joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee50
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x47e4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
xor esi, esi
mov word [ebp - 0x20c], ax
call fcn.00446080
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push str.UninstallString
push str.Software360360se6UpdateClientState02E720BD_2B50_4404_947C_65DBE64F6970
push SysReAllocString
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x214], 0x103
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40ef09
xor edx, edx
cmp dx, word [ebp - 0x20c]
je 0x40ef09
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.......
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x4676d4
lea ecx, [ebp - 0x20c]
push ecx
call edi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop edi
lea eax, [esi + 1]
jne 0x40ef0b
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00445a92
mov esp, ebp
pop ebp
ret

Function at 0x40ef20
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x47e4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
xor esi, esi
mov word [ebp - 0x20c], ax
call fcn.00446080
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
push ecx
push str.UninstallString
push str.Software360ChromeUpdateClientState27D39816_7A3D_406c_9ABC_97FB55674016
push SysReAllocString
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x214], 0x103
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40efd9
xor edx, edx
cmp dx, word [ebp - 0x20c]
je 0x40efd9
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.......
lea eax, [ebp - 0x20c]
push eax
call edi
push str.360chrome.exe
lea ecx, [ebp - 0x20c]
push ecx
call edi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop edi
lea eax, [esi + 1]
jne 0x40efdb
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00445a92
mov esp, ebp
pop ebp
ret
Function at 0x40f070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x467908
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f0fc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea edx, [ecx + ecx]
push esi
lea ecx, [ebp - 0xc]
push ecx
push 0
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
push 0x47229c
push edx
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f0d5
sub eax, edx
sar eax, 1
je 0x40f0fe
cmp word [esi + eax*2 - 2], 0x5c
je 0x40f0fe
mov ecx, 0x5c
mov word [esi + eax*2], cx
inc eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40f960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461e70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47e4f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
push 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x40fa52
lea ecx, [ebp - 0x14]
push ecx
call fcn.004193c0
push str._safemonWdHPFileSafe.dll
push eax
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], 0
call fcn.0040f860
add esp, 0x10
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f9e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fa24
mov edi, dword [ebp - 0x10]
push edi
call fcn.0040f4a0
add esp, 4
test eax, eax
je 0x40fa24
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40fa24
push str.CreateHPCtrl
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40fa24
call eax
mov dword [esi + 4], eax
cmp dword [esi + 4], 0
je 0x40fa69
push 1
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], ebx
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x40fa52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x40fa88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413b00
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x413b8a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x413b77
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, 0x100
ja 0x413b67
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and edi, 0x27
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x413f10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461ec8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47e4f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413f57
and al, 0x10
xor cl, cl
cmp cl, al
sbb edx, edx
neg edx
jne 0x414018
push ebx
lea ecx, [ebp - 0x14]
call fcn.00413e30
mov esi, dword [ebp - 0x14]
mov eax, esi
mov dword [ebp - 4], 0
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413f70
sub eax, edx
sar eax, 1
cmp eax, 1
jle 0x413f93
cmp word [esi + eax*2 - 2], 0x5c
jne 0x413f93
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
push 0x5c
push esi
call fcn.00446d64
add esp, 8
push esi
test eax, eax
jne 0x413fc2
call fcn.004465a0
add esp, 4
mov eax, 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
mov word [eax], dx
call fcn.00413f10
mov edi, eax
add esp, 4
test edi, edi
je 0x413ff2
push esi
call fcn.004465a0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41400f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x413fd5
push esi
call fcn.004465a0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414f00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.00447c73
add esp, 0xc
pop ebp
ret 0xc

Function at 0x414f80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, 0x100
je 0x414f9f
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 0x10]
push eax
push esi
push edi
call fcn.00448839
add esp, 0xc
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x415730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x1108], eax
je 0x41575b
xor eax, eax
mov dword [esi + 0x10e4], 0x3f3
mov dword [esi + 0x10e8], eax
mov dword [esi + 0x10ec], eax
pop esi
ret
mov eax, dword [0x4807a4]
push ebx
push edi
cmp eax, 0xffffffff
je 0x41588d
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
xor ebx, ebx
cmp eax, ebx
je 0x415796
pop edi
mov dword [esi + 0x10e8], ebx
mov dword [esi + 0x10ec], ebx
pop ebx
mov dword [esi + 0x10e4], 0x3f4
xor eax, eax
pop esi
ret
mov eax, dword [0x4807a4]
cmp eax, 0xffffffff
je 0x41588f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x41588f
mov eax, dword [0x4807a4]
push eax
call edi
cmp eax, ebx
je 0x41588f
lea edi, [esi + 0x10cc]
xor eax, eax
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
cmp dword [esi + 0x10f0], ebx
jne 0x415887
cmp dword [esi + 0x110c], ebx
jne 0x4158ad
push str.Cabinet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
mov dword [esi + 0x110c], eax
call ebx
mov ecx, dword [esi + 0x110c]
push str.FDICopy
push ecx
mov dword [esi + 0x1110], eax
call ebx
mov edx, dword [esi + 0x110c]
push str.FDIIsCabinet
push edx
mov dword [esi + 0x1114], eax
call ebx
mov dword [esi + 0x1118], eax
mov eax, dword [esi + 0x110c]
push str.FDIDestroy
push eax
call ebx
xor ecx, ecx
mov dword [esi + 0x111c], eax
cmp dword [esi + 0x1110], ecx
je 0x415874
cmp dword [esi + 0x1114], ecx
je 0x415874
cmp dword [esi + 0x1118], ecx
je 0x415874
cmp eax, ecx
jne 0x4158ab
mov dword [esi + 0x110c], ecx
mov dword [edi + 0x18], 0x3e8
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
pop edi
pop ebx
xor eax, eax
pop esi
ret
xor ebx, ebx
pop edi
mov dword [esi + 0x10e4], ebx
mov dword [esi + 0x10ec], ebx
pop ebx
mov dword [esi + 0x10e8], 0xe
xor eax, eax
pop esi
ret
xor ebx, ebx
mov ecx, dword [esi + 0x1110]
push edi
push 1
push 0x415020
push fcn.00414ff0
push 0x4144a0
push 0x414fc0
push 0x415700
push 0x4139c0
push 0x4139b0
call ecx
add esp, 0x24
xor edx, edx
cmp eax, ebx
setne dl
pop edi
mov dword [esi + 0x10f0], eax
pop ebx
pop esi
mov eax, edx
ret
Function at 0x415f50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x47e4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x416023
test esi, esi
je 0x416023
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x80
jl 0x416023
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00446080
add esp, 0xc
lea ecx, [ebp - 0x404]
push ecx
push 0x200
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x416023
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x408]
push eax
push 0x471f8c
lea ecx, [ebp - 0x404]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x416023
push ebx
push 0
push esi
call fcn.00446080
mov eax, dword [ebp - 0x408]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push 0x469708
push esi
call fcn.00410210
add esp, 0x24
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445a92
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00445a92
mov esp, ebp
pop ebp
ret

Function at 0x4161f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push edi
xor edi, edi
xor ebx, ebx
test eax, eax
je 0x41626a
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x416241
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFile_Error__Code___d
call fcn.00426100
add esp, 8
pop esi
mov eax, edi
pop edi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41625e
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
test esi, esi
je 0x416269
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x4162e3
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x76
push edi
call ebx
push 8
mov esi, eax
push edi
imul esi, esi, 0x64
call ebx
mov ecx, eax
mov eax, esi
cdq
idiv ecx
push 0x58
push edi
mov esi, eax
call ebx
mov ecx, eax
imul ecx, ecx, 0x64
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
pop ebx
cmp esi, 0x64
je 0x416362
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push str.CONTROL_PANELDESKTOPWINDOWMETRICS
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416356
mov eax, 4
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.AppliedDPI
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x416340
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x416356
imul ecx, ecx, 0x64
mov eax, 0xaaaaaaab
mul ecx
mov esi, edx
shr esi, 6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4163a1
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea ecx, [ebp - 0x1c]
push ecx
push str.SeIncreaseQuotaPrivilege
push edi
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 4]
push edi
push edi
push edi
lea edx, [ebp - 0x20]
push edx
push edi
push eax
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov esi, eax
call ebx
cmp esi, edi
jne 0x41641a
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, edi
je 0x41641a
lea edx, [ebp - 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x41641a
push eax
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
jne 0x416423
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x416488
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 1
push 2
push 0
push 0x18b
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x416488
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x416483
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x416488
mov edi, 1
mov edx, dword [ebp - 8]
push edx
call ebx
mov eax, dword [ebp - 0xc]
push eax
call ebx
push esi
call ebx
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4168f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push edi
push esi
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416950
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.00446080
mov ecx, dword [ebp + 0xc]
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], 0x1040
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x416950
mov edi, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4170d0
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x47e4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x430], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
mov dword [ebp - 0x42c], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_5.exe
mov dword [ebp - 0x428], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
mov dword [ebp - 0x424], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se.exe
xor esi, esi
jmp 0x417120
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x420], 0x410
call fcn.00446080
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp + esi*4 - 0x430]
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0x472350
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4171c7
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4171c7
call fcn.0040f3c0
test eax, eax
je 0x4171c7
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
mov ecx, 0x47d4f8
mov dword [ebp - 0x418], 0xffffffff
call fcn.0043df10
test eax, eax
je 0x4171c7
mov eax, dword [ebp - 0x418]
cmp eax, 3
je 0x4171c7
cmp eax, 0xffffffff
jne 0x4171e3
inc esi
cmp esi, 4
jb 0x417120
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445a92
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x469858
lea edx, [ebp - 0x414]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00445a92
mov esp, ebp
pop ebp
ret
Function at 0x417220
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x47e4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x430], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
mov dword [ebp - 0x42c], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_5.exe
mov dword [ebp - 0x428], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
mov dword [ebp - 0x424], str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se.exe
xor esi, esi
jmp 0x417270
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x420], 0x410
call fcn.00446080
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp + esi*4 - 0x430]
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0x472350
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x417317
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417317
call fcn.0040f3c0
test eax, eax
je 0x417317
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
mov ecx, 0x47d4f8
mov dword [ebp - 0x418], 0xffffffff
call fcn.0043df10
test eax, eax
je 0x417317
mov eax, dword [ebp - 0x418]
cmp eax, 3
je 0x417317
cmp eax, 0xffffffff
jne 0x417333
inc esi
cmp esi, 4
jb 0x417270
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445a92
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00445a92
mov esp, ebp
pop ebp
ret

Function at 0x417630
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00447370
mov eax, dword [0x47e4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00446080
add esp, 0xc
push 0x4722d0
push 0x800
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00416b80
push esi
push 0x800
lea edx, [ebp - 0x1004]
push edx
call fcn.00416b80
push 0x4722d8
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00416b80
push esi
push 0x800
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00416b80
push 0x472304
push 0x800
lea edx, [ebp - 0x1004]
push edx
call fcn.00416b80
mov eax, dword [ebp + 8]
push eax
push 0x800
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00416b80
push 0x469a88
push 0x800
lea edx, [ebp - 0x1004]
push edx
call fcn.00416b80
push 0x14
push esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x417759
push 0xc8
push 0x472258
push 0x47c248
call fcn.004467aa
add esp, 0xc
test eax, eax
jne 0x417741
call fcn.004083c0
test eax, eax
je 0x417741
push 5
push 0
push 0
push 0x47c3e0
jmp 0x41774c
push 5
push 0
push 0
push 0x47c248
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0x10], 0
je 0x417766
push 0
call fcn.004493bc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00445a92
mov esp, ebp
pop ebp
ret