joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, dword [ebp + 0x18]
and eax, 1
jne 0x47b5d4
push 9
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0047be80
add esp, 0x14
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov byte [ebp - 9], 0x3c
lea ecx, [ebp - 9]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0xa], 0x21
lea edx, [ebp - 0xa]
push edx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0xb], 0x44
lea eax, [ebp - 0xb]
push eax
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0xc], 0x4f
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0xd], 0x43
lea edx, [ebp - 0xd]
push edx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0xe], 0x54
lea eax, [ebp - 0xe]
push eax
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0xf], 0x59
lea ecx, [ebp - 0xf]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0x10], 0x50
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0x11], 0x45
lea eax, [ebp - 0x11]
push eax
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov byte [ebp - 0x12], 0x20
lea ecx, [ebp - 0x12]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00465da0
mov esi, eax
mov ecx, dword [ebp + 0x14]
call fcn.004666d0
add esi, eax
push esi
mov ecx, dword [ebp + 0x14]
call fcn.00465da0
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0047bee0
add esp, 0x14
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov byte [ebp - 0x1d], 0x3e
lea ecx, [ebp - 0x1d]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00405080
mov ecx, eax
call fcn.0047ac40
lea ecx, [ebp + 0xc]
call fcn.00405080
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47d100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ad8f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push 0x5463cc
lea ecx, [ebp - 0x10]
call fcn.00401e30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401270
add esp, 8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00401970
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
lea ecx, [ebp - 0x10]
call fcn.00402010
movzx eax, al
test eax, eax
je 0x47d1a0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x18]
jmp 0x47d1f3
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47d1ce
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x1c]
jmp 0x47d1f3
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401970
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x47e7b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3c], 0
je 0x47e827
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x2710
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47e7f9
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x47e842
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.004a2a30
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x47ea90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x47ead3
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x47e8c0
push 0
push 0
call fcn.004b17b2
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov esp, ebp
pop ebp
ret
Function at 0x47eaf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b018
mov eax, dword fs:[0]
push eax
mov eax, 0x1a50
call fcn.004b0a90
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a58], ecx
cmp dword [0x58fc2c], 0
jne 0x47ec23
mov dword [ebp - 0x83c], 0x828
push str.360qiyeban
push 0x100
lea eax, [ebp - 0x838]
push eax
call fcn.004b6a27
add esp, 0xc
push str.360qiyeban
push 0x100
lea ecx, [ebp - 0x638]
push ecx
call fcn.004b6a27
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0xa44]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xa44]
push eax
push str._s360safeloginfo
push 0x104
lea ecx, [ebp - 0x438]
push ecx
call fcn.004b5486
add esp, 0x10
lea edx, [ebp - 0x1a54]
push edx
call fcn.00401330
add esp, 4
mov dword [ebp - 0x1a5c], eax
mov eax, dword [ebp - 0x1a5c]
mov ecx, dword [eax]
push ecx
push 0x540c24
push 0x104
lea edx, [ebp - 0x230]
push edx
call fcn.004b5486
add esp, 0x10
lea ecx, [ebp - 0x1a54]
call fcn.00401eb0
mov dword [ebp - 0x28], 0x3c
mov dword [ebp - 0x24], 0x200000
mov dword [ebp - 0x20], 0x3c
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x83c]
push eax
call fcn.004cfdc0
add esp, 4
test eax, eax
je 0x47ec23
mov dword [0x58fc2c], 1
cmp dword [0x58fc2c], 0
je 0x47ed07
mov dword [ebp - 0xa48], 0
xor ecx, ecx
mov word [ebp - 0x1a4c], cx
push 0xffe
push 0
lea edx, [ebp - 0x1a4a]
push edx
call fcn.004b0ac0
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00402010
movzx eax, al
test eax, eax
jne 0x47ec7a
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00402010
movzx ecx, al
test ecx, ecx
je 0x47ec81
xor eax, eax
jmp 0x47ed0c
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x1a50]
call fcn.00401e10
mov dword [ebp - 4], 0
push 0x5408ec
push 0x548e18
lea ecx, [ebp - 0x1a50]
call fcn.0047ffe0
mov eax, dword [ebp - 0x1a50]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
push str._pqiyeban__cqiyeban__tpxr__md5_s__file_s_
push 0x7ff
lea eax, [ebp - 0x1a4c]
push eax
call fcn.004b5486
add esp, 0x14
lea ecx, [ebp - 0x1a4c]
push ecx
call fcn.004cff70
add esp, 4
or eax, dword [ebp - 0xa48]
mov dword [ebp - 0xa48], eax
je 0x47ecf5
call fcn.004cfd30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a50]
call fcn.00401eb0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret 4
Function at 0x480210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b0f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
cmp dword [0x58bfa8], 0
jne 0x480259
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401eb0
jmp 0x4802d2
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x44], 0
jne 0x480295
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x44], eax
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
push 0x480430
push 0
push 0
call fcn.004b17b2
add esp, 0x18
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 0x14]
add edx, 0x28
push edx
lea ecx, [ebp - 0x10]
call fcn.00447c10
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.00481b10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00447c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x480370
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x44], 0
je 0x48041d
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4803c7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
call fcn.004802f0
test eax, eax
je 0x4803c7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
cmp eax, ecx
jbe 0x4803ba
jmp 0x4803c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x48039c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
call fcn.004802f0
mov dword [ebp - 8], eax
cmp dword [0x58fb50], 0
je 0x480410
mov eax, dword [ebp - 8]
push eax
push 0x548e60
push 0x58f750
call fcn.004045b0
add esp, 0xc
cmp dword [ebp - 4], 0x102
jne 0x48041d
xor eax, eax
jmp 0x480422
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x482080
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x20], 0
jne 0x482133
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x481f60
push 0
push 0
call fcn.004b17b2
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4820be
cmp dword [ebp - 8], 0xffffffff
jne 0x4820c0
jmp 0x482133
push 0x493e0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x482122
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x20], 0
je 0x4820fa
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x483dc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b604
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.004b0a90
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], ecx
mov dword [ebp - 0x14], 1
push str.EntClientEntAllfix.ini.dec
lea eax, [ebp - 0x18]
push eax
call fcn.00401270
add esp, 8
mov dword [ebp - 4], 0
push 0x540868
lea ecx, [ebp - 0x1c]
call fcn.00401e30
mov byte [ebp - 4], 1
push 0x540868
lea ecx, [ebp - 0x10]
call fcn.00401e30
mov byte [ebp - 4], 2
xor ecx, ecx
mov word [ebp - 0x1024], cx
push 0xffe
push 0
lea edx, [ebp - 0x1022]
push edx
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x1028], 0
jmp 0x483e70
mov eax, dword [ebp - 0x1028]
add eax, 1
mov dword [ebp - 0x1028], eax
mov ecx, dword [ebp - 0x1028]
push ecx
push str.task_d
lea edx, [ebp - 0x1c]
push edx
call fcn.00409170
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0043e290
push eax
push 0x7ff
lea eax, [ebp - 0x1024]
push eax
push 0x540868
lea ecx, [ebp - 0x1c]
call fcn.0043e290
push eax
push str.Task
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x483ebf
jmp 0x483f52
lea ecx, [ebp - 0x1024]
push ecx
call fcn.004b0eb7
add esp, 4
test eax, eax
jne 0x483ed4
jmp 0x483f52
lea edx, [ebp - 0x1024]
push edx
lea ecx, [ebp - 0x10]
call fcn.00401ed0
lea ecx, [ebp - 0x10]
call fcn.00428bb0
push 0
push str.360safe_update
lea ecx, [ebp - 0x10]
call fcn.004282c0
cmp eax, 0xffffffff
je 0x483f2b
push 0
push str.10001
lea ecx, [ebp - 0x10]
call fcn.004282c0
cmp eax, 0xffffffff
je 0x483f2b
push 0
mov ecx, dword [ebp + 8]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x10]
call fcn.004282c0
cmp eax, 0xffffffff
jne 0x483f30
jmp 0x483e61
push 0
push str.normal
lea ecx, [ebp - 0x10]
call fcn.004282c0
cmp eax, 0xffffffff
je 0x483f4b
mov dword [ebp - 0x14], 0
jmp 0x483f52
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x102c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov eax, dword [ebp - 0x102c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret 4
Function at 0x488120
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x48813a
mov eax, 1
jmp 0x4881ed
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x488199
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x2710
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x488182
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x488690
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b95f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
push 0x540868
lea ecx, [ebp - 0x14]
call fcn.00401e30
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0041ad90
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call fcn.00401c70
add esp, 4
test eax, eax
jne 0x48870a
push 0x542cb8
lea ecx, [ebp - 0x14]
call fcn.00401ed0
jmp 0x4887b7
push str.360Examin.dll
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041acc0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x488741
push 0x542c74
lea ecx, [ebp - 0x14]
call fcn.00401ed0
jmp 0x4887ab
push 0x540868
lea edx, [ebp - 0x20]
push edx
call fcn.0041acc0
add esp, 8
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
push str._exam1
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
push str.open
push 0
call fcn.00428ad0
add esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
ja 0x48879f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x542c4c
lea eax, [ebp - 0x14]
push eax
call fcn.00409170
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00401eb0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401e10
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48a100
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bb98
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x10]
call fcn.00403840
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.00401800
add esp, 4
test eax, eax
jne 0x48a162
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x14]
jmp 0x48a1d9
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x48a179
push str.LogVirusScanLog
lea ecx, [ebp - 0x10]
call fcn.00401990
jmp 0x48a186
push str.LogRealtimeProtectLog
lea ecx, [ebp - 0x10]
call fcn.00401990
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48a1b4
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x18]
jmp 0x48a1d9
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401970
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x48a6e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bbf3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARE360Safe360Ent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x48a74d
jmp 0x48a78a
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x28], 8
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push str.SDReportTime
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x48a783
jmp 0x48a78a
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x14], 0
je 0x48a79a
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.EntClientSDReport.dat
lea ecx, [ebp - 0x20]
push ecx
call fcn.00401270
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00402010
movzx edx, al
test edx, edx
jne 0x48a851
xor eax, eax
mov word [ebp - 0x38], ax
xor ecx, ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov dword [ebp - 0x2e], ecx
mov word [ebp - 0x2a], cx
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x3c]
call fcn.00403840
mov byte [ebp - 4], 1
movzx ecx, word [ebp - 0x2c]
push ecx
movzx edx, word [ebp - 0x2e]
push edx
movzx eax, word [ebp - 0x30]
push eax
movzx ecx, word [ebp - 0x32]
push ecx
movzx edx, word [ebp - 0x36]
push edx
movzx eax, word [ebp - 0x38]
push eax
push str._04d__02d__02d__02d:_02d:_02d
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00409170
add esp, 0x20
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
lea ecx, [ebp - 0x3c]
call fcn.0043e290
push eax
push str.SDReportTime
push str.History
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401eb0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4