joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a180
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x78
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, ebx
je 0x42a19f
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42a34b
push ebp
push edi
mov edi, dword [esi + 0xc]
mov ecx, dword [edi + 4]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x42a1bd
mov dword [edi + 8], eax
mov edi, dword [esi + 0xc]
mov eax, dword [edi + 4]
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x18], ebx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x42a1d9
mov dword [edi + 8], eax
push 0x493f1c
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x20]
push ecx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x54]
push eax
push ecx
push edx
call fcn.0042deb0
lea eax, [esp + 0x50]
push eax
call fcn.0042df20
add esp, 0x14
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_SubtractRect]
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x14]
sub ecx, dword [esp + 0x34]
sub eax, ebp
cmp dword [esp + 0x90], 5
je 0x42a27b
sub ecx, dword [esp + 0x10]
mov edi, eax
mov ebx, ecx
jmp 0x42a28f
cdq
sub eax, edx
mov edi, eax
mov eax, ecx
sub eax, dword [esp + 0x10]
sar edi, 1
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov ecx, dword [0x4a3644]
xor eax, eax
push 0x7f00
mov dword [esp + 0x68], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x88], eax
push eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x68], 3
mov dword [esp + 0x6c], 0x429ec0
mov dword [esp + 0x78], ecx
mov dword [esp + 0x8c], str.POPTIPS_CLASS
call dword [sym.imp.USER32.dll_LoadCursorW]
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 6
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [0x4a3644]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push esi
push eax
push 0
push 0
push ecx
push ebp
push ebx
push edi
push SysReAllocString
push 0
push edx
push 0x10088
call dword [sym.imp.USER32.dll_CreateWindowExW]
push esi
push 0x486954
push eax
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_SetPropW]
pop edi
pop ebp
mov eax, dword [esi + 4]
pop esi
pop ebx
add esp, 0x78
ret 8
Function at 0x42abb0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PtInRect]
mov esi, ecx
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esi + 0x20]
push edx
mov dword [esi + 0x58], 1
call edi
test eax, eax
je 0x42abe4
mov dword [0x4a3648], 1
jmp 0x42acad
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esi + 0x40]
push edx
call edi
test eax, eax
je 0x42ac25
push 2
mov dword [0x4a3648], 3
call fcn.00425ac0
mov ecx, eax
add ecx, 0x20
call fcn.00424a60
push eax
call fcn.00422530
mov ecx, eax
call fcn.004231a0
jmp 0x42acad
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esi + 0x30]
push edx
call edi
test eax, eax
je 0x42acc1
push 8
mov dword [0x4a3648], 2
call fcn.00425ac0
mov ecx, eax
add ecx, 0x20
call fcn.00424a60
push eax
push 9
call fcn.00425ac0
mov ecx, eax
add ecx, 0x20
call fcn.00424a60
push eax
push 0xc
call fcn.00425ac0
mov ecx, eax
add ecx, 0x20
call fcn.00424a60
push eax
push 0xb
call fcn.00425ac0
mov ecx, eax
add ecx, 0x20
call fcn.00424a60
push eax
push 3
call fcn.00425ac0
mov ecx, eax
add ecx, 0x20
call fcn.00424a60
push eax
call fcn.00422530
mov ecx, eax
call fcn.00423e50
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
ret 0xc
Function at 0x42afc0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x78
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
push edi
xor edi, edi
cmp eax, edi
je 0x42afdf
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42b1be
push ebp
push esi
mov esi, dword [ebx + 0xc]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], edi
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, edi
je 0x42affd
mov dword [esi + 8], eax
mov esi, dword [ebx + 0xc]
mov eax, dword [esi + 4]
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x18], edi
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, edi
je 0x42b019
mov dword [esi + 8], eax
push 0x493f1c
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x20]
push ecx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x54]
push eax
push ecx
push edx
call fcn.0042deb0
lea eax, [esp + 0x50]
push eax
call fcn.0042df20
add esp, 0x14
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_SubtractRect]
mov edx, dword [esp + 0x90]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
sub eax, dword [esp + 0x30]
sub ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x14]
dec edx
cmp edx, 4
ja case.0x42b0b2.3
jmp dword [edx*4 + 0x42b1cc]
xor esi, esi
jmp 0x42b0ed
sub eax, ebp
jmp 0x42b0eb
xor esi, esi
sub ecx, dword [esp + 0x10]
mov edi, ecx
jmp 0x42b0ed
sub eax, ebp
cdq
sub eax, edx
mov esi, eax
mov eax, ecx
sub eax, dword [esp + 0x10]
sar esi, 1
cdq
sub eax, edx
mov edi, eax
sar edi, 1
jmp 0x42b0ed
sub eax, ebp
sub ecx, dword [esp + 0x10]
mov edi, ecx
mov esi, eax
mov ecx, dword [0x4a3644]
xor eax, eax
push 0x7f00
mov dword [esp + 0x68], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x88], eax
push eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x68], 3
mov dword [esp + 0x6c], 0x42acd0
mov dword [esp + 0x78], ecx
mov dword [esp + 0x8c], str.POPTIPS_CLASS
call dword [sym.imp.USER32.dll_LoadCursorW]
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], 6
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [0x4a3644]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push ebx
push eax
push 0
push 0
push ecx
push ebp
push edi
push esi
push SysReAllocString
push 0
push edx
push 0x8010088
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
push 0x486954
push eax
mov dword [ebx + 4], eax
call dword [sym.imp.USER32.dll_SetPropW]
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebx + 4]
push 0
push eax
push 0x49644c65
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop esi
pop ebp
mov eax, dword [ebx + 4]
pop edi
pop ebx
add esp, 0x78
ret 8
Function at 0x42b6d0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push esi
mov esi, dword [esp + 0x220]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.00450880
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se6.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x103
call edi
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b78a
cmp word [esp + 0x14], 0
je 0x42b78a
lea edx, [esp + 0x14]
push edx
call ebp
test eax, eax
je 0x42b78a
lea eax, [esp + 0x14]
push eax
call fcn.0042e110
add esp, 4
test eax, eax
je 0x42b78a
mov ecx, dword [esp + 0x228]
dec ecx
push ecx
lea edx, [esp + 0x18]
push edx
push esi
call fcn.0045136f
add esp, 0xc
mov eax, 1
jmp 0x42b811
push 0x208
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00450880
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360se6
push SysReAllocString
mov dword [esp + 0x24], 0x103
call edi
test eax, eax
jne 0x42b80f
cmp word [esp + 0x14], ax
je 0x42b80f
mov edx, dword [esp + 0x228]
push str.360se.exe
lea ecx, [esp + 0x18]
push ecx
push 0x48c964
dec edx
push edx
push esi
call fcn.0044fdd8
add esp, 0x14
push esi
call ebp
test eax, eax
je 0x42b80a
push esi
call fcn.0042e110
add esp, 4
test eax, eax
jne 0x42b780
xor eax, eax
mov word [esi], ax
xor eax, eax
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0044f9f3
add esp, 0x214
ret 8

Function at 0x42b830
Capabilities:
Get common file path
Get program files directory

Disassembly:
xor eax, eax
cmp ax, word [0x4a3a88]
jne 0x42b86e
push esi
push edi
push eax
push 0x26
push 0x4a3a88
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, 0x4a3a88
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42b854
mov ecx, 0x10
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, 0x4a3a88
ret
Function at 0x42b880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0x110], eax
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x124]
push edi
lea edx, [esp + 8]
push edx
push 0x20019
push 0
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42b93b
mov edi, dword [esp + 8]
test edi, edi
je 0x42b93b
test esi, esi
jne 0x42b8e3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
jmp 0x42b93d
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.00450880
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push esi
push edi
mov dword [esp + 0x24], 0x104
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x42b93d
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
xor ecx, esp
call fcn.0044f9f3
add esp, 0x114
ret 0xc

Function at 0x42b990
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0x20c], eax
mov edx, dword [esp + 0x218]
push esi
mov esi, dword [esp + 0x218]
mov eax, dword [esi]
push edi
cmp eax, 1
jne 0x42ba34
lea eax, [esp + 8]
push eax
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x16]
push edx
mov edi, eax
mov word [esp + 0x18], cx
call fcn.00450880
add esp, 0xc
cmp dword [esp + 8], 0
je 0x42bae7
mov ecx, dword [edi]
push 0x104
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.0041db30
add esp, 0xc
test eax, eax
je 0x42bae7
lea edx, [esp + 0xc]
push edx
call fcn.0045224b
add esp, 4
cmp eax, 6
jl 0x42bae7
mov dword [esi], 2
jmp 0x42bae7
cmp eax, 0x1c
jne 0x42bae7
call fcn.0042b830
mov edi, eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00450880
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42bae7
push 0x104
lea edx, [esp + 0x10]
push edx
push edi
call fcn.0041db30
add esp, 0xc
test eax, eax
je 0x42bae7
mov ax, word [esp + 0xc]
mov ecx, 0x37
cmp cx, ax
jne 0x42ba97
mov dword [esi], 0x1d
jmp 0x42bae7
mov edx, 0x38
cmp dx, ax
jne 0x42baa9
mov dword [esi], 0x1e
jmp 0x42bae7
mov ecx, 0x39
cmp cx, ax
jne 0x42babb
mov dword [esi], 0x1f
jmp 0x42bae7
mov edx, 0x31
cmp dx, ax
jne 0x42bae7
mov ax, word [esp + 0xe]
mov ecx, 0x30
cmp cx, ax
jne 0x42badc
mov dword [esi], 0x20
jmp 0x42bae7
cmp dx, ax
jne 0x42bae7
mov dword [esi], 0x27
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0044f9f3
add esp, 0x210
ret 8
Function at 0x42bb00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [0x4a3c90]
push edi
xor edi, edi
mov dword [esp + 8], ecx
cmp eax, edi
jne 0x42bd20
push ebp
push esi
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x30], ax
call fcn.00450880
mov ebp, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x493f1c
push str.http_shellopencommand
push SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x208
mov dword [esp + 0x24], edi
call ebp
test eax, eax
jne 0x42bc1b
xor edx, edx
cmp dx, word [esp + 0x24]
je 0x42bc1b
push ebx
lea eax, [esp + 0x28]
push 0x5c
push eax
call fcn.004535e5
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x42bc1a
add ebx, 2
mov esi, 0x486b98
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42bbb6
sub eax, edx
sar eax, 1
push eax
push esi
push ebx
call fcn.004528a3
add esp, 0xc
test eax, eax
je 0x42bbe5
add esi, 0x414
inc edi
cmp esi, 0x48c964
jl 0x42bbb1
jmp 0x42bc1a
imul edi, edi, 0x414
mov ecx, dword [edi + 0x486fa8]
lea edx, [esp + 0x28]
push edx
mov dword [0x4a3c90], ecx
mov ecx, dword [esp + 0x18]
push 0x4a3c90
call fcn.0042b990
xor eax, eax
cmp dword [0x4a3c90], 2
sete al
mov dword [esp + 0x10], eax
pop ebx
call fcn.0042db30
test eax, eax
je 0x42bd19
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x236]
push edx
mov word [esp + 0x238], cx
call fcn.00450880
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x20]
push edx
push str.Progid
push str.SoftwareMicrosoftWindows_shellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], 0x103
call ebp
test eax, eax
jne 0x42bd19
cmp ax, word [esp + 0x22c]
je 0x42bd19
xor edi, edi
mov esi, str.360seURL
cmp word [esi], 0
je 0x42bcc8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42bca3
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x230]
push esi
push ecx
call fcn.004528a3
add esp, 0xc
test eax, eax
je 0x42bcd9
add esi, 0x414
inc edi
cmp esi, 0x48cb6c
jl 0x42bc98
jmp 0x42bd19
imul edi, edi, 0x414
cmp dword [esp + 0xc], 0
mov edi, dword [edi + 0x486fa8]
mov dword [0x4a3c90], edi
je 0x42bd03
cmp edi, 1
jne 0x42bd03
mov dword [0x4a3c90], 2
jmp 0x42bd19
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x22c]
push edx
push 0x4a3c90
call fcn.0042b990
mov eax, dword [0x4a3c90]
pop esi
pop ebp
mov ecx, dword [esp + 0x42c]
pop edi
xor ecx, esp
call fcn.0044f9f3
add esp, 0x42c
ret
Function at 0x42bd50
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x21c
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
mov esi, dword [esp + 0x228]
push edi
xor edi, edi
test esi, esi
jne 0x42bd7a
xor eax, eax
jmp 0x42bef5
mov eax, dword [esp + 0x228]
mov dword [esp + 8], 1
cmp eax, 6
jb 0x42bdb6
lea eax, [esp + 0x230]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0x48cd04
push str.Software360360se6chrome
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x42bef3
cmp eax, 5
jne 0x42bde3
lea edx, [esp + 0x230]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0x48cd04
push str.Software360360se5defaultmain
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x42bef3
cmp eax, 4
je 0x42be7d
cmp eax, 3
je 0x42be7d
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.00450880
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42bef3
push str.360se.ini
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42bef3
mov eax, dword [esp + 0x230]
lea edx, [esp + 0x14]
push edx
push eax
jmp 0x42bed8
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.00450880
add esp, 0xc
push 0
push 0x1a
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42bef3
push str.360SE360se.ini
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42bef3
mov ecx, dword [esp + 0x230]
lea eax, [esp + 0x14]
push eax
push ecx
push esi
push 0x493f1c
push 0x48cd04
push str.main
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, edi
mov ecx, dword [esp + 0x220]
pop edi
pop esi
xor ecx, esp
call fcn.0044f9f3
add esp, 0x21c
ret 0xc

Function at 0x42bf10
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
test eax, eax
jne 0x42bf1f
pop esi
ret 8
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
push 0x48cd04
push str.Software360Chromechrome
push SysReAllocString
mov dword [esp + 0x20], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42bf50
mov esi, 1
mov eax, esi
pop esi
ret 8
Function at 0x42bf60
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
je 0x42bff5
xor eax, eax
cmp ax, word [edx]
je 0x42bff5
mov eax, edx
push esi
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42bf80
mov ecx, dword [esp + 8]
sub eax, esi
sar eax, 1
add eax, eax
pop esi
cmp ecx, 1
jne 0x42bfb6
push eax
push edx
push ecx
push 0x48cd04
push str.Software360360se5defaultmain
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
ret
cmp ecx, 2
jne 0x42bfd7
push eax
push edx
push 1
push 0x48cd04
push str.Software360Chromechrome
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
ret
cmp ecx, 3
jne 0x42bff5
push eax
push edx
push 1
push 0x48cd04
push str.Software360360se6chrome
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
ret
Function at 0x42c000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x258
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x5a]
xor eax, eax
push esi
push ecx
mov word [esp + 0x60], ax
call fcn.00450880
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.registtime
push str.Software360safeCoop
mov ebx, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42c181
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x60]
push str._d:_d:_d
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
call fcn.00453fd6
add esp, 0x14
cmp dword [esp + 8], esi
jle 0x42c0a6
sub dword [esp + 8], ebx
push ebp
lea eax, [esp + 0x50]
push edi
push eax
call fcn.00451e09
lea ecx, [esp + 0x58]
push ecx
call fcn.00453e77
mov ecx, 0x1e
mov ebp, eax
mov eax, 0x1f
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor edi, edi
cmp ecx, eax
mov dword [esp + 0x28], 0x1d
jge 0x42c13d
xor edx, edx
cmp ecx, eax
jge 0x42c14d
mov ebx, eax
sub ebx, ecx
cmp ebx, 2
jl 0x42c12f
lea ebx, [eax - 1]
mov edi, edi
add edx, dword [esp + ecx*4 + 0x24]
add esi, dword [esp + ecx*4 + 0x28]
add ecx, 2
cmp ecx, ebx
jl 0x42c120
cmp ecx, eax
jge 0x42c137
mov edi, dword [esp + ecx*4 + 0x24]
add esi, edx
add edi, esi
jmp 0x42c14d
jle 0x42c14d
cmp eax, ecx
jge 0x42c14d
sub edi, dword [esp + eax*4 + 0x24]
add eax, ebx
cmp eax, ecx
jl 0x42c143
mov eax, dword [ebp + 0x14]
sub eax, dword [esp + 0x14]
add eax, 0x76c
imul eax, eax, 0x16d
add eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x18]
add eax, edi
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.0044f9f3
add esp, 0x258
ret
mov ecx, dword [esp + 0x25c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0044f9f3
add esp, 0x258
ret

Function at 0x42c1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
push str.PartnerName
push str.Software360safeCoop
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
lea eax, [esi + 1]
je 0x42c1d9
mov eax, esi
pop esi
pop ecx
ret 8