joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5ee0
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4fe48b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [0x563288]
mov edx, dword [eax + 0xc]
mov ecx, 0x563288
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
mov dword [esp + 0x230], 0
push ecx
mov dword [esp + 0x14], 0
mov word [esp + 0x20], ax
call fcn.004e8fe0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push str.Path
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360Zip.exe
push reloc.SHELL32.dll_SHChangeNotifyRegister
mov dword [esp + 0x28], 0x204
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4c5fed
add esi, 0xfffffff0
mov eax, esi
call fcn.004048c0
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x228], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4c5fc6
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004e3edb
add esp, 0x224
ret
mov ecx, 0x104
lea eax, [esp + 0x14]
cmp word [eax], 0
je 0x4c6006
add eax, 2
sub ecx, 1
jne 0x4c5ff6
jmp 0x4c602b
test ecx, ecx
je 0x4c602b
mov eax, 0x104
sub eax, ecx
push SHChangeNotifyRegister
mov ecx, 0x104
push 0x519708
sub ecx, eax
lea edx, [esp + eax*2 + 0x1c]
call fcn.0041ec40
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c5f93
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x40
or eax, ecx
jge 0x4c6062
mov ecx, 0x40
lea eax, [esp + 0xc]
call fcn.004014d0
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push esi
push 0x510130
push str.Language
push str.Main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004e4d4d
add esp, 8
test eax, eax
jl 0x4c60ca
cmp eax, dword [esi - 8]
jg 0x4c60ca
mov dword [esi - 0xc], eax
xor edx, edx
mov word [esi + eax*2], dx
add esi, 0xfffffff0
mov eax, esi
call fcn.004048c0
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x228], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jmp 0x4c5fba
push 0x80070057
call fcn.00401540
int3
Function at 0x4c7ba0
Capabilities:
Access peb ldr_data
Capture webcam image
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4febdd
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x170]
mov ebx, dword [esp + 0x174]
mov ecx, dword [ebx + 0xc]
lea edi, [esp + 0x18]
lea esi, [esp + 0xe4]
mov eax, ebp
call fcn.004c75a0
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x419
push esi
call edi
lea ecx, [esp + 0x24]
push ecx
push eax
push 0x41d
push esi
call edi
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
push 1
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea esi, [esp + 0x34]
call fcn.004c6b90
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
mov edx, dword [ebp + 4]
push esi
push eax
push ecx
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004c8990
test eax, eax
je 0x4c7c78
lea ecx, [esp + 0x34]
push ecx
jmp 0x4c7c90
mov eax, dword [esp + 0x18]
mov edi, dword [ebx + 0xc]
cmp eax, esi
je 0x4c7c8b
push eax
mov esi, ebp
call fcn.004c7600
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x16c], 0xffffffff
call fcn.004c6f30
xor eax, eax
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.004e3edb
add esp, 0x158
ret 8
Function at 0x4c7f10
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x507036
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x444]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x454]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x2c]
push eax
push 0
mov edi, ecx
mov ecx, dword [ebp + 4]
push 0x434
push ecx
call esi
mov edx, dword [ebp + 4]
lea ebx, [edi + 0x18]
push ebx
push 0
push 0x437
push edx
call esi
xor eax, eax
push 0x400
push eax
lea ecx, [esp + 0x3e]
push ecx
mov word [esp + 0x40], ax
call fcn.004e8fe0
mov ecx, dword [ebp + 4]
mov edi, dword [edi + 0x1c]
mov ebx, dword [ebx]
xor eax, eax
add esp, 0xc
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x44b
lea edx, [esp + 0x40]
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
call esi
mov eax, dword [ebp + 4]
lea edx, [esp + 0x2c]
push edx
push 0
push 0x437
push eax
call esi
lea esi, [esp + 0x34]
call fcn.0048a840
test eax, eax
je 0x4c8121
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
cmp dword [ebp + 0x45c], 0
mov eax, ecx
je 0x4c8105
mov edx, dword [0x563288]
mov eax, dword [edx + 0xc]
mov ecx, 0x563288
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44c], 0
call fcn.0048a8b0
mov ebx, dword [esp + 0x1c]
test eax, eax
je 0x4c8054
push 5
push 0
mov ecx, esi
push ecx
push ebx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4c80dc
mov edx, dword [0x563288]
mov eax, dword [edx + 0xc]
mov ecx, 0x563288
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x34]
push ecx
push str.360_r_n_s
lea edi, [esp + 0x20]
mov byte [esp + 0x454], 1
call fcn.00404890
mov esi, dword [esp + 0x20]
mov edx, dword [ebp + 4]
push 0x24
push esi
push edx
xor eax, eax
call fcn.00488c60
add esp, 0x14
cmp eax, 6
jne 0x4c80b8
push 5
push 0
push 0
lea eax, [esp + 0x40]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [esp + 0x44c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c80dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x44c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c8121
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4c8121
test eax, eax
je 0x4c8121
push 5
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [esp + 0x444]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004e3edb
add esp, 0x43c
ret 4
Function at 0x4c8da0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 0x38]
push ebx
push esi
push 0
push 0
push 0x130b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x60]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
neg eax
sbb eax, eax
and eax, 5
push eax
push ecx
call ebx
mov eax, dword [edi + 0x88]
mov edx, esi
neg edx
sbb edx, edx
and edx, 0xfffffffb
add edx, 5
push edx
push eax
call ebx
test esi, esi
pop esi
pop ebx
je 0x4c8df4
mov ecx, dword [edi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
ret
mov edx, dword [edi + 0x88]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
ret

Function at 0x4c9a74
Capabilities:
Create thread

Disassembly:
sub esp, 0x424
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
je 0x4c9a99
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.004e3edb
add esp, 0x424
ret
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004e8fe0
add esp, 0xc
push 0x208
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360Util.dll
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edi, [esp + 0x10]
call fcn.0041d860
test eax, eax
je 0x4c9c1c
cmp dword [0x565840], 0
jne 0x4c9b37
push 0x565828
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x565840], 0
jne 0x4c9b2c
push 0x565418
mov ecx, edi
call fcn.0041dc60
mov dword [0x565844], eax
mov dword [0x565840], 1
push 0x565828
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x565844], 0
je 0x4c9c1c
mov eax, dword [0x565420]
test eax, eax
je 0x4c9c1c
lea edi, [esi + 4]
push edi
push 0x519c00
call eax
test eax, eax
jl 0x4c9c1c
mov eax, dword [edi]
test eax, eax
je 0x4c9c1c
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push str.360TS
push eax
call edx
test eax, eax
jl 0x4c9c1c
mov edi, dword [edi]
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push 0x510134
push edi
call ecx
test eax, eax
jl 0x4c9c1c
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0xc], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x14], eax
call edi
cmp dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
je 0x4c9c1c
cmp dword [esi + 0x14], 0
je 0x4c9c1c
test eax, eax
je 0x4c9c1c
lea edx, [esp + 0xc]
push edx
push 0
push esi
push 0x4c9a50
push 0
push 0
call fcn.004e5813
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x4c9c1c
mov eax, dword [esi + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov dword [esi], 1
jmp 0x4c9c26
cmp dword [esi], 0
jne 0x4c9c26
call fcn.004c9c40
mov eax, dword [esi]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
call fcn.004e3edb
add esp, 0x424
ret
Function at 0x4cb680
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x1dc]
push ebp
push esi
push edi
push 0x103
mov esi, ecx
lea ecx, [esp + 0xd5]
push 0
push ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0xdc], 0
call fcn.004e8fe0
push esi
push 0x519c74
mov ecx, 0x104
lea edi, [esp + 0xe4]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
call fcn.004cc940
mov eax, edi
add esp, 0x14
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb710
sub eax, edx
lea edx, [esp + 0xd0]
push edx
lea esi, [esp + 0x14]
call fcn.004cb1e0
mov eax, esi
call fcn.004cb2f0
mov eax, esi
call fcn.004cb2f0
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
push 0x40
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x98]
push 0
push ecx
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], eax
call fcn.004e8fe0
add esp, 0x10
xor ebp, ebp
movzx edx, byte [esp + ebp + 0x80]
xor eax, eax
push edx
push str._02x
lea ecx, [eax + 8]
lea edi, [esp + 0x80]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
call fcn.004cc940
lea eax, [esp + 0x98]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb7b4
sub eax, edx
mov ecx, 0x40
sub ecx, eax
lea eax, [esp + 0x78]
lea esi, [eax + 1]
jmp 0x4cb7d0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4cb7d0
sub eax, esi
cmp ecx, eax
jge 0x4cb7e1
mov eax, ecx
jmp 0x4cb7f1
lea eax, [esp + 0x78]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb7e8
sub eax, edx
push eax
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.004e7800
inc ebp
add esp, 0xc
cmp ebp, 0x10
jl 0x4cb77a
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4cb847
mov esi, dword [esp + 0x1ec]
push esi
push 0
push edi
call fcn.004e8fe0
lea edx, [esp + 0x9c]
push edx
push 0x519c74
lea ecx, [esi - 1]
call fcn.004cc940
push edi
call fcn.004e5c38
add esp, 0x18
mov ecx, dword [esp + 0x1dc]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004e3edb
add esp, 0x1d8
ret
Function at 0x4cbcc0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2d14
call fcn.004f3c00
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x2d10], eax
mov eax, dword [esp + 0x2d18]
push ebx
xor ebx, ebx
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x4cbe16
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
xor ebp, ebp
lea esp, [esp]
push ebp
lea eax, [esp + 0x414]
push str..PhysicalDrive_d
push eax
mov eax, 0x200
call fcn.00420b40
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea ecx, [esp + 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4cbdf1
xor eax, eax
push 0x2710
lea edx, [esp + 0x614]
push ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004e8fe0
add esp, 0xc
push ebx
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x61c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4cbde2
push 0x3e8
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.004e8fe0
mov eax, dword [esp + 0x634]
add esp, 0xc
lea edi, [esp + 0x28]
lea ecx, [esp + 0x610]
call fcn.004cb410
push SHChangeNotifyRegister
mov ecx, edi
push ecx
mov ecx, dword [esp + 0x20]
mov edx, 0x64
call fcn.004cc880
cmp eax, ebx
jne 0x4cbde2
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
cmp edi, ebx
jne 0x4cbdfb
inc ebp
cmp ebp, 0x10
jl 0x4cbd00
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d10]
xor ecx, esp
call fcn.004e3edb
add esp, 0x2d14
ret
mov ecx, dword [esp + 0x2d14]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004e3edb
add esp, 0x2d14
ret
Function at 0x4cc110
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x4f8
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x4f4], eax
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
test esi, esi
je 0x4cc341
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004e8fe0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cc305
push ebx
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xf2]
push eax
mov word [esp + 0xf4], dx
call fcn.004e8fe0
mov eax, dword [esp + 0x14]
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xfc]
push edx
push ebx
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4cc2f9
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esp, [esp]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
lea edx, [esp + 0xf8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cc2c2
xor ecx, ecx
push 0x208
push ecx
lea edx, [esp + 0x2fe]
push edx
mov word [esp + 0x300], cx
call fcn.004e8fe0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2f8]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0x519d44
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x20a
call ebp
test eax, eax
jne 0x4cc2b7
push 0x64
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.004e8fe0
add esp, 0xc
lea edx, [esp + 0x88]
lea ecx, [esp + 0x2f4]
call fcn.004cbfd0
test eax, eax
je 0x4cc2b7
cmp byte [esp + 0x24], 0
je 0x4cc280
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x4cc2b7
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x4cc2af
mov cl, byte [esi + eax]
test cl, cl
je 0x4cc2af
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4cc294
jmp 0x4cc2b3
test edx, edx
jne 0x4cc2b4
dec eax
mov byte [eax], 0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4cc1c0
mov esi, dword [esp + 0x20]
pop ebp
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp byte [esp + 0x1c], 0
je 0x4cc341
push SHChangeNotifyRegister
lea ecx, [esp + 0x20]
push ecx
mov edx, 0x64
mov ecx, esi
call fcn.004cc880
xor edx, edx
test eax, eax
setge dl
pop esi
mov eax, edx
mov ecx, dword [esp + 0x4f4]
xor ecx, esp
call fcn.004e3edb
add esp, 0x4f8
ret
mov ecx, dword [esp + 0x4f8]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004e3edb
add esp, 0x4f8
ret
Function at 0x4cc5a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x514
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x50c], eax
test esi, esi
je 0x4cc6db
push 0x400
lea eax, [esp + 0x10c]
push 0
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x400
call fcn.004e8fe0
add esp, 0xc
lea ecx, [esp]
push ecx
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0xc]
push eax
push 0x519d64
push str.Software360SafeLiveup
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4cc6db
lea eax, [esp + 0x108]
lea edx, [eax + 1]
jmp 0x4cc620
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cc620
sub eax, edx
cmp eax, 0x40
jne 0x4cc6db
push 0x20
lea ecx, [esp + 0x10c]
push ecx
lea edx, [eax + 0x40]
lea ecx, [esp + 0x10]
call fcn.004cc880
push SHChangeNotifyRegister
lea edx, [esp + 0x12c]
push edx
mov edx, 0x80
lea ecx, [esp + 0x90]
call fcn.004cc880
push 0x400
lea eax, [esp + 0x10c]
push 0
push eax
call fcn.004e8fe0
add esp, 0xc
lea ecx, [esp + 0x108]
push 0x400
push ecx
lea ecx, [esp + 0x10]
call fcn.004cb680
add esp, 8
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4cc6db
lea ecx, [esp + 8]
push ecx
mov edx, 0x80
mov ecx, esi
call fcn.004cc8d0
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.004e3edb
add esp, 0x514
ret
mov ecx, dword [esp + 0x50c]
xor ecx, esp
xor eax, eax
call fcn.004e3edb
add esp, 0x514
ret
Function at 0x4dc600
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push ebp
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
push edi
lea eax, [esp + 0x2c]
xor ebp, ebp
push eax
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x48]
cmp edi, 0x1000
ja 0x4dc64b
mov edi, 0x1000
mov eax, dword [esp + 0x54]
xor edx, edx
div edi
xor ebx, ebx
mov esi, eax
imul esi, edi
cmp dword [esp + 0x58], esi
jae 0x4dc723
cmp esi, dword [esp + 0x5c]
jae 0x4dc723
push 0x1c
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4dc723
cmp dword [esp + 0x20], 0x10000
jne 0x4dc6a9
cmp dword [esp + 0x1c], edi
jb 0x4dc6a9
push 0x40
push 0x3000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x4dc6db
lea eax, [ebp + 1]
and ebp, 0x80000001
jns 0x4dc6b9
dec ebp
or ebp, 0xfffffffe
inc ebp
neg ebp
sbb ebp, ebp
and ebp, 2
dec ebp
imul ebp, eax
imul ebp, edi
add esi, ebp
mov ebp, eax
cmp dword [esp + 0x58], esi
jb 0x4dc664
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
mov eax, 0x8d3dcb09
mul edi
shr edx, 6
lea eax, [ebx + 0x74]
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], eax
cmp edx, 1
jbe 0x4dc716
lea eax, [ebx + 0xe0]
lea ecx, [edx - 1]
lea esi, [eax - 0xe0]
mov dword [eax], esi
lea esi, [eax + 8]
mov dword [eax + 4], esi
add eax, 0x74
sub ecx, 1
jne 0x4dc700
mov ecx, dword [0x5652d0]
imul edx, edx, 0x74
mov dword [edx + ebx - 4], ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x4dc820
Capabilities:
Resume thread
Suspend thread

Disassembly:
sub esp, 0x2d0
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x2cc], eax
mov eax, dword [esp + 0x2d4]
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x4dc8e8
test esi, esi
je 0x4dc8e8
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x4dc909
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetThreadContext]
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], 0x10001
xor edi, edi
call ebp
test eax, eax
je 0x4dc928
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4dc8a0
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0x2e8]
cmp eax, ecx
jb 0x4dc8e3
mov edx, dword [esp + 0x2ec]
add ecx, edx
cmp eax, ecx
jae 0x4dc8e3
push esi
call ebx
cmp edi, 3
jge 0x4dc8fe
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [esp + 0x10]
push eax
push esi
inc edi
call ebp
test eax, eax
jne 0x4dc8a0
mov eax, esi
pop ebx
pop edi
pop ebp
pop esi
mov ecx, dword [esp + 0x2cc]
xor ecx, esp
call fcn.004e3edb
add esp, 0x2d0
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4dc8e5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2cc]
xor ecx, esp
call fcn.004e3edb
add esp, 0x2d0
ret
mov ecx, dword [esp + 0x2d8]
pop edi
pop ebp
mov eax, esi
pop esi
xor ecx, esp
call fcn.004e3edb
add esp, 0x2d0
ret

Function at 0x4dc950
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [esp + 0xc], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x5652dc], esi
jbe 0x4dc9b2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [esp]
mov eax, dword [0x5652d8]
mov ecx, dword [eax + esi*4]
push ecx
call ebx
mov edx, dword [0x5652d8]
mov eax, dword [edx + esi*4]
push eax
call ebp
inc esi
cmp esi, dword [0x5652dc]
jb 0x4dc990
pop ebp
pop ebx
mov ecx, dword [0x5652d8]
push ecx
call fcn.004e4b2f
mov edx, dword [esp + 0xc]
add esp, 4
xor eax, eax
push edx
mov dword [0x5652d8], eax
mov dword [0x5652dc], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ecx
ret
Function at 0x4dd310
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004e0ee0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.004e0f80
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004e3edb
add esp, 0x68
ret