 0x78]
push eax
call fcn.00453537
pop ecx
push 0x80
lea eax, [ebp + 0xf88]
push eax
call edi
lea eax, [ebp + 0xf88]
push eax
call ebx
mov ecx, dword [ebp + 0x1788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x178c
leave
ret 4
Function at 0x422dda
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x487ba0
call fcn.004677c7
mov esi, ecx
push 0x98
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], esi
call fcn.00421f25
and dword [ebp - 4], 0
push 0x4c4f30
lea ecx, [ebp - 0x18]
call fcn.00401ce4
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0044d477
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x4910f8
push dword [ebp - 0x18]
lea eax, [ebp]
push eax
call ebx
mov esi, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.004673c7
pop ecx
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push str.DisplayIcon
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
push 0x4c4f30
lea ecx, [ebp - 0x14]
call fcn.00401ce4
push 0x96
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00402a5a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.DisplayName
push dword [ebp - 0x10]
push edi
call esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
call fcn.0044c718
push eax
lea ecx, [ebp - 0x14]
call fcn.00401d13
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.DisplayVersion
push dword [ebp - 0x10]
push edi
call esi
push 0x99
lea ecx, [ebp - 0x14]
call fcn.00402a5a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.Publisher
push dword [ebp - 0x10]
push edi
call esi
push 0x491994
push dword [ebp - 0x18]
lea eax, [ebp]
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp]
push eax
call fcn.004673c7
pop ecx
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push str.UninstallString
push dword [ebp - 0x1c]
push edi
call esi
push 0x9a
lea ecx, [ebp - 0x14]
call fcn.00402a5a
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.URLInfoAbout
push dword [ebp - 0x10]
push edi
call esi
push 0x4a11e8
push dword [ebp - 0x18]
lea eax, [ebp]
push eax
call ebx
mov ebx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.004673c7
pop ecx
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push str.InstallLocation
push ebx
push edi
call esi
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.EstimatedSize
push dword [ebp - 0x10]
mov dword [ebp - 0x20], 0x2fe8b
push edi
call esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret