joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7021c0c0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x7021c0e3
call fcn.7021bd40
mov ecx, dword [edi + 0x10]
cmp ecx, 1
je 0x7021c103
xor eax, eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
push esi
push 1
lea esi, [edi + 0x14]
push 3
mov eax, 0x42c
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c130
mov eax, 0x42d
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c176
push 1
push 3
mov eax, 0x42f
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c159
mov eax, 0x437
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c176
push 1
push 3
mov eax, 0x4b0
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c29b
cmp dword [0x703593cc], 0
jne 0x7021c188
call fcn.70215a50
test eax, eax
je 0x7021c19e
cmp dword [0x7035903c], 5
jne 0x7021c19e
cmp dword [0x70359040], 2
je 0x7021c29b
call fcn.70215c90
test eax, eax
jne 0x7021c29b
call fcn.70215bc0
test eax, eax
jne 0x7021c29b
mov eax, 0x70359a38
call fcn.70227cf0
test eax, eax
jne 0x7021c1e6
mov eax, 0x70359a38
call fcn.70227d10
test eax, eax
jne 0x7021c1e6
mov eax, 0x70359a38
call fcn.70227d30
test eax, eax
je 0x7021c29b
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str...Utils360BuyTicket.exe
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c29b
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Config_newui_themesdefault360BuyTicket360BuyTicket_theme.ui
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c29b
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Config_newui_themesdefault_theme_360BuyTicket.xml
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
neg eax
sbb eax, eax
pop esi
neg eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x20c
ret
Function at 0x7021c2c0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x7021c2e3
call fcn.7021bd40
mov ecx, dword [edi + 0x10]
cmp ecx, 1
je 0x7021c303
xor eax, eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
push esi
push 1
lea esi, [edi + 0x14]
push 3
mov eax, 0x42c
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c330
mov eax, 0x42d
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c376
push 1
push 3
mov eax, 0x42f
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c359
mov eax, 0x437
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c376
push 1
push 3
mov eax, 0x4b0
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c537
cmp dword [0x703593cc], 0
jne 0x7021c388
call fcn.70215a50
test eax, eax
je 0x7021c39e
cmp dword [0x7035903c], 5
jne 0x7021c39e
cmp dword [0x70359040], 2
je 0x7021c537
call fcn.70215c90
test eax, eax
jne 0x7021c537
call fcn.70215bc0
test eax, eax
jne 0x7021c537
mov eax, 0x70359a38
call fcn.70227cf0
test eax, eax
jne 0x7021c3e6
mov eax, 0x70359a38
call fcn.70227d10
test eax, eax
jne 0x7021c3e6
mov eax, 0x70359a38
call fcn.70227d30
test eax, eax
je 0x7021c537
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str...Utils360BuyTicket.exe
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c537
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Utils360TicketUI.dll
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c537
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Utils360TicketBase.dll
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c537
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Utils360Ticket.ini
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c537
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Config_newui_themesdefault360TicketUI360TicketUI_theme.ui
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
test eax, eax
je 0x7021c537
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...Config_newui_themesdefault_theme_360Ticket.xml
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call edi
neg eax
sbb eax, eax
pop esi
neg eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x20c
ret
Function at 0x7021c550
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x20c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x7021c573
call fcn.7021bd40
mov ecx, dword [edi + 0x10]
cmp ecx, 1
je 0x7021c593
xor eax, eax
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
push esi
push 1
lea esi, [edi + 0x14]
push 3
mov eax, 0x413
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c5c0
mov eax, 0x419
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c62f
push 1
push 3
mov eax, 0x42b
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c5e9
mov eax, 0x42d
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c62f
push 1
push 3
mov eax, 0x42f
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c612
mov eax, 0x437
mov ecx, esi
call fcn.7021b740
test eax, eax
jne 0x7021c62f
push 1
push 3
mov eax, 0x4b0
mov ecx, 1
mov edx, esi
call fcn.7021b6d0
test eax, eax
je 0x7021c6ec
push 0
push 1
lea edx, [edi + 0x20]
mov eax, 0x65e
xor ecx, ecx
call fcn.7021b6d0
test eax, eax
je 0x7021c6ec
push 0
push 2
lea edx, [edi + 0x50]
mov eax, 0x4e7
xor ecx, ecx
call fcn.7021b6d0
test eax, eax
je 0x7021c6ec
push 0x208
lea edx, [esp + 0xc]
push 0
push edx
call fcn.702e95e0
add esp, 0xc
push str...360leakfixer.exe
push 0x70359d48
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x7021c6ec
call fcn.70215de0
test eax, eax
jne 0x7021c6ec
mov eax, 0x70359a38
call fcn.70227cf0
test eax, eax
jne 0x7021c6d0
mov eax, 0x70359a38
call fcn.70227d10
test eax, eax
jne 0x7021c6d0
mov eax, 0x70359a38
call fcn.70227d30
test eax, eax
je 0x7021c6ec
pop esi
mov eax, 1
pop edi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x20c
ret
Function at 0x7021c9a0
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
sub esp, 8
cmp dword [0x7035a004], 0
push ebx
push esi
push edi
jne 0x7021c9b8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
mov esi, ecx
push 1
add esi, 0x94
push esi
call edi
test eax, eax
je 0x7021c9dc
mov eax, dword [esi]
cmp eax, 1
jne 0x7021ca61
xor ecx, ecx
cmp ecx, 0x70359b40
je 0x7021ca54
push 0x70359b40
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x7021ca54
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.702b46c0
add esp, 4
test eax, eax
je 0x7021ca1b
mov ebx, 0x70359b40
mov eax, 0x70354e60
call fcn.702b7430
test eax, eax
jne 0x7021ca3e
lea edx, [esp + 0x10]
push edx
mov eax, 0x70359b40
call fcn.702da240
add esp, 4
test eax, eax
je 0x7021ca54
mov eax, dword [esp + 0x10]
test eax, eax
je 0x7021ca54
cmp eax, 1
je 0x7021ca54
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.___in_chromeie
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x7021ca5a
push 1
push 3
jmp 0x7021ca5e
push 1
push 2
push esi
call edi
mov eax, dword [esi]
xor ecx, ecx
cmp eax, 2
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
add esp, 8
ret
Function at 0x70220190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x702201a0
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x702201b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x702201e0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea edx, [esp + 0x20]
push edx
xor edi, edi
or eax, 0x2001f
push eax
push edi
push ebp
push ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, edi
jne 0x70220255
xor eax, eax
cmp ecx, edi
je 0x70220243
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], edi
mov esi, eax
mov dword [esp + 0x14], ecx
cmp eax, edi
je 0x70220263
cmp ecx, edi
je 0x70220300
push ecx
jmp 0x702202fa
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x28]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push edi
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x702202ce
jmp 0x70220290
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x18]
call fcn.702201e0
mov ebp, eax
cmp ebp, edi
jne 0x7022031d
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
push ecx
push edi
push edx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x70220290
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x702202e1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, dword [ebx]
push ebp
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x70220300
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.702e1c2f
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x7022032c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x70220302
Function at 0x70220820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x70310590
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov esi, dword [ebp + 0x414]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
jne 0x7022089f
call fcn.7020df50
mov esi, eax
jmp 0x70220980
mov eax, dword [ebp - 0x14]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x702208bb
call fcn.7020df50
jmp 0x70220977
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x702208d4
call fcn.7020df50
jmp 0x70220977
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x14], eax
cmp ecx, eax
jae 0x70220908
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x702208f6
lea eax, [ebp]
call fcn.70224950
lea esi, [ebp - 0x1c]
call fcn.70202690
mov eax, 0x8007000e
jmp 0x70220992
mov eax, ecx
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.70223d90
mov dword [ebp - 4], 1
jmp 0x70220931
mov ecx, dword [ebp]
cmp ecx, ebx
jne 0x7022093f
mov esi, 0x8007000e
jmp 0x70220979
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
push eax
push ecx
push eax
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x7022095c
call fcn.7020df50
jmp 0x70220977
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.70221620
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x70220990
lea eax, [ebp]
call fcn.70224950
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.702e1c2f
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x702236f0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [0x70359468]
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.702e95e0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x702237a3
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.702e4500
add esp, 8
test eax, eax
je 0x702237a3
inc eax
push 0x70328ed8
push eax
call fcn.702e4367
add esp, 8
test eax, eax
jne 0x702237a3
call fcn.702236a0
test al, al
jne 0x702237a3
push 4
call fcn.702e1f8d
add esp, 4
test eax, eax
je 0x702237a3
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x70223500
mov dword [eax], 0
push 0
mov dword [eax], esi
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x70359460], eax
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x10c
ret

Function at 0x702239c0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
xor edi, edi
call fcn.70223930
mov esi, eax
cmp esi, edi
je 0x70223a32
push str.chrome.exe
push esi
call fcn.702e3fa7
add esp, 8
test eax, eax
je 0x70223a32
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, edi
je 0x70223a32
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], edi
call fcn.702156d0
mov ecx, dword [esp + 0x14]
shr ecx, 0x10
add esp, 0xc
cmp ecx, 0x44
jb 0x70223a2b
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x10
ret
Function at 0x70223bb0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x420
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x703599ec]
push ebx
push esi
push edi
cmp eax, 2
je 0x70223d06
mov ecx, dword [0x703599ec]
cmp ecx, 3
je 0x70223d2e
mov edx, dword [0x703599ec]
cmp edx, 4
je 0x70223d2e
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
push 1
push 0x703599ec
call ebx
test eax, eax
jne 0x70223d2e
push 0x208
push eax
lea eax, [esp + 0x18]
push eax
call fcn.702e95e0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x21c]
push 0
push ecx
call fcn.702e95e0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.afe.dll
push 0x70359d48
lea edx, [esp + 0x18]
push edx
call esi
push str.afedata_
push 0x70359d48
lea eax, [esp + 0x220]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x10]
push ecx
call esi
test eax, eax
je 0x70223d23
lea edx, [esp + 0x218]
push edx
call esi
test eax, eax
je 0x70223d23
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x70223c9e
lea ecx, [esp + 0x10]
push ecx
jmp 0x70223cb0
lea eax, [esp + 0x10]
call fcn.702b4730
test eax, eax
je 0x70223cdc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x70223cdc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.init
push esi
call edi
push str.scan
push esi
mov dword [0x70359458], eax
call edi
mov dword [0x7035945c], eax
mov eax, dword [0x70359458]
test eax, eax
je 0x70223d23
cmp dword [0x7035945c], 0
je 0x70223d23
lea ecx, [esp + 0x218]
push ecx
call eax
add esp, 4
push 1
push 2
push 0x703599ec
call ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x420
ret
push 1
push 3
push 0x703599ec
call ebx
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x420
ret
Function at 0x702254d0
Capabilities:
Check os version
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7030ee0b
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x103
xor esi, esi
lea ecx, [ebp - 0x117]
push esi
push ecx
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 0x118], 0
call fcn.702e95e0
add esp, 0xc
mov dword [ebp - 0x1b8], esi
lea edx, [ebp - 0x1b0]
mov dword [ebp - 4], esi
push edx
mov dword [ebp - 0x1b0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x702255a1
cmp dword [ebp - 0x1ac], 6
push 1
lea eax, [ebp - 0x118]
jb 0x70225582
push 0x28
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x7022557b
lea esi, [ebp - 0x1b8]
call fcn.70202690
or eax, 0xffffffff
jmp 0x702256a4
push 0x70329080
jmp 0x70225591
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.360WDBrowserCrash
lea ecx, [ebp - 0x118]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x70359f90
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
inc eax
cdq
push 2
push edx
push eax
call fcn.702fbce0
mov ebx, eax
add eax, 0x80000000
adc edx, esi
mov dword [ebp - 0x1bc], edx
jne 0x7022564d
cmp eax, 0xffffffff
ja 0x7022564d
cmp ebx, 0x400
jg 0x702255fc
push ebx
call fcn.7020c9f0
add esp, 4
test al, al
je 0x702255fc
mov eax, ebx
call fcn.702e98d0
mov edi, esp
jmp 0x7022561d
or ecx, 0xffffffff
sub ecx, ebx
cmp ecx, 8
jb 0x70225643
lea eax, [ebx + 8]
push eax
call fcn.702e20da
add esp, 4
cmp eax, esi
je 0x7022564d
mov dword [eax], esi
mov esi, eax
lea edi, [eax + 8]
test edi, edi
je 0x7022564d
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push 0x70359f90
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, edi
jmp 0x7022564f
push 0x80070057
call fcn.702042c0
xor eax, eax
mov edi, dword [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x118]
push edx
push str._s_s.dmp
mov ecx, 0x104
call fcn.7021b4f0
add esp, 0xc
test eax, eax
jge 0x7022568d
test esi, esi
je 0x70225688
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.702e1dee
add esp, 4
test esi, esi
jne 0x70225677
or eax, 0xffffffff
jmp 0x702256a4
test esi, esi
je 0x702256a2
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.702e1dee
add esp, 4
test esi, esi
jne 0x70225691
xor eax, eax
lea esp, [ebp - 0x1d4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.702e1c2f
mov esp, ebp
pop ebp
ret
Function at 0x70227370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.WDSwitchiSuggMmg
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esp]
add esp, 0xc
ret

Function at 0x702275d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x70315ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], ax
lea edx, [esp + 0x10]
mov dword [esp + 0x38], esi
call fcn.70227500
mov ebx, dword [esp + 0x14]
mov edi, 8
cmp dword [esp + 0x28], edi
jae 0x70227636
lea ebx, [esp + 0x14]
cmp ebx, esi
je 0x70227673
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x70227673
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.702b46c0
add esp, 4
test eax, eax
je 0x70227666
mov eax, 0x70354e60
call fcn.702b7430
test eax, eax
jne 0x7022768a
push ebx
call fcn.702da5e0
add esp, 4
cmp eax, esi
jne 0x7022768a
cmp dword [esp + 0x28], edi
jb 0x70227686
mov ecx, dword [esp + 0x14]
push ecx
call fcn.702e1c24
add esp, 4
xor eax, eax
jmp 0x702276b9
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x70227698
lea eax, [esp + 0x14]
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp dword [esp + 0x28], edi
jb 0x702276b7
mov edx, dword [esp + 0x14]
push edx
call fcn.702e1c24
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x2c
ret