joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4052b0
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4691f0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x4e02cc], 1
jne 0x40530b
or dword [0x4e02cc], 1
mov dword [0x4e02d0], ebx
mov dword [0x4e02d4], ebx
mov dword [0x4e02d8], ebx
mov dword [0x4e02dc], ebx
mov esi, 0x4e02d0
call fcn.004410e0
call fcn.0040a5b0
test eax, eax
je 0x40534f
test byte [0x4e0008], 1
jne 0x405338
or dword [0x4e0008], 1
mov dword [0x4e000c], 0x4e0004
call fcn.0042cbd0
call fcn.00403820
cmp dword [eax + 4], ebx
je 0x40534f
add eax, 0x14
call fcn.00404ad0
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x54], ebx
call fcn.004090f0
test eax, eax
jne 0x4053a5
cmp dword [esp + 0x44], 8
jb 0x405387
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0044b6e3
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x48
ret
push 0x4743d0
lea ecx, [esp + 0x30]
lea esi, [esp + 0x14]
call fcn.00404d90
add esp, 4
push 0xc
push 0x474534
mov eax, esi
mov byte [esp + 0x5c], 1
call fcn.00405090
mov edi, dword [esp + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x4053e0
lea edi, [esp + 0x14]
push 0x4dfa00
call fcn.00403570
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x405432
cmp dword [esp + 0x28], esi
jae 0x4053fc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x28], esi
jb 0x405416
mov edx, dword [esp + 0x14]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
cmp dword [esp + 0x44], esi
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
jmp 0x405378
cmp dword [esp + 0x28], esi
jae 0x40543c
lea eax, [esp + 0x14]
push ebx
push ebx
push str.restart_service
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x405d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a3c7
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc], eax
mov dword [esi + 8], str.protectSvc
mov dword [esi + 0x14], ecx
mov eax, 7
xor ebp, ebp
xor edx, edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], ebp
mov word [esi + 0x1c], dx
mov dword [esp + 0x18], ebp
xor ecx, ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], ebp
mov word [esi + 0x38], cx
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], ebp
mov word [esi + 0x54], dx
mov dword [esi + 0x84], eax
xor eax, eax
mov dword [esi + 0x80], ebp
mov word [esi + 0x70], ax
mov byte [esp + 0x18], 3
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 8
mov dword [esi + 0x10], eax
call fcn.0044b9c0
mov edi, eax
add esp, 4
mov dword [esp + 0x24], edi
mov byte [esp + 0x18], 4
cmp edi, ebp
je 0x405df0
mov ecx, edi
mov dword [edi], ebp
mov dword [edi + 4], ebp
call fcn.00405ad0
jmp 0x405df2
xor edi, edi
mov byte [esp + 0x18], 3
push 8
mov dword [esi], edi
call fcn.0044b9c0
add esp, 4
cmp eax, ebp
je 0x405e12
mov dword [eax], vtable.UpdateControl.0
mov dword [eax + 4], ebp
jmp 0x405e14
xor eax, eax
mov edx, dword [esi]
mov dword [esi + 4], eax
mov dword [eax + 4], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 8
Function at 0x406450
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x264]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 1
push 0x80000000
push eax
mov dword [esp + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406589
lea edx, [esp + 0x14]
push edx
push esi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x14], ebp
jne 0x406582
cmp eax, ebp
je 0x406582
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
lea eax, [esp + 0x14]
push eax
push 0x40
lea ecx, [esp + 0x234]
push ecx
push esi
mov dword [esp + 0x24], ebp
call edi
test eax, eax
je 0x406582
mov edx, 0x5a4d
cmp word [esp + 0x228], dx
jne 0x406582
mov ecx, dword [esp + 0x264]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
mov dword [esp + 0x28], ebp
call ebx
cmp eax, 0xffffffff
je 0x406582
push ebp
lea edx, [esp + 0x14]
push edx
push 0xf8
lea eax, [esp + 0x34]
push eax
push esi
call edi
test eax, eax
je 0x406582
mov ecx, 0x8664
cmp word [esp + 0x2c], cx
jne 0x4065a4
mov eax, dword [esp + 0x264]
push ebp
lea edx, [esp + 0x28]
push edx
push eax
push esi
mov dword [esp + 0x34], ebp
call ebx
cmp eax, 0xffffffff
je 0x406582
push ebp
lea ecx, [esp + 0x14]
push ecx
push 0x108
lea edx, [esp + 0x12c]
push edx
push esi
call edi
test eax, eax
je 0x406582
mov eax, dword [esp + 0x1c8]
cmp eax, ebp
je 0x406582
mov edi, dword [esp + 0x1cc]
cmp edi, ebp
jne 0x4065ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x260
ret
mov eax, dword [esp + 0xc0]
cmp eax, ebp
je 0x406582
mov edi, dword [esp + 0xc4]
cmp edi, ebp
je 0x406582
lea ecx, [edi + eax]
cmp ecx, dword [esp + 0x1c]
ja 0x406582
cmp ecx, eax
jb 0x406582
push ebp
lea ecx, [esp + 0x1c]
push ecx
push eax
push esi
call ebx
cmp eax, 0xffffffff
je 0x406582
mov ebx, dword [esp + 0x20]
push edi
mov eax, ebx
call fcn.00407a90
mov edx, dword [ebx + 0x10]
sub edx, dword [ebx + 0xc]
jne 0x4065ef
call fcn.0044be90
mov eax, dword [ebx + 0xc]
push ebp
lea ecx, [esp + 0x14]
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x406583
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40658b
Function at 0x406620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4687dc
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x18]
push eax
mov dword [esi], vtable.SignInfoCollecter.0
call fcn.00424320
lea ecx, [esi + 0x30]
xor ebx, ebx
push ecx
mov dword [esp + 0x18], ebx
call fcn.00424320
lea edx, [esi + 0x48]
push edx
mov byte [esp + 0x18], 1
call fcn.00424320
lea eax, [esi + 0x60]
push eax
mov byte [esp + 0x18], 2
call fcn.00424320
lea ecx, [esi + 0x78]
push ecx
mov byte [esp + 0x18], 3
call fcn.00424320
mov dword [esi + 0xa4], ebx
mov eax, 0xf
mov dword [esi + 0xa8], eax
mov byte [esi + 0x94], bl
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xb0], bl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x408e70
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
push ebx
mov dword [esp + 0x14], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jne 0x408e9a
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push esi
call fcn.0044c68f
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x408eb4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x408ef5
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x4743d0
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x408ef5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x24]
mov eax, dword [eax + 0xc]
mov dword [edx], ecx
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov ebp, 1
push edi
call fcn.0044c4f7
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4091a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.0044e9d0
mov edx, dword [esp + 0x220]
add esp, 0xc
push 0
push edx
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x409202
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409210
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 8]
push ecx
call fcn.004018a0
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0044b6ee
add esp, 0x20c
ret

Function at 0x409320
Capabilities:
Create directory

Disassembly:
push esi
mov esi, eax
mov ecx, esi
call fcn.00409250
test eax, eax
jne 0x409332
xor eax, eax
pop esi
ret
push 0x12
push str.User_Data_tcdump_
mov eax, esi
call fcn.00405090
cmp dword [esi + 0x18], 8
jb 0x40934b
mov esi, dword [esi + 4]
jmp 0x40934e
add esi, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409368
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40932e
mov eax, 1
pop esi
ret
Function at 0x409a60
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x469f38
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, 7
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], ax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x74], ebx
call fcn.00409ef0
add esp, 4
test eax, eax
je 0x409b02
push 0xc
push str.360base.dll
lea eax, [esp + 0x18]
call fcn.00405090
mov eax, dword [esp + 0x14]
mov edi, 8
cmp dword [esp + 0x28], edi
jae 0x409adf
lea eax, [esp + 0x14]
call fcn.00445fb0
test eax, eax
jne 0x409b1d
cmp dword [esp + 0x28], edi
jb 0x409b16
mov eax, dword [esp + 0x14]
push eax
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x409c0a
cmp dword [esp + 0x28], 8
jb 0x409b16
mov edx, dword [esp + 0x14]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x409c0a
xor ecx, ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 1
call fcn.004090f0
test eax, eax
jne 0x409b7a
cmp dword [esp + 0x44], edi
jb 0x409b51
mov edx, dword [esp + 0x30]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
cmp dword [esp + 0x28], edi
jb 0x409b16
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x409c0a
push str.360Base.dll
lea ecx, [esp + 0x30]
lea esi, [esp + 0x4c]
call fcn.00404d90
add esp, 4
mov byte [esp + 0x70], 2
mov ecx, dword [esp + 0x4c]
cmp dword [esp + 0x60], edi
jae 0x409ba2
lea ecx, [esp + 0x4c]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x409bb0
lea eax, [esp + 0x14]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x409bdc
lea esi, [esp + 0x48]
call fcn.00402290
lea esi, [esp + 0x2c]
call fcn.00402290
lea esi, [esp + 0x10]
call fcn.00402290
xor eax, eax
jmp 0x409c0a
call section..text
call fcn.004096f0
lea esi, [esp + 0x48]
test eax, eax
je 0x409bc1
call fcn.00402290
lea esi, [esp + 0x2c]
call fcn.00402290
lea esi, [esp + 0x10]
call fcn.00402290
mov eax, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x64
ret
Function at 0x409c30
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x70
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x48
mov esi, ecx
mov dword [esp + 0x1c], eax
xor eax, eax
lea ecx, [esp + 0x34]
push ebp
push ecx
xor edi, edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.0044e9d0
add esp, 0xc
push ebp
push ebp
push 3
push ebp
push 1
push 0x80000000
mov eax, esi
call fcn.00402190
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409d2e
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x409d1a
cmp dword [esp + 0x14], ebp
jne 0x409d1a
push esi
call fcn.0044b6d8
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x409d1a
push ebp
lea eax, [esp + 0x20]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409d1a
push edi
mov eax, esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.00419570
mov ecx, dword [esp + 0x1c]
add esp, 4
lea esi, [esp + 0x20]
call fcn.00419610
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebp
je 0x409d2e
push edi
call fcn.0044c759
add esp, 4
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044b6ee
add esp, 0x70
ret

Function at 0x40a160
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, eax
push esi
call fcn.0040a010
add esp, 4
test eax, eax
jne 0x40a172
pop esi
ret
cmp dword [esi + 0x18], 8
jb 0x40a18a
mov esi, dword [esi + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
pop esi
ret
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
pop esi
ret
Function at 0x40a200
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24
push esi
push edi
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServices360bpsvc
push 0x80000002
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a281
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.LAST_DMP_TIME
push edi
mov dword [esp + 0x28], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a263
cmp dword [esp + 0x14], 0xb
je 0x40a289
push esi
call fcn.0040a1a0
add esp, 4
mov esi, eax
test edi, edi
je 0x40a279
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret
xor eax, eax
pop edi
pop esi
add esp, 0x24
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
mov dword [esi + 4], ecx
mov dword [esi], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0040a1a0
add esp, 4
test eax, eax
je 0x40a2d5
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x40a2d5
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esi + 4], edx
mov dword [esi], eax
test edi, edi
je 0x40a2e0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x24
ret

Function at 0x40a2f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServices360bpsvc
push 0x80000002
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a35d
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov esi, dword [esp + 8]
xor ecx, ecx
or ecx, eax
push 8
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push 0xb
xor edi, edi
push edi
push str.LAST_DMP_TIME
or edx, edi
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40a365
test esi, esi
je 0x40a35d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x40a370
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x40a380
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push ecx
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a3dc
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x1c]
push 0
push edx
push eax
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40a3e3
test esi, esi
je 0x40a3dc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 8
ret
test esi, esi
je 0x40a3ee
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x40a400
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServices360bpsvc
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a466
mov esi, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 8
lea eax, [esp + 0xc]
push eax
push 0xb
push 0
push 0x474ca0
push esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40a46d
test esi, esi
je 0x40a466
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
test esi, esi
je 0x40a478
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x40a490
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServices360bpsvc
push 0x80000002
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a502
mov edx, dword [esp + 0x10]
mov eax, dword [esp]
push esi
lea ecx, [esp + 8]
push ecx
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x474c98
push eax
mov esi, eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a4f0
cmp dword [esp + 0xc], 4
je 0x40a508
test esi, esi
je 0x40a4fb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
test esi, esi
je 0x40a513
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x40a520
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServices360bpsvc
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a58d
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x474ca0
push eax
mov esi, eax
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a582
cmp dword [esp + 0xc], 0xb
je 0x40a594
test esi, esi
je 0x40a58d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret
test esi, esi
je 0x40a59f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x40a8d0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push str.SYSTEMCurrentControlSet_services360bpsvc
push 0x80000002
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a91e
mov edx, dword [esp]
push 4
lea ecx, [esp + 8]
push ecx
push 4
push str.DelayedAutostart
push eax
push edx
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x40a930
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xe0
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
mov ebx, 1
mov esi, ecx
push ebx
push 0
mov ecx, str.Software360360se6Chrome
mov edi, 0x80000001
mov dword [esp + 0x1c], 0
call fcn.0040a800
add esp, 0xc
test eax, eax
je 0x40a98e
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.0044b6ee
add esp, 0xe0
ret
push 0xc8
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.0044e9d0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x47448c
push ecx
mov dword [esp + 0x2c], 0xc6
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a9ce
xor ebx, ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a9e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004018a0
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0xe0
ret

Function at 0x40ab10
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
push esi
add eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push 0
mov dword [edi], 0
mov ecx, dword [eax]
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ab7e
mov eax, dword [esp + 8]
cmp eax, 1
je 0x40ab4f
cmp eax, 2
jne 0x40ab6a
mov eax, dword [esp]
test esi, esi
je 0x40ab78
test eax, eax
je 0x40ab73
test al, 1
jne 0x40ab6a
mov edx, eax
shr edx, 1
cmp word [esi + edx*2 - 2], 0
je 0x40ab78
mov eax, 0xd
pop ecx
ret 4
xor ecx, ecx
mov word [esi], cx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 4