joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f3f0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov eax, ecx
mov ecx, dword [0x530f98]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea esi, [ebp - 0x2a4]
mov ecx, esi
mov dword [ebp - 0x504], edx
push edx
push 3
push 0
push eax
call fcn.004441a0
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.004443f0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x43f441
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x43f5ad
lea ebx, [ebp - 0x4f4]
xor edi, edi
jmp 0x43f46a
mov edi, esi
test eax, eax
je 0x43f5af
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00444370
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x43f4cd
cmp byte [ebp + 8], 0
jne 0x43f4ad
mov ecx, ebx
call fcn.00444110
test al, al
je 0x43f4a7
mov ecx, ebx
call fcn.00444110
xor esi, esi
test al, al
je 0x43f530
jmp 0x43f568
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x43f4c5
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.00444110
test al, al
je 0x43f530
xor esi, esi
cmp byte [ebp + 8], 0
je 0x43f568
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.0043f3f0
add esp, 4
mov esi, eax
test eax, eax
jne 0x43f568
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x43f515
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x43f568
jmp 0x43f552
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x43f545
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x43f568
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00410600
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004443f0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00430500
mov ecx, ebx
call fcn.004304c0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x43f460
mov eax, dword [ebp - 0x4fc]
jmp 0x43f460
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.004304c0
lea ecx, [ebp - 0x2a4]
call fcn.00444300
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fc60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.004b8bc0
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x43fc95
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
jmp 0x43fca2
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret

Function at 0x43fce0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x43fd32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x43fd1c
call fcn.00432240
push dword [esi]
call fcn.00440cc0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43fd2b
mov dword [esi], ebx
call fcn.00432240
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x43fd49
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x43fe80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x43fea6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43fea8
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x43fec8
cmp byte [ebp + 0xc], 0
je 0x43ff11
cmp byte [esi + 4], 0
je 0x43ff03
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43ff05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x43fedc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43fede
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43fef5
xor ebx, ebx
jmp 0x43ff7f
cmp byte [esi + 4], 0
je 0x43ff3f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43ff41
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 4], 0
je 0x43ff1f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43ff21
mov eax, dword [esi]
push eax
call fcn.00450ec0
add esp, 4
mov ecx, dword [0x533494]
mov bl, 1
test ecx, ecx
je 0x43ff7f
push edi
push eax
call fcn.0044f4d0
jmp 0x43ff7f
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x43ff53
mov edi, dword [ebp - 0x14]
cmp byte [esi + 4], 0
je 0x43ff61
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x43ff63
mov eax, dword [esi]
push eax
call fcn.00450ec0
add esp, 4
mov ecx, dword [0x533494]
test ecx, ecx
je 0x43ff7d
push edi
push eax
call fcn.0044f4d0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x440760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4
Function at 0x440b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x530f98]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x440b98
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x440b98
cmp dword [ebp - 0x14], 4
jne 0x440b98
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x440bb0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004af8c0
mov eax, dword [ebp + 8]
mov edx, dword [0x530f98]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea edx, [ebp - 0x1018]
lea ebx, [ebp - 0x810]
lea esi, [ebp - 0x1014]
push edx
push ebx
push esi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x440c5d
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x440c25
mov esi, 0x3f4
cmp eax, 1
jne 0x440c5d
mov ecx, edi
push ebx
jmp 0x440c56
lea eax, [ebp - 0x1010]
push 0x400
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xffffffff
mov esi, 0xea
cmp eax, 0x3ff
ja 0x440c5d
mov ecx, edi
lea eax, [ebp - 0x1010]
push eax
call fcn.0042a05c
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x440c80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x530f98]
xor edx, ebp
mov dword [ebp - 8], edx
lea edx, [ebp + 0xc]
push 4
push edx
push 4
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x4413a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x533118]
test al, 1
je 0x441400
movzx eax, word [0x5330f4]
cmp eax, 0xc
ja case.0x4413cc.1
xor esi, esi
jmp dword [eax*4 + 0x4e9744]
mov esi, 2
jmp case.0x4413cc.0
mov esi, 4
jmp case.0x4413cc.0
mov esi, 1
jmp case.0x4413cc.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004af401
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
or eax, 1
mov dword [0x533118], eax
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x533114], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x533104], xmm1
movups xmmword [0x5330f4], xmm0
jmp 0x4413be
Function at 0x442290
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4422f4
lea eax, [ebp - 0x14]
push eax
push 0x4e99cc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4422f8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 0x18]
push 0
push 0
push 0x10
push eax
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
jmp 0x4422fa
xor esi, esi
jmp 0x442303
xor esi, esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 0x18
pop esi
pop ebp
ret

Function at 0x442320
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x420], eax
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test eax, eax
je 0x4423ac
lea ebx, [esp + 0x10]
push 0x410
push 0
push ebx
call fcn.004b8bc0
add esp, 0xc
push 0x208
push ebx
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
add eax, 0xffffffff
cmp eax, 0x206
ja 0x442414
cmp byte [ebp + 0x10], 0
je 0x4423cb
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, esi
push eax
call fcn.0042a05c
jmp 0x442414
call fcn.00442290
test eax, eax
je 0x44241b
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test eax, eax
jne 0x44236b
jmp 0x44241b
mov ecx, esi
push ebx
call fcn.0042a05c
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov ebx, esp
push ebx
push esi
call fcn.00441dc0
add esp, 8
test al, al
je 0x442402
mov ecx, esi
push ebx
call fcn.004299aa
cmp byte [esp + 0xb], 0
jns 0x442414
push dword [esp]
call fcn.004af3c6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x420]
xor ecx, ebp
call fcn.004af401
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00441a60
xor esi, esi
cmp eax, 1
jne 0x4424dd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x442484
mov esi, 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x4424dd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4424f1
mov dword [ebp - 0x14], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov ebx, dword [edi]
mov esi, 0xffffffff
jmp 0x4424b2
mov ebx, dword [ebx]
cmp ebx, edi
je 0x4424dd
cmp dword [ebx + 0x1c], 0
je 0x4424b0
movzx eax, word [ebx + 0x2c]
shr eax, 1
push eax
push dword [ebp + 8]
push dword [ebx + 0x30]
call fcn.004cc9b8
add esp, 0xc
test eax, eax
jne 0x4424b0
mov word [ebx + 0x38], 0xffff
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x443690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov ecx, dword [ebp + 8]
mov al, byte [ebp + 0x18]
mov dl, byte [ebp + 0x1c]
mov esi, dword [0x530f98]
xor esi, ebp
mov dword [esp + 0x30], esi
movzx esi, dl
movzx edx, al
push esi
call fcn.00443480
add esp, 4
mov ebx, eax
test al, al
jne 0x4438be
cmp byte [ebp + 0x20], 0
je 0x4438be
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
movzx eax, ax
cmp eax, 0x804
jne 0x44373a
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
lea esi, [esp + 0x10]
test eax, eax
je 0x443778
mov ecx, esi
push eax
call fcn.0042a05c
cmp byte [esp + 0x1b], 0
mov eax, esi
jns 0x443734
mov eax, dword [esp + 0x10]
lea edi, [esp + 4]
jmp 0x44377e
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
lea esi, [esp + 0x10]
test eax, eax
je 0x4437a6
mov ecx, esi
push eax
call fcn.0042a05c
cmp byte [esp + 0x1b], 0
mov eax, esi
jns 0x443772
mov eax, dword [esp + 0x10]
lea edi, [esp + 4]
jmp 0x4437ac
lea edi, [esp + 4]
mov eax, esi
lea ecx, [esp + 4]
push eax
push 0x4e9ab4
push ecx
call fcn.00439d30
add esp, 0xc
cmp byte [esp + 0x2b], 0
js 0x4437d7
mov word [esp + 0x20], 0
mov byte [esp + 0x2b], 0
jmp 0x443803
lea edi, [esp + 4]
mov eax, esi
lea ecx, [esp + 4]
push eax
push str._s_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
push ecx
call fcn.00439d30
add esp, 0xc
cmp byte [esp + 0x2b], 0
js 0x443831
mov word [esp + 0x20], 0
mov byte [esp + 0x2b], 0
jmp 0x44385d
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [esp + 0x2b], 0
jns 0x443803
push dword [esp + 0x20]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [edi + 8]
mov dword [esp + 0x28], eax
movsd xmm0, qword [edi]
movsd qword [esp + 0x20], xmm0
cmp byte [esi + 0xb], 0
jns 0x443826
push dword [esp + 0x10]
call fcn.004af3c6
add esp, 4
lea esi, [esp + 0x20]
mov eax, 0x4e3248
jmp 0x443889
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x24], 0
cmp byte [esp + 0x2b], 0
jns 0x44385d
push dword [esp + 0x20]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [edi + 8]
mov dword [esp + 0x28], eax
movsd xmm0, qword [edi]
movsd qword [esp + 0x20], xmm0
cmp byte [esi + 0xb], 0
jns 0x443880
push dword [esp + 0x10]
call fcn.004af3c6
add esp, 4
lea esi, [esp + 0x20]
mov eax, str.Tips
mov bh, byte [ebp + 0x14]
cmp byte [esi + 0xb], 0
jns 0x443898
mov ecx, dword [esp + 0x20]
jmp 0x44389c
lea ecx, [esp + 0x20]
push 0x40
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test bh, bh
jne 0x4438d6
cmp byte [esi + 0xb], 0
jns 0x4438be
push dword [esp + 0x20]
call fcn.004af3c6
add esp, 4
movzx esi, bl
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004af401
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call fcn.004c4b13
int3
Function at 0x4438e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
movzx esi, byte [ebp + 0x10]
movzx edx, al
push esi
call fcn.00443480
add esp, 4
test al, al
jne 0x443906
cmp byte [ebp + 0x14], 0
jne 0x44390e
movzx eax, al
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00443990
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor ecx, ecx
test esi, esi
mov edx, 0x4e32ec
mov edi, 0x4e3252
cmove edi, edx
mov edx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
mov ebx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan._Download_the_latest_version_
cmove ebx, edx
movzx eax, ax
setne cl
cmp eax, 0x804
cmove ebx, edi
mov eax, 0x4e3248
mov edx, str.Tips
cmove edx, eax
lea eax, [ecx*4 + 0x40]
push eax
push edx
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x44397c
cmp eax, 6
jne 0x44397c
push str.http:__............._
call fcn.00443ab0
add esp, 4
push 0
call fcn.004c4b13
int3

Function at 0x443990
Capabilities:
Check if file exists
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x420
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea esi, [ebp - 0x214]
push 0x208
push 0
push esi
call fcn.004b8bc0
add esp, 0xc
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x424], 0x208
lea edi, [ebp - 0x41c]
push 0x208
push 0
push edi
call fcn.004b8bc0
add esp, 0xc
push 0
push 0x26
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push str._sInternet_Exploreriexplore.exe
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443a45
lea eax, [ebp - 0x424]
lea ecx, [ebp - 0x420]
push eax
push esi
push ecx
push 0x4e3bae
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443a45
mov word [ebp - 0x214], 0
push esi
call fcn.004d03ae
add esp, 4
mov esi, 1
test eax, eax
jne 0x443a97
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x428]
push eax
push 0x4ec7b4
push 0x15
push 0
push 0x4ec7c4
call dword [sym.imp.ole32.dll_CoCreateInstance]
xor esi, esi
test eax, eax
js 0x443a97
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x443a97
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004af401
mov eax, esi
add esp, 0x420
pop esi
pop edi
pop ebp
ret
Function at 0x443ab0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov edi, dword [ebp + 8]
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x448], eax
xor esi, esi
test edi, edi
je 0x443ba6
cmp word [edi], 0
je 0x443ba6
lea esi, [esp + 0x240]
push 0x208
push 0
push esi
call fcn.004b8bc0
add esp, 0xc
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], 0x208
lea ebx, [esp + 0x38]
push 0x208
push 0
push ebx
call fcn.004b8bc0
add esp, 0xc
push 0
push 0x26
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
push str._sInternet_Exploreriexplore.exe
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443b7c
lea eax, [esp + 0x30]
lea ecx, [esp + 0x34]
push eax
push esi
push ecx
push 0x4e3bae
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x443b7c
mov word [esp + 0x240], 0
push esi
call fcn.004d03ae
add esp, 4
test eax, eax
je 0x443bbe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xa
push 0
push edi
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 1
mov ecx, dword [esp + 0x448]
xor ecx, ebp
call fcn.004af401
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x2c]
push eax
push 0x4ec7b4
push 0x15
push 0
push 0x4ec7c4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x443c6d
mov eax, dword [esp + 0x2c]
mov esi, 1
test eax, eax
je 0x443ba6
mov dword [esp + 0x14], 0
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x443c25
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov word [esp + 0x18], 0
mov word [esp], 8
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
mov ebx, esp
push edx
push edx
push edx
push edx
push ebx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x443ba6
xor esi, esi
jmp 0x443ba6
Function at 0x443c80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
call fcn.00443990
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor ecx, ecx
test esi, esi
mov edx, 0x4e32ec
mov edi, 0x4e3252
cmove edi, edx
mov edx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan.
mov ebx, str.Main_program_file_that_the_360Chrome_has_been_damaged__not_the_original_file.__r_nFor_your_safe__the_program_will_automatically_exit.__r_nSuggest_you_re_install__and_the_Trojan_scan._Download_the_latest_version_
cmove ebx, edx
movzx eax, ax
setne cl
cmp eax, 0x804
cmove ebx, edi
mov eax, 0x4e3248
mov edx, str.Tips
cmove edx, eax
or ecx, 0x40040
push ecx
push edx
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x443cf6
cmp eax, 1
jne 0x443cf6
push str.http:__............._
call fcn.00443ab0
add esp, 4
mov bl, byte [ebp + 0xc]
test edi, edi
je 0x443d10
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x443d19
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call fcn.004c4b13