joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5566b8]
and eax, 1
jne 0x4c3e13
mov ecx, dword [0x5566b8]
or ecx, 1
mov dword [0x5566b8], ecx
mov ecx, 0x5566b4
call fcn.0041d080
push 0x52bc50
call fcn.004f8227
add esp, 4
cmp dword [0x5524c0], 0
je 0x4c3edb
mov dword [0x5524c0], 0
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004f7580
add esp, 0xc
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x220], 0x206
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsNetPurifier.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4c3eca
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.Path
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, 0x5566b4
call fcn.0041d140
push 0x5566b4
mov ecx, dword [ebp + 8]
call fcn.0041d0a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x4c3fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5566c0]
and eax, 1
jne 0x4c3fe3
mov ecx, dword [0x5566c0]
or ecx, 1
mov dword [0x5566c0], ecx
mov ecx, 0x5566bc
call fcn.0041d080
push 0x52bc60
call fcn.004f8227
add esp, 4
cmp dword [0x5524c4], 0
je 0x4c40a0
mov dword [0x5524c4], 0
xor edx, edx
mov word [ebp - 0x208], dx
push 0x1fe
push 0
lea eax, [ebp - 0x206]
push eax
call fcn.004f7580
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [ebp - 0x208]
push ecx
call fcn.004c6230
add esp, 8
test eax, eax
je 0x4c4044
lea edx, [ebp - 0x208]
push edx
mov ecx, 0x5566bc
call fcn.0041d140
jmp 0x4c40a0
mov dword [ebp - 0x20c], 0x200
mov dword [ebp - 0x210], 1
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x538c1c
push 0x538c24
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c40a0
xor eax, eax
mov word [ebp - 0x1c8], ax
lea ecx, [ebp - 0x208]
push ecx
mov ecx, 0x5566bc
call fcn.0041d140
push 0x5566bc
mov ecx, dword [ebp + 8]
call fcn.0041d0a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x4c4320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
mov dword [ebp - 4], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push str.State
push str.SOFTWARE360Safe_safemonSoftPriv
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 0
jne 0x4c4366
xor eax, eax
jmp 0x4c436b
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4c4420
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c4494
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004ff8fc
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
jmp 0x4c4496
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4d6b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
jne 0x4d6b86
xor eax, eax
jmp 0x4d6c1a
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4d6c02
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x18]
mov edx, dword [eax + 0xc]
call edx
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x18]
call eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d6c60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x14], 0
jne 0x4d6c76
xor eax, eax
jmp 0x4d6d22
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocStringLen
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4d6d20
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call fcn.004f5e5a
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004f7a71
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x4d6d22
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d7bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x40c], 0
je 0x4d7c0f
mov eax, 1
jmp 0x4d7d2b
mov ecx, dword [ebp - 0x20]
add ecx, 0x410
call fcn.0041d2b0
push eax
call fcn.0045ff30
add esp, 4
test eax, eax
je 0x4d7c44
mov ecx, dword [ebp - 0x20]
add ecx, 0x410
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0
jne 0x4d7c53
xor eax, eax
jmp 0x4d7d2b
push str.EngLib_Init
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4d7c89
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], 0
xor eax, eax
jmp 0x4d7d2b
mov edx, dword [ebp - 0x20]
mov dword [edx + 8], 0x404
mov eax, dword [ebp - 0x20]
add eax, 8
push eax
call dword [ebp - 0x14]
test eax, eax
jne 0x4d7cad
mov ecx, dword [ebp - 0x20]
call fcn.004d7d30
xor eax, eax
jmp 0x4d7d2b
mov dword [ebp - 0xc], str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push str.ProxyEnable
mov ecx, dword [ebp - 0xc]
push ecx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp dword [ebp - 4], 0
jne 0x4d7d19
mov dword [ebp - 0x1c], 1
lea edx, [ebp - 0x1c]
push edx
push 3
mov ecx, dword [ebp - 0x20]
call fcn.004d8480
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x18]
push eax
push 4
mov ecx, dword [ebp - 0x20]
call fcn.004d8440
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x40c], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4d8c30
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x10]
call fcn.0041d080
lea eax, [ebp - 0x10]
push eax
call fcn.0042e9d0
add esp, 4
push str.deepscan_speedmem2.tmp
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.0041bc20
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4d8ca0
mov dword [ebp - 8], 0
jmp 0x4d8cb9
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.deepscan_speedmem2.hg
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.0041bc20
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d8d07
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
jmp 0x4d8d2b
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4d8d3a
mov dword [ebp - 8], 0
jmp 0x4d8d44
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 0x14]
call fcn.0041d100
lea ecx, [ebp - 0x10]
call fcn.0041d100
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x4d94e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x4d94fb
mov eax, 1
jmp 0x4d95cf
push 0x539d8c
push str.360conf.dll
lea ecx, [ebp - 4]
push ecx
call fcn.0041b740
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d953b
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0xc]
jmp 0x4d95cf
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call fcn.0045ff60
add esp, 4
test eax, eax
je 0x4d9568
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call fcn.0042d610
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d9582
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x10]
jmp 0x4d95cf
push str.CreateObject
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0
jne 0x4d95b4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x14]
jmp 0x4d95cf
mov eax, dword [ebp - 0x1c]
mov dword [eax], 1
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x4d98a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x14
call fcn.004f8259
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d98cd
mov ecx, dword [ebp - 0x18]
call fcn.004d9810
mov dword [ebp - 0x1c], eax
jmp 0x4d98d4
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d995d
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.004db980
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0041d140
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0x4d97b0
call fcn.004ffe46
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4d9955
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4d9943
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp 0x4d9955
lea ecx, [ebp - 0xc]
call fcn.004db9e0
mov edx, dword [ebp - 8]
mov dword [edx + 8], 1
lea ecx, [ebp - 0xc]
call fcn.004db9a0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4d9990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x14
call fcn.004f8259
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d99bd
mov ecx, dword [ebp - 0x18]
call fcn.004db130
mov dword [ebp - 0x1c], eax
jmp 0x4d99c4
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d9a57
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
call fcn.004dba10
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0041d140
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0041d140
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x4d97b0
call fcn.004ffe46
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4d9a4f
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4d9a3d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
jmp 0x4d9a4f
lea ecx, [ebp - 0xc]
call fcn.004dba70
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 1
lea ecx, [ebp - 0xc]
call fcn.004dba30
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4d9c90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.004db260
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d9cab
xor eax, eax
jmp 0x4d9d44
mov ecx, dword [ebp - 4]
call fcn.004db390
test eax, eax
je 0x4d9cc1
mov eax, 1
jmp 0x4d9d44
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x539dc8
push 0x539de8
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041b740
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d9d0b
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0xc]
call fcn.0041d100
mov eax, dword [ebp - 0x14]
jmp 0x4d9d44
lea ecx, [ebp - 0xc]
call fcn.0041d2b0
push eax
mov ecx, dword [ebp - 4]
call fcn.004db3b0
test eax, eax
je 0x4d9d33
mov ecx, dword [ebp - 4]
call fcn.004db390
test eax, eax
je 0x4d9d33
mov dword [ebp - 8], 1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0xc]
call fcn.0041d100
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x4daba0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x33c]
mov edx, dword [ecx + 4]
push edx
call fcn.004db860
add esp, 8
cmp dword [ebp - 8], 0
je 0x4dad5a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x33c]
call fcn.004dab70
test eax, eax
jne 0x4dac09
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jbe 0x4dac15
mov dword [ebp - 4], 0
jmp 0x4dad5a
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.004f7580
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x338]
push edx
call fcn.004f7580
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004f7580
add esp, 0xc
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0xffffffff
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 4]
push eax
call fcn.004db820
add esp, 0x14
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x4dacd9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 4]
push eax
call fcn.004db860
add esp, 8
jmp 0x4dabdc
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0x186a0
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x22c]
add edx, 1
push edx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xffffffff
je 0x4dad36
jmp 0x4dad38
jmp 0x4dad55
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 4]
push eax
call fcn.004db860
add esp, 8
mov dword [ebp - 4], 1
jmp 0x4dabdc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4dcf50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0xffffffff
je 0x4dcf97
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x4dcf80
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x4dcfd5
push 0x1f4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4dcfd5
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x248], 0
je 0x4dcff1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x248]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x248], 0
je 0x4dd00d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24c]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x248], 0
je 0x4dd029
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x250]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x248], 0
je 0x4dd045
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x254]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
add eax, 0x230
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov esp, ebp
pop ebp
ret
Function at 0x4e0440
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
call fcn.00415eb0
test eax, eax
je 0x4e0459
xor eax, eax
jmp 0x4e0589
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
je 0x4e046b
mov eax, 1
jmp 0x4e0589
mov dword [ebp - 8], str.360SoftPrivMgr.dll
mov ecx, dword [ebp - 8]
push ecx
push str._safemon_
lea edx, [ebp - 0x10]
push edx
call fcn.004163f0
add esp, 4
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041bc20
add esp, 0xc
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0041bc20
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0041d100
lea ecx, [ebp - 0x10]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e04db
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x18]
jmp 0x4e0589
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call fcn.0045ff30
add esp, 4
test eax, eax
je 0x4e0505
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], 0
je 0x4e053b
push str.Create360SoftPrivMgrObj
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4e053b
push str.adpopwnd
push str.PopWndTracker
call dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0
je 0x4e0557
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x1c]
jmp 0x4e0589
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], 0
je 0x4e0577
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
mov dword [eax + 4], 0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x4edd20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x810], 1
push 0x53a3a8
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x53a3ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x4ede8c
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x4ede32
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x4ede0e
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, 0x556f6c
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x4eddc6
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, 0x556f6c
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x53a3b8
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x4edd78
mov ecx, 0x556f6c
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x4ee150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xfeff
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4ee183
xor eax, eax
jmp 0x4ee1c5
push 0
lea ecx, [ebp - 4]
push ecx
push 2
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x4ee1bb
cmp dword [ebp - 4], 2
jne 0x4ee1bb
mov dword [ebp - 0x10], 1
jmp 0x4ee1c2
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret