joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a664
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43e27e
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
mov eax, dword [0x44d08c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebx, ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a6b0
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004055b8
pop ecx
test eax, eax
je 0x40a69c
push 0x10
xor esi, esi
lea eax, [esp + 0x18]
push esi
push eax
call fcn.004253c0
add esp, 0xc
push 0x40
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.004253c0
add esp, 0xc
push 5
pop eax
mov word [esp + 0x54], ax
mov eax, dword [0x451a2c]
mov ecx, 0x451a2c
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x78], esi
lea eax, [esp + 0x10]
cmp dword [ebp + 8], esi
je 0x40a729
push dword [ebp + 8]
push ebx
push str.__s___s
call fcn.00405984
add esp, 0xc
jmp 0x40a736
push ebx
push str.__s_
call fcn.00405984
pop ecx
pop ecx
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40a765
lea eax, [ebx - 0x10]
call fcn.004054cf
mov eax, esi
jmp 0x40a69e
mov eax, dword [ebp + 0xc]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40a77a
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
jmp 0x40a780
push dword [esp + 0x14]
call esi
push dword [esp + 0x18]
call esi
xor esi, esi
inc esi
jmp 0x40a756

Function at 0x40a8dc
Capabilities:
Check if file exists
Persist via app paths registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp + 0x188], eax
push 0x104
lea eax, [ebp - 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a989
push str.....360safe.exe
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40a989
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a989
push ebx
push esi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00425946
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x80]
push eax
push 1
push 0x4425b8
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x40a986
lea eax, [ebp - 0x80]
push eax
call fcn.00425946
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x80]
push eax
push 1
push str.Path
push ebx
push edi
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.00425271
add ebp, 0x18c
leave
ret
Function at 0x40a99e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
mov esi, 0x208
push esi
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4425b8
push str.CLSID87515F61_A66C_4319_A0E0_D416CB8059E3InprocServer32
push SysReAllocString
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x78], 0
je 0x40aa0e
lea eax, [ebp - 0x78]
push eax
call fcn.0040a78b
pop ecx
test al, al
jne 0x40aa4a
lea eax, [ebp - 0x78]
push eax
mov eax, str.Safelive.dll
call fcn.0040a54b
pop ecx
test eax, eax
je 0x40aa4a
lea eax, [ebp - 0x78]
push eax
call fcn.00405600
mov esi, eax
pop ecx
test esi, esi
je 0x40aa4a
push str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa43
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop esi
call fcn.00425271
add ebp, 0x194
leave
ret

Function at 0x40ab1a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
mov eax, str.360ver.dll
call fcn.0040a54b
pop ecx
test eax, eax
je 0x40ab65
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ab65
lea eax, [ebp - 0x210]
push eax
call fcn.004055b8
pop ecx
test eax, eax
jne 0x40abb3
lea eax, [ebp - 0x210]
push eax
mov eax, str.hipsver.dll
call fcn.0040a54b
pop ecx
test eax, eax
je 0x40ab9d
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ab9d
lea eax, [ebp - 0x210]
push eax
call fcn.004055b8
pop ecx
test eax, eax
jne 0x40abb3
lea eax, [ebp - 0x210]
push eax
mov edx, 0x4545b8
mov ecx, 0x104
call fcn.00405a76
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call fcn.004031c2
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push ebx
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.0040a592
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0xc
call fcn.00425271
leave
ret

Function at 0x40ad03
Capabilities:
Set registry value

Disassembly:
cmp dword [esp + 8], 0
jne 0x40ad0e
push 0x57
pop eax
ret
push dword [esp + 8]
call fcn.00425946
pop ecx
add eax, eax
push eax
push dword [esp + 0xc]
push 1
push str.links.dll
push dword [esp + 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret
Function at 0x40aea5
Capabilities:
Check if file exists

Disassembly:
push 0x220
mov eax, 0x43d926
call fcn.00429c87
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 4], edi
mov eax, dword [0x451a2c]
mov ecx, 0x451a2c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.00405984
mov ebx, dword [ebp - 0x224]
pop ecx
pop ecx
push 1
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x220]
call fcn.004045a3
test eax, eax
jne 0x40af80
push edi
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x22c]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x22c], 0x104
call fcn.004091a4
test eax, eax
jne 0x40af7e
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40af7e
mov eax, edi
push eax
push dword [ebp - 0x228]
call fcn.004031c2
lea eax, [ebx - 0x10]
call fcn.004054cf
cmp dword [ebp - 0x220], 0
je 0x40af79
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x40af9e
xor edi, edi
lea eax, [ebx - 0x10]
call fcn.004054cf
cmp dword [ebp - 0x220], edi
je 0x40af9c
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
call fcn.00429d0a
ret

Function at 0x40e33f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edi, edi
push edi
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 2
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x40e378
call fcn.00403bac
jmp 0x40e3b5
mov ecx, dword [ebp - 0xc]
push 4
pop edx
push edi
push ecx
push edi
push edi
push edx
push eax
mov dword [esi + 4], ecx
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
cmp eax, edi
jne 0x40e3b3
call fcn.00403bac
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
mov eax, ebx
jmp 0x40e3b5
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x40e53a
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
pop edi
test eax, eax
je 0x40e587
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 4]
jbe 0x40e587
sub eax, dword [ebp - 4]
cmp eax, 0x493e0
jl 0x40e587
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x24], 0x50
jg 0x40e587
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x40ee19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
call fcn.0040a32a
test eax, eax
je 0x40ee30
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
jne 0x40ee4b
push 0x4483cc
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], str.can_not_load_pdown.dll
call fcn.004297ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PPInit
push eax
call esi
push str.PPInit2
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.PPClose
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.PPSetConfig
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.PPGetConfig
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.PPDownload
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.PPStopTask
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.PPRestart
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.PPRemoveTask
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.PPStopSeed
push dword [edi]
mov dword [edi + 0x24], eax
call esi
push str.PPCloseHandle
push dword [edi]
mov dword [edi + 0x28], eax
call esi
push str.PPQueryTask
push dword [edi]
mov dword [edi + 0x2c], eax
call esi
push str.PPQueryTaskEx
push dword [edi]
mov dword [edi + 0x30], eax
call esi
push str.PPStartTask
push dword [edi]
mov dword [edi + 0x34], eax
call esi
push str.PPStartTaskEx
push dword [edi]
mov dword [edi + 0x38], eax
call esi
push str._GetTasks
push dword [edi]
mov dword [edi + 0x3c], eax
call esi
push str._StartRun
push dword [edi]
mov dword [edi + 0x44], eax
call esi
push str._StopRun
push dword [edi]
mov dword [edi + 0x48], eax
call esi
push str._Run
push dword [edi]
mov dword [edi + 0x4c], eax
call esi
push str._EnableP2P
push dword [edi]
mov dword [edi + 0x50], eax
call esi
mov dword [edi + 0x54], eax
push str._SetKeep
push dword [edi]
call esi
push str._SetKeepEx
push dword [edi]
mov dword [edi + 0x58], eax
call esi
push str._IsStopped
push dword [edi]
mov dword [edi + 0x5c], eax
call esi
push str._PPQueryTask2
push dword [edi]
mov dword [edi + 0x60], eax
call esi
push str.__PPSetModulePath2
push dword [edi]
mov dword [edi + 0x64], eax
call esi
push str.StartLan
push dword [edi]
mov dword [edi + 0x68], eax
call esi
push str.StopLan
push dword [edi]
mov dword [edi + 0x6c], eax
call esi
push str._PPQueryIPPort
push dword [edi]
mov dword [edi + 0x70], eax
call esi
push str._PPSetLocalLog
push dword [edi]
mov dword [edi + 0x74], eax
call esi
push str._P2SPUpdateRegInfo
push dword [edi]
mov dword [edi + 0x78], eax
call esi
push str._P2SPCheckProxy
push dword [edi]
mov dword [edi + 0x7c], eax
call esi
push str._P2SPCancelCheckProxy
push dword [edi]
mov dword [edi + 0x80], eax
call esi
push str._P2SPSetOption
push dword [edi]
mov dword [edi + 0x84], eax
call esi
push str.PPSetOption
push dword [edi]
mov dword [edi + 0x88], eax
call esi
mov dword [edi + 0x40], eax
mov eax, edi
pop esi
leave
ret
Function at 0x40f310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, ecx
jne 0x40f322
xor eax, eax
inc eax
leave
ret
push 0
lea edx, [ebp - 4]
push edx
sub eax, ecx
push eax
push ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f34a
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
cmp dword [ebp - 4], ecx
jne 0x40f34a
mov dword [esi + 4], eax
jmp 0x40f31d
mov eax, dword [esi]
mov dword [esi + 4], eax
xor eax, eax
leave
ret

Function at 0x40f92a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b0]
and dword [ebp - 0x78], 0
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push str.CrashDumpEnabled
mov ebx, str.SYSTEMCurrentControlSetControlCrashControl
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x7c], 0x410
mov dword [ebp - 0x80], 4
call esi
test eax, eax
jne 0x40f9ec
cmp dword [ebp - 0x78], 3
jne 0x40f9ec
and dword [ebp - 0x74], eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x74]
push eax
push str.MinidumpDir
push ebx
push edi
call esi
test eax, eax
jne 0x40f9ec
cmp dword [ebp - 0x74], 2
jne 0x40f9e7
push 0x40e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call fcn.004253c0
add esp, 0xc
push 0x410
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 0x70]
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x6c]
call fcn.0040570c
xor eax, eax
inc eax
jmp 0x40f9ee
xor eax, eax
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425271
add ebp, 0x3a8
leave
ret
Function at 0x40fa06
Capabilities:
Enumerate files on windows

Disassembly:
push 0x280
mov eax, 0x43ddba
call fcn.00429c87
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
xor esi, esi
call fcn.00409ada
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x268]
cmp dword [eax - 0xc], esi
jne 0x40fa45
add eax, 0xfffffff0
call fcn.004054cf
xor eax, eax
call fcn.00429d0a
ret
push 0x24c
lea eax, [ebp - 0x260]
push esi
push eax
mov dword [ebp - 0x264], esi
call fcn.004253c0
lea eax, [ebp - 0x26c]
push 0x443bec
push eax
lea ecx, [ebp - 0x268]
call fcn.00409bd2
mov eax, dword [eax]
add esp, 0x14
lea ecx, [ebp - 0x264]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.004054cf
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp edi, 0xffffffff
jne 0x40fabb
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.004054cf
mov eax, esi
jmp 0x40fa3f
lea eax, [ebp - 0x238]
push 0x443bfc
push eax
call fcn.0042617e
pop ecx
pop ecx
test eax, eax
je 0x40fb58
lea eax, [ebp - 0x238]
push 0x443c00
push eax
call fcn.0042617e
pop ecx
pop ecx
test eax, eax
je 0x40fb58
test byte [ebp - 0x264], 0x10
jne 0x40fb58
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..dmp
push eax
call fcn.00426398
pop ecx
pop ecx
test eax, eax
jne 0x40fb58
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [ebp - 0x276]
cmp ax, word [ebp - 0x286]
jne 0x40fb58
mov ax, word [ebp - 0x27a]
cmp ax, word [ebp - 0x28a]
jne 0x40fb58
mov ax, word [ebp - 0x27c]
cmp ax, word [ebp - 0x28c]
je 0x40fb70
lea eax, [ebp - 0x264]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40fabb
jmp 0x40fb73
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40faa9
Function at 0x410678
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
push 4
pop ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x78]
push ecx
add eax, 0x520
push eax
lea eax, [ebp - 0x7c]
push eax
push str.SafeTrayType
mov ebx, str.Software360Safe360Ent
push ebx
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
mov eax, dword [ebp - 0x80]
xor ecx, ecx
add eax, 0x520
inc ecx
cmp dword [eax], ecx
jne 0x410786
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x43c
push eax
lea eax, [ebp - 0x7c]
push eax
push str.SafeTrayTips
push ebx
push edi
mov dword [ebp - 0x78], 0xc8
mov dword [ebp - 0x7c], ecx
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.004253c0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.SafeTrayIcon
push ebx
push edi
mov dword [ebp - 0x78], 0x208
call esi
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410758
lea eax, [ebp - 0x74]
push eax
push 0x4549c8
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x10
push 0x10
push 0x10
push 1
lea eax, [ebp - 0x74]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, dword [ebp - 0x80]
add esi, 0x510
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x410784
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi], edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425271
add ebp, 0x198
leave
ret 4

Function at 0x410a76
Capabilities:
Check if file exists

Disassembly:
push 0x224
mov eax, 0x43e91b
call fcn.00429cbd
lea eax, [ebp - 0x220]
mov esi, ecx
push eax
xor ebx, ebx
mov eax, str.pdown.dll
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], ebx
call fcn.0040a54b
pop ecx
test eax, eax
je 0x410b6d
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410b6d
push 0x8c
mov dword [ebp - 4], ebx
call fcn.004254b1
mov edi, eax
pop ecx
mov dword [ebp - 0x228], edi
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x410aef
lea eax, [ebp - 0x220]
call fcn.0040ee19
jmp 0x410af1
xor eax, eax
mov byte [ebp - 4], bl
mov dword [esi + 0x54], eax
cmp eax, ebx
je 0x410b39
push 0xc367
lea eax, [ebp - 0x228]
push eax
call fcn.00409ada
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 8]
mov dword [ebp - 0x22c], 1
cmp eax, ebx
je 0x410b39
push ecx
push ebx
push ebx
call eax
add esp, 0xc
mov byte [ebp - 0x221], 1
cmp al, bl
jne 0x410b3f
mov byte [ebp - 0x221], bl
mov dword [ebp - 4], ebx
test byte [ebp - 0x22c], 1
je 0x410b59
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.004054cf
cmp byte [ebp - 0x221], bl
je 0x410b6d
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0x6c]
cmp eax, ebx
je 0x410b6d
call eax
call fcn.00429d19
ret
Function at 0x411677
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
pop eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x424]
push eax
push str.DrvTipCount
push str.SOFTWARE360Safe
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x41c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x411757
inc eax
cmp dword [ebp - 0x41c], eax
je 0x4116e6
cmp dword [ebp - 0x41c], 2
jne 0x411757
push str.AppRun_DrvTip
call fcn.0040ad9a
pop ecx
test eax, eax
je 0x411757
xor eax, eax
push 0x40e
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push esi
push eax
call fcn.004253c0
lea eax, [ebp - 0x418]
add esp, 0xc
push eax
mov eax, str.UtilsDrvTip360DrvTip.exe
call fcn.0040a54b
pop ecx
test eax, eax
je 0x41174a
lea eax, [ebp - 0x418]
push eax
call fcn.0040a78b
pop ecx
test al, al
je 0x41174a
push esi
push esi
lea ecx, [ebp - 0x418]
call fcn.0040a664
pop ecx
jmp 0x411756
push str.Utils360DrvTip.exe
xor esi, esi
call fcn.0040ad36
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00425271
leave
ret

Function at 0x4117b7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
push edi
mov eax, esi
call fcn.00411c8d
call fcn.0041b448
call fcn.0040576d
cmp dword [0x45332c], edi
mov ebx, 0x2d0
jl 0x41182f
add dword [0x45332c], 5
cmp dword [0x45332c], ebx
jl 0x41182f
or dword [0x45332c], 0xffffffff
call fcn.004058cf
test eax, eax
je 0x41182f
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x405921
push edi
push edi
call fcn.00425a61
add esp, 0x18
cmp eax, edi
je 0x41182f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x51c]
lea eax, [esi + 0x518]
inc dword [eax]
sub ecx, 0x14
mov eax, dword [eax]
je 0x411863
dec ecx
je 0x41185f
dec ecx
je 0x411858
dec ecx
jne 0x4118fd
cmp eax, 0x1680
jmp 0x411868
cmp eax, 0x870
jmp 0x411868
cmp eax, ebx
jmp 0x411868
cmp eax, 0xb4
jl 0x4118fd
push 1
lea ecx, [esi + 0x94c]
mov dword [esi + 0x51c], edi
call fcn.00415d5c
push edi
push str.Q360FWMainClass
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x41189f
push edi
push edi
push 0x592
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004253c0
add esp, 0xc
push 0xc3b5
lea eax, [ebp - 0x214]
push eax
call fcn.00409ada
mov edx, dword [eax]
lea ecx, [ebp - 0x210]
push ecx
mov eax, 0x104
call fcn.0040570c
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
call fcn.004054cf
xor ecx, ecx
lea edx, [ebp - 0x210]
inc ecx
call fcn.0040f7f0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00425271
leave
ret
Function at 0x41190b
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x44d08c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 6
pop ecx
mov dword [ebp - 0x21c], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x23c], ebx
lea edi, [ebp - 0x238]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x23c]
push ebx
push eax
mov dword [ebp - 0x218], ebx
call fcn.004253c0
add esp, 0xc
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x411a7c
push 4
push str.wscsvc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
jne 0x41198b
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x411a7c
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x220], eax
call esi
push edi
call esi
cmp dword [ebp - 0x220], ebx
je 0x411a7c
cmp dword [ebp - 0x238], 4
jne 0x411a7c
mov edi, dword [ebp - 0x21c]
xor esi, esi
inc esi
push 6
add edi, 0x2c
mov dword [ebp - 0x218], esi
call fcn.0041c203
call fcn.0041128f
test eax, eax
je 0x411a63
cmp dword [0x4551f0], 6
jb 0x411a17
mov edi, str.UnregWscOld
push edi
mov eax, esi
call fcn.00415c25
test eax, eax
je 0x411a17
push str.safemonWscControl.exe
mov esi, str._unregas
call fcn.0040ad36
pop ecx
push ebx
push edi
call fcn.00415e7f
lea eax, [ebp - 0x214]
push eax
mov eax, str.deepscanqutmload.dll
call fcn.0040a54b
pop ecx
test eax, eax
je 0x411a5c
lea eax, [ebp - 0x214]
push eax
call fcn.00405600
mov esi, eax
pop ecx
cmp esi, ebx
je 0x411a5c
push str.SetFixWDASList
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x411a55
push 1
call eax
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.safemonWscReg.exe
jmp 0x411a71
cmp dword [0x4551f0], 6
jb 0x411a7c
push str.safemonWscControl.exe
mov esi, str._regas:1_1
call fcn.0040ad36
pop ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425271
leave
ret 4