joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a2a2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x430
mov eax, 0x516660
call fcn.004f21c7
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x434], edi
call fcn.00404939
xor eax, eax
mov dword [ebp - 4], edi
push 0x208
mov word [ebp - 0x424], ax
xor ebx, ebx
lea eax, [ebp - 0x422]
push edi
inc ebx
push eax
mov dword [ebp - 0x434], ebx
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x438]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x430], 0x209
mov dword [ebp - 0x438], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x46a3bc
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004e7380
add esp, 0xc
push str.QHVer.dll
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], edi
push eax
lea edi, [ebp - 0x218]
call fcn.004413a9
pop ecx
pop ecx
cmp al, bl
jne 0x46a3bc
mov eax, dword [ebp - 0x42c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x428]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._d._d._d._d
push esi
call fcn.00404568
add esp, 0x18
mov eax, esi
call fcn.004f224a
ret

Function at 0x46bb26
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x5274ba
call fcn.004f21c7
xor ebx, ebx
cmp byte [0x585595], bl
jne 0x46bb43
push 4
jmp 0x46bc14
lea ecx, [ebp - 0x2c]
call fcn.00449388
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x46bc07
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x46bb63
lea eax, [ebp - 0x28]
cmp eax, ebx
je 0x46bc07
mov ecx, str.____________________________________
call fcn.0046d797
test eax, eax
setne al
cmp al, bl
je 0x46bc07
call fcn.004093f7
test al, al
jne 0x46bb9a
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004051fe
push 3
jmp 0x46bc14
push 0x582e91
push 8
call fcn.004eb6e3
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x46bbb9
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 4], al
push ebx
push ebx
push esi
push 0x46bc1b
push ebx
xor edi, edi
push ebx
inc edi
call fcn.004eb0fa
add esp, 0x18
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0x46bbf1
xor esi, esi
cmp dword [ebp + 0x10], ebx
je 0x46bbe6
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push esi
call fcn.004e7360
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004051fe
mov eax, edi
jmp 0x46bc15
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004051fe
push 2
pop eax
call fcn.004f224a
ret
Function at 0x46e164
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x51b997
call fcn.004f21c7
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x220], edi
mov eax, dword [0x582d44]
mov esi, 0x582d44
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
xor eax, eax
mov dword [ebp - 4], edi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x46e22d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00405721
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5427fc
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x46e22d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00405721
lea eax, [ebp - 0x21c]
jmp 0x46e254
mov eax, dword [0x582d44]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 1
mov eax, dword [eax]
sub eax, 0x10
call fcn.0040499b
or dword [ebp - 0x220], 2
add eax, 0x10
test byte [ebp - 0x220], 1
mov dword [ebx], eax
je 0x46e281
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, ebx
call fcn.004f224a
ret

Function at 0x46e960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x46e96d
xor al, al
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46e98e
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
neg eax
sbb al, al
inc al
pop ebp
ret
shr al, 4
and al, 1
pop ebp
ret

Function at 0x46eb5d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004e736b
leave
ret

Function at 0x46ee30
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
cmp esi, 0xffffffff
je 0x46ee4f
test esi, esi
jne 0x46ee77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x46ee6e
cmp esi, 0xffffffff
je 0x46ee6a
test esi, esi
je 0x46ee6a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x46ee80
cmp esi, 0xffffffff
je 0x46ee7e
test esi, esi
je 0x46ee7e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebp
ret
Function at 0x46ee83
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x51c94f
call fcn.004f215e
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x46eea7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x46eea7
xor al, al
jmp 0x46eff7
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x46eea0
xor eax, eax
cmp dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
jle 0x46efec
mov ebx, 0x582d44
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + eax*4]
cmp word [eax], 0x2f
jne 0x46efdc
add eax, 2
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00405747
and dword [ebp - 4], 0
mov eax, dword [0x582d44]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [0x582d44]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x3a
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00417292
mov esi, eax
cmp esi, 0xffffffff
je 0x46ef80
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0xc]
call fcn.004219ee
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004044e5
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.0040557a
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
lea eax, [ebp + 0xc]
call fcn.004044a4
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004044e5
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.0040557a
jmp 0x46ef8b
lea eax, [ebp + 0xc]
lea edi, [ebp - 0x14]
call fcn.004044e5
push 0x22
pop edx
push edx
lea eax, [ebp - 0x10]
call fcn.0046f0c1
call fcn.0046f06d
lea eax, [ebp - 0x14]
call fcn.00425111
push eax
push dword [ebp + 8]
call fcn.0041775c
mov edi, eax
lea eax, [ebp - 0x10]
call fcn.004044e5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040557a
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jl 0x46eed0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
call fcn.004f2236
ret 8
Function at 0x46f8da
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0xbc
mov eax, 0x527adc
call fcn.004f21c7
lea eax, [ebp - 0xc8]
push eax
call fcn.00433eee
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x18], bl
je 0x46f992
cmp dword [ebp - 0xc4], ebx
jne 0x46f933
push ebx
push ebx
push 0x1404
push str.Q360InternationSafeClass
call fcn.004368f9
mov ecx, dword [edi]
add esp, 0x10
push 1
call fcn.00490fc0
lea eax, [ebp - 0xc8]
call fcn.0046f854
cmp dword [ebp - 0xc8], ebx
jne 0x46f96a
lea eax, [ebp - 0xc8]
push eax
call fcn.0046f5e6
pop ecx
lea eax, [ebp - 0xc8]
call fcn.0046f722
lea esi, [ebp - 0xc8]
call fcn.0046f68f
call fcn.0046f79d
mov esi, dword [edi]
call fcn.00493086
lea eax, [ebp - 0xc8]
push eax
call fcn.0046f7e0
cmp dword [ebp - 0x20], 1
pop ecx
je 0x46f992
push str.360DesktopLite
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea esi, [ebp - 0xc8]
call fcn.00433f2f
call fcn.004f224a
ret

Function at 0x46fb50
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x520605
call fcn.004f215e
lea eax, [ebp - 0x30]
xor esi, esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call fcn.0046fad1
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x2c]
inc esi
mov dword [esp], str.AVE360KP.dll
push ecx
mov edi, eax
mov dword [ebp - 0x14], esi
call fcn.0040603b
pop ecx
pop ecx
push 3
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
push dword [eax]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
je 0x46fc15
lea eax, [ebp - 0x28]
push eax
call fcn.0046fad1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x24]
mov dword [esp], str.AVE360KPBase.dll
push ecx
mov edi, eax
mov dword [ebp - 0x14], 7
call fcn.0040603b
pop ecx
pop ecx
mov dword [ebp - 4], ebx
push 0xf
pop ebx
push dword [eax]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
je 0x46fc15
lea eax, [ebp - 0x20]
push eax
call fcn.0046fad1
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c]
mov dword [esp], str.AVEkpb.def
push ecx
mov edi, eax
mov dword [ebp - 0x14], 0x1f
call fcn.0040603b
pop ecx
pop ecx
push 0x3f
pop ebx
push dword [eax]
call esi
mov byte [ebp - 0xd], 1
test eax, eax
jne 0x46fc19
mov byte [ebp - 0xd], 0
test bl, 0x20
je 0x46fc2c
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
and ebx, 0xffffffdf
call fcn.0040557a
test bl, 0x10
je 0x46fc3f
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
and ebx, 0xffffffef
call fcn.0040557a
test bl, 8
je 0x46fc52
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
and ebx, 0xfffffff7
call fcn.0040557a
test bl, 4
je 0x46fc65
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
and ebx, 0xfffffffb
call fcn.0040557a
test bl, 2
je 0x46fc78
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
and ebx, 0xfffffffd
call fcn.0040557a
test bl, 1
je 0x46fc88
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.0040557a
cmp byte [ebp - 0xd], 0
je 0x46fc95
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
call fcn.004f2236
ret
Function at 0x46fd23
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x520605
call fcn.004f215e
lea eax, [ebp - 0x30]
xor esi, esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call fcn.0046fcdf
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x2c]
inc esi
mov dword [esp], str.vbase000.vdf
push ecx
mov edi, eax
mov dword [ebp - 0x14], esi
call fcn.0040603b
pop ecx
pop ecx
push 3
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
push dword [eax]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
jne 0x46fde8
lea eax, [ebp - 0x28]
push eax
call fcn.0046fcdf
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x24]
mov dword [esp], str.aeoffice.dll
push ecx
mov edi, eax
mov dword [ebp - 0x14], 7
call fcn.0040603b
pop ecx
pop ecx
mov dword [ebp - 4], ebx
push 0xf
pop ebx
push dword [eax]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
jne 0x46fde8
lea eax, [ebp - 0x20]
push eax
call fcn.0046fcdf
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x1c]
mov dword [esp], str.aebb.dll
push ecx
mov edi, eax
mov dword [ebp - 0x14], 0x1f
call fcn.0040603b
pop ecx
pop ecx
push 0x3f
pop ebx
push dword [eax]
call esi
mov byte [ebp - 0xd], 0
test eax, eax
je 0x46fdec
mov byte [ebp - 0xd], 1
test bl, 0x20
je 0x46fdff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
and ebx, 0xffffffdf
call fcn.0040557a
test bl, 0x10
je 0x46fe12
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
and ebx, 0xffffffef
call fcn.0040557a
test bl, 8
je 0x46fe25
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
and ebx, 0xfffffff7
call fcn.0040557a
test bl, 4
je 0x46fe38
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
and ebx, 0xfffffffb
call fcn.0040557a
test bl, 2
je 0x46fe4b
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
and ebx, 0xfffffffd
call fcn.0040557a
test bl, 1
je 0x46fe5b
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
call fcn.0040557a
cmp byte [ebp - 0xd], 0
je 0x46fe68
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
call fcn.004f2236
ret
Function at 0x4703fc
Capabilities:
Get logon sessions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xff0
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xfc8], ecx
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfd4], edx
mov byte [ebp - 0xfad], 0
cmp eax, esi
jne 0x47043f
cmp ecx, esi
jne 0x47043f
xor al, al
jmp 0x4705ed
lea eax, [ebp - 0xfc0]
push eax
lea eax, [ebp - 0xfbc]
push eax
mov dword [ebp - 0xfbc], esi
mov dword [ebp - 0xfc0], esi
call sub.Secur32.dll_LsaEnumerateLogonSessions
test eax, eax
jne 0x470438
mov dword [ebp - 0xfb8], esi
cmp dword [ebp - 0xfbc], esi
jbe 0x4705dc
mov ebx, 0x7ce
lea edi, [ebx + 2]
mov ecx, dword [ebp - 0xfb8]
lea eax, [ebp - 0xfb4]
push eax
mov eax, dword [ebp - 0xfc0]
lea eax, [eax + ecx*8]
push eax
mov dword [ebp - 0xfb4], esi
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
jne 0x4705a4
mov esi, dword [ebp - 0xfb4]
test esi, esi
je 0x4705a2
mov eax, dword [esi + 0x30]
mov dword [ebp - 0xfd0], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0xfcc], eax
xor eax, eax
push ebx
push eax
mov word [ebp - 0x7dc], ax
lea eax, [ebp - 0x7da]
push eax
call fcn.004e7380
add esp, 0xc
xor eax, eax
push ebx
push eax
mov word [ebp - 0xfac], ax
lea eax, [ebp - 0xfaa]
push eax
call fcn.004e7380
add esp, 0xc
push dword [esi + 0x10]
lea eax, [ebp - 0x7dc]
push edi
push eax
call fcn.00421170
mov eax, dword [ebp - 0xfb4]
push dword [eax + 0x18]
lea eax, [ebp - 0xfac]
push edi
push eax
call fcn.00421170
push dword [ebp - 0xfb4]
call sub.Secur32.dll_LsaFreeReturnBuffer
and dword [ebp - 0xfb4], 0
cmp dword [ebp - 0xfc8], 0
je 0x470552
lea eax, [ebp - 0x7dc]
push eax
push dword [ebp - 0xfc8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4705a2
cmp dword [ebp - 0xfc4], 0
je 0x470572
lea eax, [ebp - 0xfac]
push eax
push dword [ebp - 0xfc4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4705a2
lea eax, [ebp - 0xfdc]
push eax
lea eax, [ebp - 0xfd0]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x4705a2
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0xfdc]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x4705be
xor esi, esi
inc dword [ebp - 0xfb8]
mov eax, dword [ebp - 0xfb8]
cmp eax, dword [ebp - 0xfbc]
jb 0x47047c
jmp 0x4705dc
mov ecx, dword [ebp - 0xfd0]
mov eax, dword [ebp - 0xfd4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xfcc]
mov dword [eax + 4], ecx
mov byte [ebp - 0xfad], 1
push dword [ebp - 0xfc0]
call sub.Secur32.dll_LsaFreeReturnBuffer
mov al, byte [ebp - 0xfad]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e736b
leave
ret 4
Function at 0x470a4f
Capabilities:
Create thread

Disassembly:
push 0x6c
mov eax, 0x52746a
call fcn.004f21c7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x74]
mov dword [ebx + 0x248], eax
call fcn.0043131e
xor edi, edi
lea esi, [ebp - 0x74]
mov dword [ebp - 4], edi
call fcn.004369c1
cmp eax, edi
je 0x470aa9
cmp eax, 1
je 0x470aa9
mov eax, dword [ebp - 0x18]
dec eax
cmp eax, 6
ja 0x470aa9
push edi
push edi
push ebx
push 0x471e1f
push edi
push edi
call fcn.004eb0fa
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x470ac7
push ecx
mov eax, esp
mov dword [ebp - 0x78], esp
push ecx
mov dword [eax], edi
mov eax, esp
mov dword [ebp - 0x78], esp
mov dword [eax], edi
push dword [ebx + 0x248]
lea esi, [ebx + 0x2c]
call fcn.004731f3
lea edi, [ebp - 0x74]
call fcn.00432c8b
mov al, 1
call fcn.004f224a
ret 8
Function at 0x473638
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.004e7380
mov esi, 0x400
push esi
push str.Sorry__one_of_360_Internet_Security_files__
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004ecfab
push esi
push edi
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004f0f12
push esi
push str._is_corrupted.__nTo_fix_this_issue__please_reinstall_360_Internet_Security.
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004f0f12
add esp, 0x3c
push 0x11
push str.360_Internet_Security
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4736d4
push 5
push ebx
push ebx
push dword [0x58658c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.004f0e7a
int3

Function at 0x473ce1
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x527301
call fcn.004f215e
mov eax, dword [ebp + 0xc]
mov edi, edx
mov esi, ecx
push edi
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.0047477e
test eax, eax
jne 0x473e06
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x473e06
push edi
call fcn.00405f50
pop ecx
push edi
test eax, eax
jne 0x473d31
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
call fcn.00473638
call fcn.004235b7
mov ebx, eax
test ebx, ebx
je 0x473e06
push str.CreateTrayClient
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x473dff
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 1
call eax
mov edi, eax
test edi, edi
je 0x473dff
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jb 0x473df8
push dword [ebp - 0x18]
and dword [ebp - 0x14], 0
mov ecx, edi
call fcn.00473ebc
mov eax, dword [esi + 0x74]
test eax, eax
je 0x473df8
mov edx, dword [edi]
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x473df8
lea eax, [ebp - 0x4c]
push eax
call fcn.00473e10
push dword [ebp - 0x1c]
and dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x4c], ebx
call fcn.00405721
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [esi + 4]
cmp dword [eax + 0x18], 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x44], edi
push ecx
je 0x473ddc
add eax, 0x1c
call fcn.00474b5a
lea esi, [ebp - 0x38]
call fcn.0044019d
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, edi
jmp 0x473e08
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
call fcn.004f2236
ret 0xc
Function at 0x474119
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51c898
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
add ebx, 4
inc dword [ebx + 0x18]
mov dword [esp + 0x10], ebx
and dword [esp + 0x38], 0
push dword [ebx + 0xc]
mov edi, ebx
lea esi, [esp + 0x20]
call fcn.0045e744
mov eax, dword [esp + 0x1c]
push dword [ebx + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
jmp 0x474197
lea esi, [esp + 0x14]
call fcn.004555bb
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 0xc]
je 0x4741d5
lea edi, [esp + 0x24]
call fcn.0047496f
push dword [ebx + 0x10]
mov edi, ebx
lea esi, [esp + 0x20]
call fcn.0045e744
mov edi, esi
lea esi, [esp + 0x14]
call fcn.004749a4
test al, al
jne 0x47417a
xor esi, esi
or dword [esp + 0x38], 0xffffffff
push ebx
call fcn.00474ad7
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
cmp dword [ebp + 0x14], ecx
jae 0x4741e0
mov dword [ebp + 0x14], ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x14]
lea edi, [eax + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [edi + 0xc]
test ecx, ecx
jne 0x4741f9
xor eax, eax
jmp 0x474201
mov eax, dword [edi + 0x14]
sub eax, ecx
sar eax, 3
mov edx, dword [edi + 0x10]
mov esi, edx
sub esi, ecx
sar esi, 3
push edx
cmp esi, eax
jae 0x474221
xor esi, esi
lea ecx, [esp + 0x20]
inc esi
call fcn.00474aaf
mov dword [edi + 0x10], eax
jmp 0x474243
lea esi, [esp + 0x18]
call fcn.0045e744
push dword [esp + 0x18]
lea eax, [esp + 0x20]
push dword [esp + 0x18]
push eax
lea eax, [esp + 0x30]
push eax
mov eax, edi
call fcn.004749e4
xor esi, esi
inc esi
jmp 0x4741b3

Function at 0x47913c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push edi
cmp dword [esi + 0x1c], eax
je 0x47915d
inc eax
jmp 0x4791dd
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push 0
push eax
call fcn.004e7380
add esp, 0xc
push 0x543d28
push 0x585d80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4791db
lea eax, [ebp - 0x210]
push eax
call fcn.00405fbb
mov edi, eax
pop ecx
test edi, edi
je 0x4791db
cmp edi, 0xffffffff
je 0x4791db
push str.CreateObject
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
test eax, eax
je 0x4791d4
xor eax, eax
inc eax
mov dword [esi + 0x1c], eax
jmp 0x4791dd
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004e736b
leave
ret
Function at 0x4791ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x40]
push edi
xor edi, edi
cmp eax, edi
je 0x479218
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x479218
cmp dword [ebp - 4], 0x103
jne 0x479218
xor eax, eax
inc eax
jmp 0x47926c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [esi + 0x20], edi
jne 0x479232
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 0x20], eax
cmp eax, edi
je 0x479266
cmp dword [esi + 0x24], edi
jne 0x479244
push edi
push edi
push edi
push edi
call ebx
mov dword [esi + 0x24], eax
cmp eax, edi
je 0x479266
push edi
push edi
push esi
push 0x4794ad
push edi
push edi
call fcn.004eb0fa
add esp, 0x18
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
je 0x479266
cmp eax, edi
je 0x479266
xor eax, eax
jmp 0x47926b
call fcn.00421bcc
pop ebx
pop edi
leave
ret
Function at 0x47e0d5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x47e0fb
push dword [ebp + 0xc]
call esi
neg eax
sbb eax, eax
and eax, 0x3ec
inc eax
inc eax
jmp 0x47e112
push dword [ebp + 8]
call fcn.0047ea34
neg eax
sbb eax, eax
and eax, 0xfffffc12
pop ecx
add eax, 0x3ee
pop esi
pop ecx
pop ebp
ret