joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100417f3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x28], ebx
je 0x10041819
mov eax, dword [esi + 0x2c]
jmp 0x10041969
mov dword [esi + 0x28], 1
call fcn.1000febb
cmp dword [eax + 0x140], 2
jne 0x10041967
call fcn.1012998f
cmp dword [eax + 4], ebx
jne 0x10041967
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._bapi.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10114081
mov dword [esi + 0x24], eax
pop ecx
test eax, eax
je 0x10041811
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DriverVersion
push eax
mov dword [ebp - 0x210], ebx
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x100418bc
lea ecx, [ebp - 0x210]
push ecx
call eax
push str.BapiCreateToolhelp32Snapshot
push dword [esi + 0x24]
call edi
push str.BapiProcess32First
push dword [esi + 0x24]
mov dword [esi + 4], eax
call edi
push str.BapiProcess32Next
push dword [esi + 0x24]
mov dword [esi + 8], eax
call edi
push str.BapiModule32First
push dword [esi + 0x24]
mov dword [esi + 0xc], eax
call edi
push str.BapiModule32Next
push dword [esi + 0x24]
mov dword [esi + 0x10], eax
call edi
push str.BapiDriver32First
push dword [esi + 0x24]
mov dword [esi + 0x14], eax
call edi
push str.BapiDriver32Next
push dword [esi + 0x24]
mov dword [esi + 0x1c], eax
call edi
cmp dword [ebp - 0x210], 0x10001042
mov dword [esi + 0x18], eax
pop edi
jb 0x1004194d
cmp dword [esi + 4], ebx
je 0x1004194d
cmp dword [esi + 8], ebx
je 0x1004194d
cmp dword [esi + 0xc], ebx
je 0x1004194d
cmp dword [esi + 0x10], ebx
je 0x1004194d
cmp dword [esi + 0x14], ebx
je 0x1004194d
cmp dword [esi + 0x1c], ebx
je 0x1004194d
test eax, eax
je 0x1004194d
mov dword [esi + 0x2c], 1
cmp dword [esi + 0x2c], ebx
jne 0x10041811
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x24], ebx
jmp 0x10041811
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret
Function at 0x1004197b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push edi
push 0
push eax
mov dword [esi], vtable.CBootInIWriteWorker.0
call fcn.1012db70
and dword [esi + 4], 0
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x210], edi
xor edi, edi
inc edi
mov dword [ebp - 0x214], edi
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
cmp word [ebp - 0x20c], 0
je 0x10041a14
push str.0804
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jmp 0x10041a22
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, 0x804
cmp ax, cx
jne 0x10041a27
mov dword [esi + 4], edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret

Function at 0x10041a60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xe
call fcn.10010082
pop ecx
test eax, eax
je 0x10041a72
pop ebp
jmp eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x10041a79
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
push 0x208
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.1012db70
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
mov dword [esi], ebx
lea eax, [ebp - 0x414]
mov ecx, edi
push 0x208
push eax
call fcn.10041f82
test eax, eax
je 0x10041b3c
push 0x208
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10042160
test eax, eax
je 0x10041b3c
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x10041b10
xor eax, eax
inc eax
mov dword [esi], eax
jmp 0x10041b3e
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.10042097
test eax, eax
je 0x10041b3c
mov eax, dword [ebp - 0x418]
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x10041b3e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 4
Function at 0x10041bbf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov ebx, 0x208
mov esi, ecx
push ebx
push 0
and dword [edi], 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push ebx
push eax
call fcn.10042160
test eax, eax
je 0x10041c61
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x10041c5a
push ebx
push ebx
push 0x1018d75c
call fcn.1005869a
add esp, 0xc
test eax, eax
je 0x10041c5a
cmp eax, 1
jne 0x10041c61
cmp dword [esi + 4], ebx
jne 0x10041c55
push ebx
push ebx
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
call fcn.1005869a
add esp, 0xc
test eax, eax
je 0x10041c5a
xor eax, eax
inc eax
jmp 0x10041c63
xor eax, eax
inc eax
mov dword [edi], eax
jmp 0x10041c63
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 4

Function at 0x10041c74
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.1012db70
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, edi
push ebx
push eax
call fcn.10042160
test eax, eax
je 0x10041d7e
lea eax, [ebp - 0x20c]
push eax
call fcn.10010313
test eax, eax
je 0x10041d7a
mov ecx, edi
call fcn.1004228a
push 4
pop eax
push esi
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], esi
push eax
lea eax, [ebp - 0x418]
push eax
push str.Current
push str.SYSTEMSelect
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
test eax, eax
jne 0x10041d7e
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push esi
push str.LastKnownGood
push str.Service
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x414]
push eax
call fcn.10136ce4
pop ecx
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x41c], eax
jne 0x10041d6e
inc esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1000f894
mov eax, esi
jmp 0x10041d80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret
Function at 0x10041df3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.1012db70
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, edi
push ebx
push eax
call fcn.10042160
test eax, eax
je 0x10041f1e
lea eax, [ebp - 0x20c]
push eax
call fcn.10010313
test eax, eax
je 0x10041f1a
push 0x1018d75c
call fcn.10057f32
pop ecx
cmp dword [edi + 4], esi
jne 0x10041e77
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
call fcn.10057f32
pop ecx
push 0x1018d948
call fcn.10057f32
pop ecx
push 4
pop eax
push esi
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], esi
push eax
lea eax, [ebp - 0x418]
push eax
push str.Current
push str.SYSTEMSelect
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
test eax, eax
jne 0x10041f1e
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push esi
push str.LastKnownGood
push str.Service
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x414]
push eax
call fcn.10136ce4
pop ecx
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x41c], eax
jne 0x10041f0e
xor esi, esi
inc esi
lea eax, [ebp - 0x20c]
push eax
call fcn.1000f894
mov eax, esi
jmp 0x10041f20
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret

Function at 0x10041f2f
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x2a
call fcn.10010082
mov esi, dword [ebp + 0xc]
pop ecx
push 0
push esi
push dword [ebp + 8]
test eax, eax
je 0x10041f4c
call eax
jmp 0x10041f52
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10041f7b
push 0xc
call fcn.10010082
pop ecx
push 0x80
push esi
test eax, eax
je 0x10041f6c
call eax
jmp 0x10041f72
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10041f7b
xor eax, eax
inc eax
jmp 0x10041f7d
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x10041f82
Capabilities:
Manipulate boot configuration

Disassembly:
push 0xa24
mov eax, 0x10157398
call fcn.1012b6ae
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
push esi
push eax
call fcn.1012db70
add esp, 0xc
test ebx, ebx
jne 0x10041fb6
xor eax, eax
jmp 0x1004208f
push 0x43
pop edi
push edi
push str._c:_boot.ini
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.10015ce6
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call fcn.10010313
test eax, eax
jne 0x10041feb
inc edi
cmp edi, 0x5a
jle 0x10041fb9
jmp 0x10041faf
lea ecx, [ebp - 0xa30]
call fcn.1011ef02
mov dword [ebp - 4], esi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa30]
call fcn.1011f0e8
test eax, eax
je 0x1004207e
mov edi, 0x800
lea eax, [ebp - 0xa18]
push edi
push esi
push eax
call fcn.1012db70
add esp, 0xc
jmp 0x10042052
push str._boot_loader_
call fcn.10130fe5
pop ecx
push eax
push str._boot_loader_
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x1004206b
xor eax, eax
mov word [ebp - 0xa18], ax
push edi
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xa30]
call fcn.1007bc9e
test eax, eax
jne 0x10042027
jmp 0x1004207e
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.100100b8
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.1011ef42
mov eax, esi
call fcn.1012b658
ret 8

Function at 0x100421d5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x824]
push edi
mov edi, 0x410
push edi
push 0
push eax
call fcn.1012db70
push edi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x824]
mov edi, 0x208
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
ja 0x10042278
test eax, eax
je 0x10042278
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1018da90
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10042278
push str..ini
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test eax, eax
je 0x10042278
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
push esi
call fcn.100100b8
xor eax, eax
inc eax
jmp 0x1004227a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret 8
Function at 0x100425ab
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, 0x208
xor ebx, ebx
push edi
push ebx
push eax
call fcn.1012db70
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x20c]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x102
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x414]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [ebp - 0x414]
push eax
call fcn.10130fe5
mov dword [esp], str.partition_
push esi
lea ebx, [ebp + eax*2 - 0x416]
call fcn.101160fa
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100426a7
mov cx, word [ebx]
lea eax, [ebp - 0x20c]
add edi, 0x14
push 0x104
push eax
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, 0x101811bc
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.101160fa
push ebx
push edi
mov esi, eax
call fcn.101160fa
add esp, 0x10
mov edi, eax
test esi, esi
je 0x100426a2
test edi, edi
je 0x100426a2
push esi
push esi
call fcn.10130fe5
pop ecx
inc eax
push eax
push edi
call fcn.10019f19
xor eax, eax
inc eax
jmp 0x100426a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 8

Function at 0x10042bbd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x20c]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push edi
push eax
call fcn.10042160
test eax, eax
je 0x10042c59
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edi, edi
inc edi
test eax, eax
jne 0x10042c78
push ebx
push ebx
push 0x1018d75c
call fcn.1005869a
add esp, 0xc
cmp eax, edi
jne 0x10042c78
push ebx
push ebx
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
call fcn.1005869a
add esp, 0xc
cmp eax, edi
jne 0x10042c78
cmp dword [esi + 4], ebx
je 0x10042c6a
push 0x1018d75c
call fcn.10057cc9
pop ecx
test eax, eax
je 0x10042c71
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
jmp 0x10042c4f
mov ecx, esi
call fcn.10042c7c
mov eax, edi
jmp 0x10042c5b
Function at 0x100434d8
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x814
push edi
push 0
lea esi, [ebx + 4]
push esi
call fcn.1012db70
add esp, 0xc
mov dword [esi], edi
mov edi, str.360safe
lea eax, [ebx + 8]
mov esi, 0x200
push edi
push esi
push eax
call fcn.100100b8
push str.newspy_killer
push esi
lea eax, [ebx + 0x208]
push eax
call fcn.100100b8
push 0
push 0x1a
lea esi, [ebx + 0x408]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10043591
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call edi
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call esi
push str.LogInfo
lea eax, [ebx + 0x408]
push eax
call edi
push 0
lea eax, [ebx + 0x408]
push eax
call esi
push 0x104
lea esi, [ebx + 0x610]
push esi
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....360verify.dll
push esi
call edi
lea eax, [ebx + 4]
push eax
call fcn.101120d7
mov ecx, eax
call fcn.10113539
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x1004be83
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x208
push ebx
push eax
call fcn.1012db70
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1004bee5
cmp eax, 0x104
jbe 0x1004bf09
push esi
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.100100b8
push 0x1018cfec
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x1018f720
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1004bf97
lea eax, [ebp - 0x20c]
push eax
call fcn.10130fe5
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10008f20
push 0x2a
call fcn.10010082
pop ecx
push ebx
test eax, eax
je 0x1004bf5c
lea ecx, [ebp - 0x20c]
push ecx
push esi
call eax
jmp 0x1004bf6a
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1004bf97
push 0xc
call fcn.10010082
pop ecx
push 0x80
test eax, eax
je 0x1004bf8a
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x1004bf97
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret

Function at 0x1004c265
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x10247ec8], esi
jne 0x1004c2a1
push esi
push esi
push esi
push 0x10056de9
push 0x30d40
push esi
mov dword [0x10247ec4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10247ec8], eax
jmp 0x1004c299
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10247ec4], esi
je 0x1004c291
mov eax, dword [0x10247ec0]
pop esi
ret
Function at 0x1004c7ac
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1004c886
push esi
call fcn.10130fe5
mov edi, 0x104
pop ecx
cmp eax, edi
ja 0x1004c886
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1004c7f2
mov al, 1
jmp 0x1004c888
push ebx
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.1012db70
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.101378c5
lea eax, [ebp - 0x210]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], eax
add esp, 0x18
mov eax, 0x414
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x21e], ebx
mov dword [ebp - 0x21a], ebx
mov dword [ebp - 0x216], ebx
mov dword [ebp - 0x22c], 3
mov word [ebp - 0x220], ax
cmp byte [ebp + 0xc], bl
jne 0x1004c869
mov eax, 0x1494
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1004c87f
cmp eax, 2
jne 0x1004c881
mov bl, 1
mov al, bl
pop ebx
jmp 0x1004c888
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret

Function at 0x1004d46a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 2
mov dword [ebp - 0x238], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1004d53a
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.1012db70
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1004d533
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
cmp edi, dword [ebp - 0x228]
je 0x1004d521
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.101311cd
pop ecx
pop ecx
test eax, eax
jne 0x1004d521
push dword [ebp - 0x228]
call fcn.1004f9d9
test eax, eax
je 0x1004d521
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x234]
push eax
call fcn.10010712
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1004d4d9
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 8
Function at 0x1004d54a
Capabilities:
Get graphical window text

Disassembly:
push 0x234
mov eax, 0x1015926c
call fcn.1012b6ae
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x23c], eax
xor eax, eax
mov dword [ebp - 0x240], ebx
test ebx, ebx
je 0x1004d6b1
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], eax
mov edi, eax
mov dword [ebp - 0x234], edi
mov esi, eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x228]
push eax
push str.ModuleUpdate.exe
call fcn.1004d46a
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x228]
sub eax, ecx
and dword [ebp - 0x21c], esi
sar eax, 2
test eax, eax
jle 0x1004d676
mov ebx, dword [ebp - 0x21c]
mov esi, eax
push dword [ecx + ebx*4]
push str.Q360DownloadMain
call fcn.1004d7bf
mov edi, eax
push edi
mov dword [ebp - 0x21c], edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1004d655
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x1004d655
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax]
call fcn.101311cd
pop ecx
pop ecx
test eax, eax
jne 0x1004d655
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.10010712
mov ecx, dword [ebp - 0x228]
inc ebx
cmp ebx, esi
jl 0x1004d5dc
mov esi, dword [ebp - 0x230]
mov edi, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x240]
sub esi, edi
sar esi, 2
cmp esi, 1
jne 0x1004d686
mov eax, dword [edi]
mov dword [ebx], eax
jmp 0x1004d689
and dword [ebx], 0
xor ebx, ebx
cmp esi, 1
sete bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10015f18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.10015f18
mov eax, ebx
call fcn.1012b658
ret 8

Function at 0x1004d722
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x234], eax
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1004d7af
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1004d7a8
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp - 0x228], edi
jne 0x1004d792
mov eax, dword [ebp - 0x234]
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
call fcn.101160fa
pop ecx
pop ecx
test eax, eax
jne 0x1004d7a5
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1004d770
jmp 0x1004d7a7
mov bl, 1
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret