joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415df0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x46323b
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x824]
mov dword fs:[0], eax
mov edi, dword [esp + 0x838]
mov eax, dword [esp + 0x83c]
mov ebp, dword [esp + 0x834]
mov ebx, dword [esp + 0x840]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test edi, edi
je 0x415f3e
test ebx, ebx
je 0x415f3e
test ebp, ebp
je 0x415f3e
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x415f3e
call fcn.0042f500
mov esi, eax
test esi, esi
je 0x415f3e
cmp dword [esp + 0x848], 0
je 0x415ea1
push ebx
call dword [0x468398]
test eax, eax
je 0x415f3e
push ebx
call dword [0x4681ec]
push edi
call dword [0x4683a4]
test eax, eax
je 0x415f22
mov ecx, dword [0x47d064]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xc]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x830], 0
call fcn.0042fca0
push 0x800
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00449530
mov edx, dword [esp + 0x20]
add esp, 0xc
push edi
push edx
lea eax, [esp + 0x28]
push eax
call dword [0x46839c]
mov edx, dword [esp + 0x844]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x24]
lea edx, [esp + 0x2c]
push edx
push ebp
push esi
call eax
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.004155d0
mov eax, esi
jmp 0x415f40
mov edx, dword [esp + 0x844]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x24]
push edx
push ebx
push eax
push edi
push ebp
push esi
call ecx
mov esi, eax
jmp 0x415f40
xor eax, eax
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044951c
add esp, 0x81c
ret 0x18
Function at 0x416220
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4650fb
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x814]
mov dword fs:[0], eax
cmp dword [esp + 0x824], 0
mov edi, ecx
je 0x41626e
push 4
lea eax, [esp + 0x10]
push eax
jmp 0x41627f
cmp dword [esp + 0x828], 0
je 0x4162a3
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push str.360Preview
push str.Software360Safe_safemon
push 0x80000002
mov dword [esp + 0x24], 1
call dword [0x468368]
jmp 0x416349
push str.360Preview
push str.Software360Safe_safemon
push 0x80000002
call dword [0x468370]
mov ecx, dword [edi + 0xc]
test ecx, ecx
jne 0x4162c6
xor eax, eax
jmp 0x41634e
call fcn.0042f500
mov esi, eax
test esi, esi
je 0x4162bf
cmp dword [esp + 0x82c], 0
jne 0x416349
mov edx, dword [0x47d064]
mov dword [esp + 0xc], edx
mov ecx, dword [edi + 0xc]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x820], 0
call fcn.0042fca0
push 0x800
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.00449530
mov edx, dword [esp + 0x18]
add esp, 0xc
push str.utils360preview.exe
push edx
lea eax, [esp + 0x18]
push eax
call dword [0x46839c]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x20]
push 0
push 0
push 1
push 5
push str._start
lea edx, [esp + 0x24]
push edx
push esi
call eax
lea ecx, [esp + 0xc]
call fcn.004155d0
mov eax, 1
mov ecx, dword [esp + 0x814]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0044951c
add esp, 0x814
ret 0xc
Function at 0x416380
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4631fb
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x80c]
mov dword fs:[0], eax
mov eax, dword [0x47d064]
mov dword [esp + 4], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 4]
push edx
mov dword [esp + 0x818], 0
call fcn.0042fca0
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00449530
mov ecx, dword [esp + 0x10]
add esp, 0xc
push str.safemon360procmon.dll
push ecx
lea edx, [esp + 0x10]
push edx
call dword [0x46839c]
lea eax, [esp + 8]
push eax
call dword [0x468398]
test eax, eax
je 0x416436
lea ecx, [esp + 8]
push ecx
call fcn.004044e0
add esp, 4
test eax, eax
jne 0x416436
call fcn.004492d0
push eax
lea edx, [esp + 0xc]
push edx
call fcn.004492e0
add esp, 8
jmp 0x416445
lea eax, [esp + 8]
push eax
call dword [0x4681f4]
test eax, eax
jne 0x416476
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x416472
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x416472
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
xor eax, eax
jmp 0x4164ba
push str.InstallCall
push eax
call dword [0x4681dc]
test eax, eax
je 0x416488
call eax
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x4164b5
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x4164b5
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x80c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0044951c
add esp, 0x814
ret
Function at 0x416610
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4632db
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x1010]
mov dword fs:[0], eax
mov eax, dword [0x47d064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x101c], 0
call fcn.0042fca0
push 0x800
lea eax, [esp + 0x810]
push 0
push eax
call fcn.00449530
mov ecx, dword [esp + 0x14]
mov esi, dword [0x46839c]
add esp, 0xc
push 0x468ce8
push ecx
lea edx, [esp + 0x814]
push edx
call esi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00449530
add esp, 0xc
push str.SoftUpdate.dll
lea ecx, [esp + 0x810]
push ecx
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 0xc]
push eax
call dword [0x468398]
test eax, eax
je 0x4166fb
lea ecx, [esp + 0xc]
push ecx
call fcn.004044e0
add esp, 4
test eax, eax
jne 0x4166fb
call fcn.004492d0
push eax
lea edx, [esp + 0x10]
push edx
call fcn.004492e0
add esp, 8
jmp 0x416725
lea eax, [esp + 0xc]
push eax
call dword [0x4681f4]
mov esi, eax
test esi, esi
je 0x416725
push str.OnUninstall
push esi
call dword [0x4681dc]
test eax, eax
je 0x41671e
call eax
push esi
call dword [0x468294]
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x416752
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x416752
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov ecx, dword [esp + 0x1010]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.0044951c
add esp, 0x1014
ret
Function at 0x416780
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x46331b
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
mov eax, dword [0x47d064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x81c], 0
call fcn.0042fca0
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00449530
mov ecx, dword [esp + 0x14]
add esp, 0xc
push str.leakrepair.dll
push ecx
lea edx, [esp + 0x14]
push edx
call dword [0x46839c]
lea eax, [esp + 0xc]
push eax
call dword [0x468398]
test eax, eax
je 0x416837
lea ecx, [esp + 0xc]
push ecx
call fcn.004044e0
add esp, 4
test eax, eax
jne 0x416837
call fcn.004492d0
push eax
lea edx, [esp + 0x10]
push edx
call fcn.004492e0
add esp, 8
jmp 0x416861
lea eax, [esp + 0xc]
push eax
call dword [0x4681f4]
mov esi, eax
test esi, esi
je 0x416861
push str.OnUninstall
push esi
call dword [0x4681dc]
test eax, eax
je 0x41685a
call eax
push esi
call dword [0x468294]
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41688e
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x41688e
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0044951c
add esp, 0x814
ret
Function at 0x4169f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x46335b
mov eax, dword fs:[0]
push eax
mov eax, 0x1a10
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1a0c], eax
push esi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x1a18]
mov dword fs:[0], eax
mov eax, dword [0x47d064]
mov dword [esp + 8], eax
mov ecx, dword [ecx + 0xc]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x1a24], 0
call fcn.0042fca0
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00449530
mov ecx, dword [esp + 0x14]
mov esi, dword [0x46839c]
add esp, 0xc
push 0x468ce8
push ecx
lea edx, [esp + 0x14]
push edx
call esi
lea eax, [esp + 0xc]
push eax
call fcn.00431f40
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x181a]
push edx
mov word [esp + 0x181c], cx
call fcn.00449530
add esp, 0x10
push 1
push 0x26
lea eax, [esp + 0x1814]
push eax
push 0
call dword [0x468334]
push 0
lea ecx, [esp + 0x1810]
push str.SoftwareMgrAppsWeb
push ecx
call fcn.0041a5f0
push 0
lea edx, [esp + 0x181c]
push str.SoftwareMgrAppsGreen
push edx
call fcn.0041a5f0
push 0
lea eax, [esp + 0x1828]
push str.SoftwareMgrApps
push eax
call fcn.0041a5f0
push 0x800
lea ecx, [esp + 0x834]
push 0
push ecx
call fcn.00449530
push 0x800
lea edx, [esp + 0x1040]
push 0
push edx
call fcn.00449530
add esp, 0x3c
push 0x208
lea eax, [esp + 0x810]
push eax
call dword [0x4681f0]
push str.360SoftMgr.cpl
lea ecx, [esp + 0x810]
push ecx
lea edx, [esp + 0x1014]
push edx
call esi
lea eax, [esp + 0x100c]
push eax
call fcn.00431550
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
add esp, 4
cmp ecx, dword [0x47d060]
je 0x416b84
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x416b84
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov ecx, dword [esp + 0x1a18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1a0c]
xor ecx, esp
call fcn.0044951c
add esp, 0x1a1c
ret
Function at 0x4174f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4633d6
mov eax, dword fs:[0]
push eax
mov eax, 0x100c
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x1020]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xc], 0
jne 0x41753e
xor eax, eax
jmp 0x4176eb
push 0x800
lea eax, [esp + 0x820]
push 0
push eax
call fcn.00449530
add esp, 0xc
push 1
push 0x10
lea ecx, [esp + 0x824]
push ecx
push 0
call dword [0x468334]
push 0x800
lea edx, [esp + 0x20]
push 0
push edx
call fcn.00449530
add esp, 0xc
push 0x88
lea ecx, [esp + 0x18]
call fcn.00417490
mov eax, dword [eax]
mov ebx, dword [0x46839c]
push eax
lea eax, [esp + 0x820]
push eax
lea ecx, [esp + 0x24]
push ecx
call ebx
mov eax, dword [esp + 0x14]
mov ebp, dword [0x468284]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x4175d2
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4175d2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
push 0x8a
lea ecx, [esp + 0x18]
call fcn.00417490
mov esi, dword [esp + 0x1030]
mov eax, dword [eax]
push esi
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push str.360Safe.exe
push eax
mov ecx, edi
mov dword [esp + 0x1040], 0
call fcn.00415df0
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
mov dword [esp + 0x1028], 0xffffffff
cmp edx, dword [0x47d060]
je 0x41763f
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41763f
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
push 0x89
lea ecx, [esp + 0x18]
call fcn.00417490
mov eax, dword [eax]
push eax
lea eax, [esp + 0x820]
push eax
lea ecx, [esp + 0x24]
push ecx
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x417688
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x417688
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
push 0x8b
lea ecx, [esp + 0x1c]
call fcn.00417490
mov edx, dword [eax]
push esi
push 0
lea ecx, [esp + 0x24]
push ecx
push str._startdesktop
push str.SoftMgrSoftManager.exe
push edx
mov ecx, edi
mov dword [esp + 0x1040], 1
call fcn.00415df0
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x4176e6
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4176e6
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x1020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.0044951c
add esp, 0x1018
ret 4
Function at 0x417720
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x463426
mov eax, dword fs:[0]
push eax
mov eax, 0x200c
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x2008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x2020]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0xc], 0
jne 0x41776e
xor eax, eax
jmp 0x417960
push 0x800
lea eax, [esp + 0x1020]
push 0
push eax
call fcn.00449530
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x1024]
push ecx
push 0
call dword [0x468334]
push 0x800
lea edx, [esp + 0x20]
push 0
push edx
call fcn.00449530
mov esi, dword [0x46839c]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [esp + 0x1020]
push eax
lea ecx, [esp + 0x24]
push ecx
call esi
push 0x800
lea edx, [esp + 0x820]
push 0
push edx
call fcn.00449530
add esp, 0xc
push 0x88
lea ecx, [esp + 0x18]
call fcn.00417490
mov eax, dword [eax]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x824]
push ecx
call esi
mov eax, dword [esp + 0x14]
mov ebp, dword [0x468284]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x41782d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41782d
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
push 0x8a
lea ecx, [esp + 0x18]
call fcn.00417490
mov edi, dword [esp + 0x2030]
mov eax, dword [eax]
push edi
push 0
lea ecx, [esp + 0x824]
push ecx
push 0
push str.360Safe.exe
push eax
mov ecx, ebx
mov dword [esp + 0x2040], 0
call fcn.00415df0
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
mov dword [esp + 0x2028], 0xffffffff
cmp edx, dword [0x47d060]
je 0x41789d
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41789d
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
push 0x800
lea eax, [esp + 0x1820]
push 0
push eax
call fcn.00449530
add esp, 0xc
push 0x89
lea ecx, [esp + 0x18]
call fcn.00417490
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1824]
push edx
call esi
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x4178fd
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x4178fd
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
push 0x8b
lea ecx, [esp + 0x1c]
call fcn.00417490
mov eax, dword [eax]
push edi
push 0
lea edx, [esp + 0x1824]
push edx
push 0
push str.SoftMgrSoftManager.exe
push eax
mov ecx, ebx
mov dword [esp + 0x2040], 1
call fcn.00415df0
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41795b
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41795b
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x2020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.0044951c
add esp, 0x2018
ret 4
Function at 0x4181e0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x2008
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x2004], eax
push esi
push edi
push 0x800
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00449530
add esp, 0xc
push 1
push 0x1a
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [0x468334]
push 0x800
lea edx, [esp + 0x1010]
push 0
push edx
call fcn.00449530
mov esi, dword [0x46839c]
add esp, 0xc
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1014]
push ecx
call esi
push 0x800
lea edx, [esp + 0x810]
push 0
push edx
call fcn.00449530
add esp, 0xc
push 0x88
lea ecx, [esp + 0xc]
call fcn.00417490
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1010]
push ecx
lea edx, [esp + 0x814]
push edx
call esi
mov eax, dword [esp + 8]
mov edi, dword [0x468284]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x4182b9
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x4182b9
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
lea eax, [esp + 0x80c]
push eax
call fcn.00431550
push 0x800
lea ecx, [esp + 0x1814]
push 0
push ecx
call fcn.00449530
add esp, 0x10
push 0x89
lea ecx, [esp + 0xc]
call fcn.00417490
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1010]
push eax
lea ecx, [esp + 0x1814]
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [eax - 0xc]
cmp edx, dword [0x47d060]
je 0x418329
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x418329
mov eax, dword [esp + 8]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
lea ecx, [esp + 0x180c]
push ecx
call fcn.00431550
mov ecx, dword [esp + 0x2010]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.0044951c
add esp, 0x2008
ret
Function at 0x418350
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1808
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1804], eax
push ebx
push ebp
push esi
push edi
push 0x800
lea eax, [esp + 0x1018]
push 0
push eax
call fcn.00449530
push 0x800
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00449530
push 0x800
lea edx, [esp + 0x830]
push 0
push edx
call fcn.00449530
add esp, 0x24
push 1
push 2
lea eax, [esp + 0x101c]
push eax
push 0
call dword [0x468334]
push 0x8a
lea ecx, [esp + 0x14]
call fcn.00417490
mov ecx, dword [eax]
mov esi, dword [0x46839c]
push ecx
lea edx, [esp + 0x1018]
push edx
lea eax, [esp + 0x1c]
push eax
call esi
mov eax, dword [esp + 0x10]
mov ebp, dword [0x468284]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x418411
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x418411
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00431f40
mov edi, dword [0x4681c8]
add esp, 4
push 0x80
lea ecx, [esp + 0x18]
push ecx
call edi
mov ebx, dword [0x4681e8]
lea edx, [esp + 0x14]
push edx
call ebx
push 0xb2
lea ecx, [esp + 0x14]
call fcn.00417490
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1018]
push ecx
lea edx, [esp + 0x81c]
push edx
call esi
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x418489
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x418489
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
lea eax, [esp + 0x814]
push eax
call fcn.00431f40
add esp, 4
push 0x80
lea ecx, [esp + 0x818]
push ecx
call edi
lea edx, [esp + 0x814]
push edx
call ebx
mov ecx, dword [esp + 0x1814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044951c
add esp, 0x1808
ret
push esi
mov esi, ecx
call fcn.00417f60
mov ecx, esi
call fcn.004181e0
mov ecx, esi
pop esi
jmp 0x418350
Function at 0x4184d0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1808
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1804], eax
push ebx
push ebp
push esi
push edi
push 0x800
lea eax, [esp + 0x1018]
push 0
push eax
call fcn.00449530
push 0x800
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.00449530
push 0x800
lea edx, [esp + 0x830]
push 0
push edx
call fcn.00449530
add esp, 0x24
push 1
push 2
lea eax, [esp + 0x101c]
push eax
push 0
call dword [0x468334]
push 0x8a
lea ecx, [esp + 0x14]
call fcn.00417490
mov ecx, dword [eax]
mov esi, dword [0x46839c]
push ecx
lea edx, [esp + 0x1018]
push edx
lea eax, [esp + 0x1c]
push eax
call esi
mov eax, dword [esp + 0x10]
mov ebp, dword [0x468284]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x418411
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x418411
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00431f40
mov edi, dword [0x4681c8]
add esp, 4
push 0x80
lea ecx, [esp + 0x18]
push ecx
call edi
mov ebx, dword [0x4681e8]
lea edx, [esp + 0x14]
push edx
call ebx
push 0xb2
lea ecx, [esp + 0x14]
call fcn.00417490
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1018]
push ecx
lea edx, [esp + 0x81c]
push edx
call esi
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x418489
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x418489
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
lea eax, [esp + 0x814]
push eax
call fcn.00431f40
add esp, 4
push 0x80
lea ecx, [esp + 0x818]
push ecx
call edi
lea edx, [esp + 0x814]
push edx
call ebx
mov ecx, dword [esp + 0x1814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044951c
add esp, 0x1808
ret
push esi
mov esi, ecx
call fcn.00417f60
mov ecx, esi
call fcn.004181e0
mov ecx, esi
pop esi
jmp 0x418350

Function at 0x4184f0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
mov esi, dword [0x4683a8]
push str.SOFTWARE360Safe
push 0x80000002
call esi
push str.SOFTWARE360softmgr
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call esi
push str.Software360Safe
push 0x80000001
call esi
push 0x98
lea ecx, [esp + 8]
call fcn.00417490
mov eax, dword [eax]
push eax
push 0x80000002
call esi
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41856d
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x41856d
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsB69F34DD_F0F9_42DC_9EDD_957187DA688D
push 0x80000002
call esi
push str.SYSTEMCurrentControlSetServiceszhudongfangyu
push 0x80000002
call esi
push str.Software360down
push 0x80000002
call esi
push str.SoftwareLiveupdate360
push 0x80000002
call esi
push str.SOFTWARE360Privacy
push 0x80000002
call esi
pop esi
pop ecx
ret