joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b340
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
lea edx, [esp + 4]
push ecx
push edx
push str.path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
neg eax
sbb eax, eax
inc eax
pop ecx
ret

Function at 0x41b380
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48d526
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x208
mov ebx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push esi
push eax
mov dword [esp + 0x14], ebx
call fcn.004020b0
add esp, 8
push str.SDVersion.dll
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x444], esi
call sub.MFC42u.DLL_operator_2
mov esi, dword [esp + 0x440]
mov eax, dword [eax]
push esi
push eax
mov byte [esp + 0x440], bl
call fcn.0041d8e0
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete bl
mov byte [esp + 0x438], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x438], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test bl, bl
je 0x41b483
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x4b0698
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::operator_1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x228]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x4b0c44
push str.SOFTWARE360SD
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x228]
push eax
call sub.MFC42u.DLL_CString::operator_1
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x430
ret
Function at 0x41b4e0
Capabilities:
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496978
push 0x436550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x834
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov word [ebp - 0x818], si
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edi
push 0x4b2338
push 0x800
lea eax, [ebp - 0x818]
push eax
call fcn.0040b210
add esp, 0x10
push 5
push esi
lea ecx, [ebp - 0x818]
push ecx
push str.Explorer
push 0x4b99c0
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x41b576
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 0x81c], esi
lea edx, [ebp - 0x81c]
push edx
push 0x4971fc
push 0x15
push esi
push 0x4971ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41b687
mov eax, dword [ebp - 0x81c]
cmp eax, esi
je 0x41b661
mov dword [ebp - 0x830], esi
mov ecx, dword [eax]
lea edx, [ebp - 0x830]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [ebp - 0x830]
cmp eax, esi
je 0x41b5e5
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
mov eax, dword [ebp - 0x830]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x41b655
mov word [ebp - 0x82c], si
mov word [ebp - 0x840], 8
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x840]
push edx
push eax
call dword [ecx + 0xd0]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x838]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c680
Capabilities:
Create process on windows

Disassembly:
push 0x4bab50
call fcn.0041cc80
mov ecx, eax
call fcn.0041cd30
push 1
push 0
push 0
push str.http:__avc.360.cn_index.html_a6353
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
ret
Function at 0x41c730
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48d658
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push ecx
mov byte [esp + 0x1c], 1
call fcn.0041b380
add esp, 8
lea ecx, [esp]
push str.http:__sd.360.cn_uninstall_quiz.html_ver
call sub.MFC42u.DLL_CString::CString_2
lea edx, [esp + 4]
lea ecx, [esp]
push edx
mov byte [esp + 0x18], 2
call sub.MFC42u.DLL_CString::operator_2
mov eax, dword [esp]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x41c7c1
mov ecx, dword [esp]
push ecx
call fcn.0041b4e0
add esp, 4
lea ecx, [esp]
mov byte [esp + 0x14], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x41ca40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x48d6ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
push ebp
mov ebp, dword [esp + 0x27c]
push esi
push ebp
lea ecx, [esp + 0x14]
call fcn.00436032
xor esi, esi
push 0x4b00b4
lea ecx, [esp + 0x14]
mov dword [esp + 0x27c], esi
call fcn.0043606e
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x41cac7
lea ecx, [esp + 0x10]
mov dword [esp + 0x278], eax
call sub.MFC42u.DLL_CString::CString
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
add esp, 0x274
ret
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
mov dword [esp + 0x1c], esi
mov ebx, 1
lea edx, [esp + 0x54]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42u.DLL_CString::CString_2
push 0x4b00b0
lea eax, [esp + 0x28]
push ebp
push eax
mov byte [esp + 0x28c], bl
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x54]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x28c], 2
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x24]
mov byte [esp + 0x280], 4
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
push 0x4b0b70
push eax
call edi
add esp, 8
test eax, eax
je 0x41cbc0
mov ecx, dword [esp + 0x10]
push 0x4b0b7c
push ecx
call edi
add esp, 8
test eax, eax
je 0x41cbc0
test byte [esp + 0x28], 0x10
je 0x41cb6e
lea edx, [esp + 0x14]
push edx
call fcn.0041ca40
add esp, 4
test eax, eax
jne 0x41cbfd
jmp 0x41cbc0
mov esi, dword [sym.imp.MSVCRT.dll_wcsstr]
lea eax, [esp + 0x54]
push str..vir
push eax
call esi
add esp, 8
test eax, eax
jne 0x41cbfd
lea ecx, [esp + 0x54]
push 0x4b0708
push ecx
call esi
add esp, 8
test eax, eax
jne 0x41cbfd
lea edx, [esp + 0x54]
push str..bkup
push edx
call esi
add esp, 8
test eax, eax
jne 0x41cbfd
lea eax, [esp + 0x54]
push str..dat
push eax
call esi
add esp, 8
test eax, eax
jne 0x41cbfd
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0x280], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x280], 0
call sub.MFC42u.DLL_CString::CString
test esi, esi
jne 0x41cad8
jmp 0x41cc22
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x280], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x280], 0
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x18]
mov dword [esp + 0x280], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x278]
mov eax, dword [esp + 0x1c]
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x274
ret
Function at 0x41cd30
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
lea ecx, [esi + 4]
call sub.MFC42u.DLL_CString::operator
cmp dword [esi], 0
jne 0x41cd67
push 0
push 0
push esi
push 0x41cda0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4

Function at 0x41d390
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
xor edi, edi
push eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [esi], eax
je 0x41d45f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AVCacheCreate
push eax
call edi
mov ecx, dword [esi]
push str.AVCacheClose
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.AVCacheQuery
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.AVNetQuery
push eax
call edi
mov ecx, dword [esi]
push str.AVInsertWhite
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.AVDeleteWhite
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.AVNetQueryCancel
push eax
call edi
mov ecx, dword [esi]
push str.MisKillCreate
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.MisKillClose
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.MisKillJudgeWhite
push eax
call edi
mov ecx, dword [esi]
push str.MisKillJudgeWhiteOnlyFile
push ecx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x41d700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push esi
mov esi, dword [esp + 0x4c]
push esi
mov dword [esi], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41d7c3
push edi
mov ecx, 0xf
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x68], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x41d796
movsx eax, byte [esp + 8]
lea ecx, [esp + 0xa]
sub eax, 0x30
push ecx
mov dword [esi + 0x10], 2
mov dword [esi + 4], eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [esi + 8], eax
mov eax, 1
pop esi
add esp, 0x44
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov ecx, eax
mov dl, ah
and ecx, 0xff
mov eax, 4
and edx, 0xff
cmp eax, ecx
mov dword [esi + 4], ecx
sbb ecx, ecx
mov dword [esi + 8], edx
neg ecx
inc ecx
mov dword [esi + 0x10], ecx
mov eax, 1
pop esi
add esp, 0x44
ret

Function at 0x41d810
Capabilities:
Get file version info

Disassembly:
mov eax, 0x400c
call fcn.00436520
mov ax, word [0x4b99c0]
push esi
mov esi, dword [esp + 0x4014]
push edi
mov word [esp + 0x14], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push esi
stosw word es:[edi], ax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x41d8d4
cmp eax, 0x3fff
ja 0x41d8d4
lea edx, [esp + 0x14]
push edx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41d8d4
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x4b00b0
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41d8d4
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x401c]
pop edi
pop esi
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov word [edx], cx
mov edx, dword [esp + 0x4018]
mov cx, word [eax + 8]
mov word [edx], cx
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x401c]
shr ecx, 0x10
mov word [edx], cx
mov ecx, dword [esp + 0x4020]
mov ax, word [eax + 0xc]
mov word [ecx], ax
mov eax, 1
add esp, 0x400c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400c
ret
Function at 0x41d970
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push ebx
mov ebx, dword [esp + 0x238]
push esi
mov ecx, ebx
call sub.MFC42u.DLL_CString::Empty
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d9a1
pop esi
xor eax, eax
pop ebx
add esp, 0x22c
ret
push ebp
push edi
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22c
push eax
push esi
xor edi, edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41d9eb
mov ebp, dword [esp + 0x240]
cmp dword [esp + 0x18], ebp
je 0x41d9e7
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41d9d0
jmp 0x41d9eb
mov edi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
call fcn.0041da10
add esp, 8
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x22c
ret

Function at 0x41da10
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x21c]
push esi
mov ecx, ebx
call sub.MFC42u.DLL_CString::Empty
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x41daa7
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41daa7
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 4
push ecx
push esi
mov dword [esp + 0x20], 0
call sub.PSAPI.DLL_EnumProcessModules
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call sub.MFC42u.DLL_CString::operator_1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov edx, dword [ebx]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [edx - 8]
test ecx, ecx
setg al
add esp, 0x210
ret

Function at 0x41dac0
Capabilities:
Get process image filename

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push ebp
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
test ebp, ebp
je 0x41db63
push ebx
mov ebx, dword [esp + 0x218]
push esi
push edi
mov edi, dword [esp + 0x224]
push edi
push ebx
push 0
push ebp
call sub.PSAPI.DLL_GetModuleFileNameExW
mov esi, eax
test esi, esi
jne 0x41db4f
push edi
push ebx
push ebp
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov esi, eax
test esi, esi
je 0x41db4f
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
push ebx
stosw word es:[edi], ax
call fcn.0041db70
mov edx, dword [esp + 0x230]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x18
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x208
ret
xor eax, eax
pop ebp
add esp, 0x208
ret
Function at 0x41db70
Capabilities:
Get disk information

Disassembly:
sub esp, 0x3a0
push ebx
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x220]
push eax
push 0xc7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41dc90
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
mov dx, word [0x4b2ce0]
mov ebx, dword [esp + 0x3b4]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4b2cdc]
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
stosw word es:[edi], ax
mov dword [esp + 0x10], ecx
mov word [esp + 0x14], dx
lea edi, [esp + 0x220]
mov ax, word [edi]
lea ecx, [esp + 0x18]
push 0x104
lea edx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1c], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41dc3c
lea eax, [esp + 0x18]
push eax
call ebp
mov esi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov word [esp + esi*2 + 0x18], 0x5c
inc esi
push esi
push ecx
push ebx
mov word [esp + esi*2 + 0x24], 0
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x41dc5a
mov dx, word [edi]
add edi, 2
test dx, dx
je 0x41dc52
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41dc47
cmp word [edi], 0
je 0x41dc90
jmp 0x41dbef
mov eax, dword [esp + 0x3bc]
lea ecx, [ebx + esi*2]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x3bc]
push edx
push 0x4b0678
push eax
push ecx
call fcn.0040c490
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a0
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3a0
ret
Function at 0x41dcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48d766
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x290
push ebx
push ebp
mov ebp, dword [esp + 0x2a8]
push esi
push edi
push str.00000000000000000000000000000000
mov ecx, ebp
call sub.MFC42u.DLL_CString::operator_1
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
xor ebx, ebx
call fcn.0041de60
add esp, 8
push str.360verify.dll
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x2b4], edi
call sub.MFC42u.DLL_operator_2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2a8], 2
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x41ddbe
push str.GetCIDW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
cmp edx, edi
je 0x41ddb1
mov word [esp + 0x20], di
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push 0x40
push eax
call edx
test eax, eax
je 0x41ddb1
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebp
call sub.MFC42u.DLL_CString::operator_1
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
cmp ebx, edi
jne 0x41de2a
mov word [esp + 0xa0], di
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xa2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
lea eax, [esp + 0xa0]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x4b2d14
push str.SOFTWARE360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x200
mov dword [esp + 0x30], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41de2a
lea edx, [esp + 0xa0]
mov ecx, ebp
push edx
mov word [esp + 0xe4], ax
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2a0]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x29c
ret

Function at 0x41e3a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push esi
mov esi, dword [esp + 0x21c]
mov ecx, esi
call sub.MFC42u.DLL_CString::Empty
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x20019
push 0
push 0x496c48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e44d
push edi
mov ecx, 0x81
lea edi, [esp + 0x16]
mov word [esp + 0x14], ax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosw word es:[edi], ax
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x496cc8
push ecx
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x14]
mov ecx, esi
push edx
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi]
xor eax, eax
pop edi
pop esi
mov edx, dword [ecx - 8]
test edx, edx
setne al
add esp, 0x214
ret
xor eax, eax
pop esi
add esp, 0x214
ret
Function at 0x41e460
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x48d798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 4]
mov dword [esp + 0x14], 0
push eax
call fcn.0041e3a0
add esp, 4
test eax, eax
je 0x41e4ce
lea ecx, [esp + 4]
push str._safemon360tray.exe
lea edx, [esp + 0xc]
push ecx
push edx
call sub.MFC42u.DLL_operator_2
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x41e4ce
mov esi, 1
jmp 0x41e4d0
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41e500
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x48d7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 4]
mov dword [esp + 0x14], 0
push eax
call fcn.0041e3a0
add esp, 4
test eax, eax
je 0x41e56e
lea ecx, [esp + 4]
push str.360leakfixer.exe
lea edx, [esp + 0xc]
push ecx
push edx
call sub.MFC42u.DLL_operator_2
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x41e56e
mov esi, 1
jmp 0x41e570
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41e5a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], eax
call fcn.0041dca0
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
neg eax
sbb eax, eax
mov dword [esp + 0x18], ecx
and eax, str.runas
lea ecx, [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
push ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
xor esi, esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41e649
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x41e633
mov ecx, dword [esp + 0x40]
push eax
push ecx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x3c
ret
mov eax, esi
pop edi
pop esi
add esp, 0x3c
ret