joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008d20
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], vtable.CMD5Checksum.0
call fcn.10038ae0
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret

Function at 0x10009fe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.WS2_32.dll_bind
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000a0a4
mov esi, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000a099
push edi
push 0x5c
push esi
call fcn.100386f7
push 0x2f
push esi
mov edi, eax
call fcn.100386f7
add esp, 0x10
test edi, edi
jne 0x1000a06a
test eax, eax
jne 0x1000a070
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
cmp edi, eax
jbe 0x1000a070
mov eax, edi
xor edx, edx
mov word [eax + 2], dx
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.360base.dll
push esi
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x1000a0b0
Capabilities:
Get file version info

Disassembly:
mov eax, 0x3810
call fcn.10038740
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x380c], eax
push esi
mov esi, dword [esp + 0x3818]
push edi
mov edi, dword [esp + 0x3820]
xor eax, eax
push 0x37fe
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.10038ae0
add esp, 0xc
cmp dword [esp + 0x3824], 0x60
jb 0x1000a187
lea edx, [esp + 0xc]
push edx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1000a187
cmp eax, 0x3800
ja 0x1000a187
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000a187
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push 0x100537c0
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000a187
mov eax, dword [esp + 8]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push str._d._d._d._d
push edi
call fcn.10009cc0
add esp, 0x18
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x380c]
xor ecx, esp
call fcn.10038723
add esp, 0x3810
ret
mov ecx, dword [esp + 0x3814]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10038723
add esp, 0x3810
ret
Function at 0x1000a1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000a1ba
test al, 0x10
jne 0x1000a1ba
mov eax, 1
ret
xor eax, eax
ret

Function at 0x1000a2b0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x420
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
push ebp
mov dword [esp + 4], eax
mov eax, dword [eax]
push str.255.255.255.0
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x3ff
lea ecx, [esp + 0x25]
push 0
push ecx
mov ebp, eax
mov byte [esp + 0x2c], 0
call fcn.10038ae0
add esp, 0xc
push 0x400
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x1000a331
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor al, al
pop ebp
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10038723
add esp, 0x420
ret 4
push ebx
push esi
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000a38b
mov esi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi], ebx
je 0x1000a38b
movsx ecx, word [eax + 0xa]
mov edi, ebp
and edi, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov eax, esi
lea esp, [esp]
mov edx, dword [esp + 0x18]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.10038770
mov eax, dword [esp + 0x2c]
mov edx, eax
and edx, ebp
add esp, 0xc
cmp edi, edx
je 0x1000a3a8
inc ebx
cmp dword [esi + ebx*4], 0
lea eax, [esi + ebx*4]
jne 0x1000a360
xor al, al
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.10038723
add esp, 0x420
ret 4
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov al, 1
jmp 0x1000a38d
Function at 0x1000ae90
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x808], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.10038ae0
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1000af10
mov eax, 1
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.10038723
add esp, 0x80c
ret
push str.360ver.dll
lea edx, [esp + 0xc]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000aef6
lea edx, [esp + 8]
push esi
push edx
call fcn.1000abe0
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000af5f
lea eax, [esi + 1]
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.10038723
add esp, 0x80c
ret
push edi
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x810]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10038723
add esp, 0x80c
ret

Function at 0x1000af90
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1004
call fcn.10038740
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push 0x1000
lea eax, [esp + 8]
push 0
push eax
call fcn.10038ae0
add esp, 0xc
push 0x10053994
push 0x800
lea ecx, [esp + 0xc]
push ecx
call fcn.1000a920
push esi
push 0x800
lea edx, [esp + 0xc]
push edx
call fcn.1000a920
push 0x10053968
push 0x800
lea eax, [esp + 0xc]
push eax
call fcn.1000a920
push esi
push 0x800
lea ecx, [esp + 0xc]
push ecx
call fcn.1000a920
push str.vL
push 0x800
lea edx, [esp + 0xc]
push edx
call fcn.1000a920
mov eax, dword [esp + 0x100c]
push eax
push 0x800
lea ecx, [esp + 0xc]
push ecx
call fcn.1000a920
push 0x10053924
push 0x800
lea edx, [esp + 0xc]
push edx
call fcn.1000a920
push 0x14
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x1000b0b0
push 0xc8
push 0x100536c8
push 0x100624b8
call fcn.1003ba1c
add esp, 0xc
test eax, eax
jne 0x1000b098
call fcn.1000ae90
test eax, eax
je 0x1000b098
push 5
push 0
push 0
push 0x10062650
jmp 0x1000b0a3
push 5
push 0
push 0
push 0x100624b8
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x1014], 0
je 0x1000b0c1
push 0
call fcn.10039f80
mov ecx, dword [esp + 0x1004]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10038723
add esp, 0x1004
ret
Function at 0x1000b8a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10050248
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100638a4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.10009230
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000b900
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.1000b310
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.10009230
cmp dword [esp + 0x28], 8
jb 0x1000b94d
mov eax, dword [esp + 0x14]
push eax
call fcn.100386ec
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x1000c2b0
Capabilities:
Check for peb beingdebugged flag
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10050378
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x100638a4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x38]
push 0x30
xor eax, eax
push 0x10053a00
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.10009330
mov eax, esi
mov dword [esp + 0x30], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000c317
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x10]
call fcn.1000b310
mov eax, dword [esp + 0xc]
mov esi, 8
cmp dword [esp + 0x20], esi
jae 0x1000c344
lea eax, [esp + 0xc]
push 0x10
push 0x100539f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x168
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0x20], esi
jb 0x1000c379
mov ecx, dword [esp + 0xc]
push ecx
call fcn.100386ec
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10038723
add esp, 0x2c
ret
Function at 0x1000c5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100504d0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100638a4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
push edi
push esi
call fcn.1000c3a0
push 0x10053a64
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.1000b8a0
add esp, 0x14
mov eax, dword [esp + 0x34]
mov ebp, 8
mov dword [esp + 0x58], 0
cmp dword [esp + 0x48], ebp
jae 0x1000c61f
lea eax, [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x1000c631
test al, 0x10
je 0x1000c6a2
push edi
push esi
call fcn.1000c480
push 0x10053a64
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.1000b8a0
add esp, 0x14
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 1
call fcn.10009230
cmp dword [esp + 0x2c], ebp
jb 0x1000c671
mov edx, dword [esp + 0x18]
push edx
call fcn.100386ec
add esp, 4
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x1000c67f
lea eax, [esp + 0x34]
push eax
call ebx
cmp eax, 0xffffffff
je 0x1000c68b
test al, 0x10
je 0x1000c6a2
cmp dword [esp + 0x48], ebp
jb 0x1000c69e
mov eax, dword [esp + 0x34]
push eax
call fcn.100386ec
add esp, 4
xor al, al
jmp 0x1000c6b7
cmp dword [esp + 0x48], ebp
jb 0x1000c6b5
mov ecx, dword [esp + 0x34]
push ecx
call fcn.100386ec
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10038723
add esp, 0x48
ret
Function at 0x1000cde0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, ecx
mov ebp, 1
cmp dword [esi + 0x50], ebp
jne 0x1000cdf5
pop esi
mov eax, ebp
pop ebp
ret 4
cmp dword [esi + 0x54], 0
push ebx
mov ebx, dword [esp + 0x10]
jne 0x1000ce5d
push 0x5c
push ebx
call fcn.100386f7
add esp, 8
test eax, eax
jne 0x1000ce13
mov eax, ebx
jmp 0x1000ce16
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esi], eax
test eax, eax
jne 0x1000ce5a
push ebp
push ebx
call fcn.1000ca20
add esp, 8
test eax, eax
je 0x1000ce38
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
jne 0x1000ce5a
push ebx
push str.Load_DLL__s__fail
push ebp
push 0x10069158
call fcn.10017d90
add esp, 0x10
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
mov dword [esi + 0x54], ebp
mov eax, dword [esi]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Init
push eax
call edi
mov ecx, dword [esi]
push str.Login
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.Uninit
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.CreateP2SPTask
push eax
call edi
mov ecx, dword [esi]
push str.QueryTask
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.QueryTask2
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push str.StartTask
push eax
call edi
mov ecx, dword [esi]
push str.StopTask
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi]
push str.RemoveTask
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi]
push str.StopSeed
push eax
call edi
mov ecx, dword [esi]
push str.SetConfigInfo
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi]
push str.GetFinishMessage
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi]
push str.SetAppMoudleInfo
push eax
call edi
mov ecx, dword [esi]
push str.UpdateRegInfo
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi]
push str.CheckProxy
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi]
push str.CheckProxyEx
push eax
call edi
mov ecx, dword [esi]
push str.CancelCheckProxy
push ecx
mov dword [esi + 0x40], eax
call edi
mov edx, dword [esi]
push str.SetP2spOption
push edx
mov dword [esi + 0x44], eax
call edi
mov dword [esi + 0x48], eax
mov eax, dword [esi + 4]
pop edi
test eax, eax
jne 0x1000cf79
push ebx
push str.Load_DLL__s__object_fail
push ebp
push 0x10069158
call fcn.10017d90
add esp, 0x10
mov ecx, esi
call fcn.1000a260
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
cmp dword [esi + 0x18], 0
je 0x1000cf82
mov dword [esi + 0x58], ebp
push 0
call eax
add esp, 4
pop ebx
mov dword [esi + 0x50], ebp
mov dword [esi + 0x4c], 0
pop esi
mov eax, ebp
pop ebp
ret 4
Function at 0x1000ec10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000ec29
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000ec64
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x1000ec60
lea ebx, [ebx]
cmp esi, eax
jae 0x1000ec64
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1000ec50
cmp esi, eax
jb 0x1000ec6a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x1000ed00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call fcn.10018200
test eax, eax
jne 0x1000ed1a
cmp dword [esi + 0xf8], eax
jne 0x1000ed1e
mov dword [esi + 0xf4], eax
xor eax, eax
pop esi
ret
cmp dword [esi + 0xf4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x1000ed36
call edi
mov dword [esi + 0xf4], eax
call edi
sub eax, dword [esi + 0xf4]
mov ecx, 0xea60
cmp ecx, eax
sbb eax, eax
pop edi
neg eax
pop esi
ret

Function at 0x1000f350
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x808], eax
push ebp
mov ebp, dword [esp + 0x814]
push esi
mov esi, dword [esp + 0x820]
push edi
mov edi, dword [esp + 0x820]
push 0x7ff
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.10038ae0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push esi
push edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000f3fc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000f3fc
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
push 0
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebp
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.10038723
add esp, 0x80c
ret
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.10038723
add esp, 0x80c
ret
Function at 0x1000fe40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x3c
push ebx
push ebp
mov ebx, ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x1000fe6e
push str.MainThread_already_exit_or_not_start_MainThread
push 1
push 0x10069158
call fcn.10017d90
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x18
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x1000fe62
cmp dword [0x100652ec], 0
mov ebp, 0x7530
jne 0x1000fe99
mov ebp, 0xea60
push 0x38
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10038ae0
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
cdq
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x2c], edx
cdq
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov eax, esi
cdq
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x68]
add esp, 0xc
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
push 0xffffffffffffffff
sub esp, 0x38
lea edx, [ebp - 0xbb8]
mov edi, esp
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], edx
mov ecx, 0xe
lea esi, [esp + 0x54]
add ebx, 0x94
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.1000f6f0
test eax, eax
jne 0x1000ff45
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x10]
push ebp
push edi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000ff88
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push ecx
push edx
push str.Handle:_u_SendMsg_d_Timeout
push esi
push 0x10069158
call fcn.10017d90
add esp, 0x14
push 0xffffffffffffffff
mov ecx, ebx
call fcn.1002bb10
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x18
Function at 0x100121c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100504d0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100638a4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
push edi
push esi
call fcn.1000c3a0
push 0x10054428
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.1000b8a0
add esp, 0x14
mov eax, dword [esp + 0x34]
mov ebp, 8
mov dword [esp + 0x58], 0
cmp dword [esp + 0x48], ebp
jae 0x1001222f
lea eax, [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x10012241
test al, 0x10
je 0x100122b2
push edi
push esi
call fcn.1000c480
push 0x10054428
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.1000b8a0
add esp, 0x14
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 1
call fcn.10009230
cmp dword [esp + 0x2c], ebp
jb 0x10012281
mov edx, dword [esp + 0x18]
push edx
call fcn.100386ec
add esp, 4
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x1001228f
lea eax, [esp + 0x34]
push eax
call ebx
cmp eax, 0xffffffff
je 0x1001229b
test al, 0x10
je 0x100122b2
cmp dword [esp + 0x48], ebp
jb 0x100122ae
mov eax, dword [esp + 0x34]
push eax
call fcn.100386ec
add esp, 4
xor al, al
jmp 0x100122c7
cmp dword [esp + 0x48], ebp
jb 0x100122c5
mov ecx, dword [esp + 0x34]
push ecx
call fcn.100386ec
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10038723
add esp, 0x48
ret
Function at 0x100122f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x100638a4]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
mov edi, dword [esp + 0x224]
lea eax, [esp + 8]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.WS2_32.dll_bind
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10012417
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.10038ae0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001240c
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.100386f7
lea edx, [esp + 0x1c]
push 0x2f
push edx
mov esi, eax
call fcn.100386f7
add esp, 0x10
test esi, esi
jne 0x100123d7
test eax, eax
jne 0x100123dd
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1005b784
mov ecx, edi
call fcn.1000b7a0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10038723
add esp, 0x218
ret
cmp esi, eax
jbe 0x100123dd
mov eax, esi
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100123f0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.10009330
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10038723
add esp, 0x218
ret