joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1894
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x5ed47f
call fcn.00593b07
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x84]
call fcn.0040ba47
and dword [ebp - 4], 0
push 0x170
call fcn.005926f7
pop ecx
mov dword [ebp - 0x88], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040b6b1
sub esp, 0x18
mov ebx, eax
mov ecx, esp
xor eax, eax
mov byte [ebp - 4], al
push esi
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00430a1f
add esp, 0x18
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040b8cb
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00430a1f
add esp, 0x18
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0040b9f4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
push 0x12c
mov ecx, ebx
call fcn.0040b8d4
cmp byte [ebp + 8], 0
je 0x4d1958
push ecx
call fcn.0040ba13
push ebx
call fcn.0040bde3
cmp dword [edi + 0x14], 8
mov esi, eax
mov ecx, edi
jb 0x4d196a
mov ecx, dword [edi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test esi, esi
jne 0x4d1a0e
test al, al
je 0x4d1a0e
and dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x18], esi
push edi
call fcn.0040b155
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], 4
je 0x4d19ea
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.00425312
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.004167f1
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
pop ecx
cmovae edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push dword [ebp - 0x34]
cmovae ecx, dword [ebp - 0x2c]
call fcn.0041e2eb
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00404812
push 0x1ab6
push 0x66cfa4
push str.__s__d___download_inspire_video_success
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
xor ebx, ebx
inc ebx
jmp 0x4d1a10
xor bl, bl
lea ecx, [ebp - 0x84]
call fcn.0040ba62
mov al, bl
call fcn.00593ab1
ret

Function at 0x4d2071
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x4d2098
push ecx
push ecx
mov dword [ebp - 4], ecx
call fcn.005bb02f
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x4d276a
Capabilities:
Check if file exists

Disassembly:
push 0xa0
mov eax, 0x5ed5fa
call fcn.00593b07
mov esi, edx
mov dword [ebp - 0xa8], esi
mov edi, ecx
mov dword [ebp - 0xa4], edi
push ecx
push 0x63d74c
mov ecx, esi
mov dword [ebp - 0xa4], edi
call fcn.0040aff3
xor ebx, ebx
cmp eax, 0xffffffff
je 0x4d27b6
push esi
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.0040b155
jmp 0x4d291b
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004ced2c
push str.bkinfomouse_set_config
mov byte [ebp - 4], 1
call fcn.005baec0
pop ecx
push eax
push str.bkinfomouse_set_config
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], ebx
push eax
push str.beautify_need_engine
mov edx, str.Software360360huabaohuabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425cdd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d28e5
push 0x61ee2e
lea ecx, [ebp - 0x58]
call fcn.004045aa
push 0xfde9
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00426889
pop ecx
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.004166a4
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00404812
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404267
lea ecx, [ebp - 0xa0]
call fcn.00430ab2
mov esi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x88]
mov edx, dword [ebp - 0xa8]
push str.___engine
call fcn.0041154e
push esi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.00420b1c
add esp, 0x20
lea ecx, [ebp - 0x40]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x70]
call fcn.0040b67e
lea ecx, [ebp - 0x88]
call fcn.0040b67e
lea ecx, [ebp - 0xa0]
call fcn.0040b67e
lea ecx, [ebp - 0x58]
call fcn.00404812
jmp 0x4d28ee
push esi
lea ecx, [ebp - 0x40]
call fcn.00413220
mov byte [ebp - 0xa8], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0xa8]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.0040b632
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
mov eax, edi
call fcn.00593ab1
ret
Function at 0x4d6310
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5ede53
call fcn.00593b07
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x5c], edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.004ced2c
push 0x632898
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0041151f
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0040b67e
cmp esi, 1
jne 0x4d636c
mov esi, str.mouse_preview_config
jmp 0x4d63be
cmp esi, 2
jne 0x4d6378
mov esi, str.mouse_set_config
jmp 0x4d63be
cmp esi, 3
jne 0x4d6384
mov esi, str.taskbar_preview_config
jmp 0x4d63be
cmp esi, 4
jne 0x4d6390
mov esi, 0x633254
jmp 0x4d63be
cmp esi, 5
jne 0x4d639c
mov esi, str.taskbar_setting_config
jmp 0x4d63be
cmp esi, 6
jne 0x4d63a8
mov esi, str.startmenu_set_config
jmp 0x4d63be
cmp esi, 7
jne 0x4d63b4
mov esi, str.startmenu_preview_config
jmp 0x4d63be
cmp esi, 8
jne 0x4d63cf
mov esi, str.video_config
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d6401
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.004046c1
jmp 0x4d6484
mov dword [ebp - 0x68], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov dword [ebp - 0x5c], ebx
call fcn.0041e238
pop ecx
test eax, eax
jne 0x4d6436
cmp dword [ebp - 0x5c], eax
jne 0x4d6465
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
call fcn.0040464f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0x68]
call fcn.0041e3bd
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, edi
call fcn.00593ab1
ret
Function at 0x4d65d1
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x5edef3
call fcn.00593b07
mov edi, edx
mov esi, ecx
mov ebx, 0x61ee2e
push ebx
call fcn.005ae8e0
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040464f
lea ecx, [ebp - 0x74]
call fcn.004ced2c
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x64], ebx
je 0x4d6708
push 0x62aa1c
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x44]
call fcn.0041154e
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004114f9
mov byte [ebp - 0x78], bl
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x78]
mov dword [ebp - 0x1c], ebx
push eax
mov dword [ebp - 0x18], ebx
call fcn.0040b632
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d6700
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x4d6700
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0040b0d5
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00426e0a
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.0040b67e
test esi, esi
je 0x4d66f8
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x44]
call fcn.00430a1f
add esp, 0x18
mov ecx, edi
push eax
call fcn.00409145
lea ecx, [ebp - 0x44]
call fcn.00404812
mov bl, 1
lea ecx, [ebp - 0x5c]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x74]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x4d78a6
Capabilities:
Check if file exists

Disassembly:
push 0x84
mov eax, 0x5ee257
call fcn.00593b07
mov esi, ecx
push str.143359e8_f4b9_4010_a5e5_789147203fa5
xor ebx, ebx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4d78da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4d7a2b
cmp dword [0x6d2c50], 1
jne 0x4d7a24
lea ecx, [ebp - 0x2c]
call fcn.004c2598
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0
je 0x4d790e
mov edi, 0x62b0fc
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
lea eax, [ebp - 0x2c]
mov edi, 0x62cf58
push eax
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.00440e2c
add esp, 0xc
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.0041151f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
mov edx, eax
mov dword [esp], 0x62b23c
call fcn.0041151f
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004114f9
mov byte [ebp - 0x90], bl
lea ecx, [ebp - 0x44]
push dword [ebp - 0x90]
mov dword [ebp - 0x34], ebx
push eax
mov dword [ebp - 0x30], ebx
call fcn.0040b632
lea ecx, [ebp - 0x5c]
call fcn.0040b67e
lea ecx, [ebp - 0x74]
call fcn.0040b67e
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
call fcn.0040b67e
push 8
pop esi
cmp dword [ebp - 0x30], esi
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
mov edi, str.LaunchHbProcess
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x18], esi
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x2100
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d7a12
cmp dword [ebp - 0x18], esi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x4d7a12
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x44]
call fcn.004383a4
test al, al
jne 0x4d7a12
push 0x2104
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x4d7a2b
mov ecx, esi
call fcn.0047c425
call fcn.00593ab1
ret

Function at 0x4d7d9c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
call fcn.004d7c8e
cmp dword [eax + 0x14], 8
jb 0x4d7dbc
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.0040b67e
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.005926d8
leave
ret
Function at 0x4d8ad4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
mov dword [ebp - 0xa08], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, eax
lea eax, [ebp - 0xa08]
push eax
push ebx
push ebx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push dword [ebp - 0xa08]
call fcn.005b9322
pop ecx
mov ebx, eax
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0xa08]
push ebx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push str.Default
push ebx
call fcn.005bc1fb
push ebx
lea eax, [ebp - 0x204]
push eax
push str.360ThemeMenu.Mutex._s._s
lea eax, [ebp - 0xa04]
push 0x400
push eax
call fcn.0042935d
push ebx
call fcn.005b92e1
add esp, 0x20
lea eax, [ebp - 0xa04]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
pop edi
pop ebx
test eax, eax
je 0x4d8bac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4d8bae
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005926d8
leave
ret
Function at 0x4d97b9
Capabilities:
Check if file exists

Disassembly:
push 0xb4
mov eax, 0x5ee7c3
call fcn.00593b07
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x80], esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004ced2c
mov edi, str._bkinfocustommyCustomizeList
mov byte [ebp - 4], 1
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d9836
mov byte [ebp - 0x7c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x7c]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
jmp 0x4d99d8
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
push eax
push str.loop_wallpaper_id
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425cdd
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00404ba6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0xa0]
cmovae ecx, dword [ebp - 0x28]
call fcn.0043676c
test eax, eax
je 0x4d99b6
lea ecx, [ebp - 0xa0]
call fcn.004056d7
test al, al
jne 0x4d98ac
push 0x22a6
push str.GetCurCustomLoopData
push str.__s__d___jValue_is_not_object
call fcn.0040a649
add esp, 0xc
jmp 0x4d99b6
push str.list
lea ecx, [ebp - 0xa0]
call fcn.00405401
push eax
lea ecx, [ebp - 0xb0]
call fcn.00404cc0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 3
call fcn.004056c6
test al, al
je 0x4d99ab
lea eax, [ebp - 0x90]
push eax
call fcn.004057e8
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004057b0
jmp 0x4d9991
lea ecx, [ebp - 0x88]
call fcn.004049ac
push eax
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc0]
push 0x633e58
mov dword [ebp - 0x7c], ebx
call fcn.00405401
lea edx, [ebp - 0x7c]
mov ecx, eax
call fcn.00436e86
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x80]
jne 0x4d9977
lea ecx, [ebp - 0x60]
call fcn.00406b04
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00406b1f
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x78]
call fcn.00404812
lea ecx, [ebp - 0x60]
call fcn.004065e4
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 3
call fcn.00404dbc
lea ecx, [ebp - 0x88]
call fcn.004049b2
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x88]
call fcn.004049b7
test al, al
je 0x4d9902
lea ecx, [ebp - 0xb0]
call fcn.00404dbc
mov byte [ebp - 0x7c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x7c]
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0xa0]
call fcn.00404dbc
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, esi
call fcn.00593ab1
ret
Function at 0x4dced5
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4dd02c
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4dd02c
cmp eax, 0x29
jne 0x4dcf12
cmp dword [esi + 0x10], 0
jne 0x4dd02c
cmp eax, eax
jne 0x4dcf12
test dword [esi + 0x50], edx
je 0x4dd032
cmp eax, 0x2e
jne 0x4dcf2d
push 5
lea ecx, [esi + 0x24]
call fcn.004dd10c
mov ecx, esi
call fcn.004dceac
jmp 0x4dd016
cmp eax, 0x5c
jne 0x4dcf82
mov ecx, esi
call fcn.004dceac
test byte [esi + 0x50], 0x80
je 0x4dcf76
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x4dcf5e
push 4
lea ecx, [esi + 0x24]
call fcn.004dd10c
mov ecx, esi
call fcn.004dceac
jmp 0x4dd01d
cmp eax, 0x42
jne 0x4dcf76
push 4
lea ecx, [esi + 0x24]
call fcn.004dd10c
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4dcf52
mov ecx, esi
call fcn.004de177
jmp 0x4dd016
cmp eax, 0x5b
jne 0x4dcfa2
mov ecx, esi
call fcn.004dceac
mov ecx, esi
call fcn.004de12b
cmp dword [esi + 0x4c], 0x5d
je 0x4dcf21
push 4
jmp 0x4dd034
cmp eax, 0x28
jne 0x4dcfbf
mov ecx, esi
call fcn.004dceac
mov ecx, esi
call fcn.004de258
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4dd032
jmp 0x4dd00b
cmp eax, 0x5e
jne 0x4dcfc8
push 2
jmp 0x4dcf4a
cmp eax, 0x24
jne 0x4dcfd4
push 3
jmp 0x4dcf4a
cmp eax, 0x2a
je 0x4dd028
cmp eax, 0x2b
je 0x4dd028
cmp eax, 0x3f
je 0x4dd028
cmp eax, 0x7b
je 0x4dd028
cmp eax, 0x7d
jne 0x4dcff2
test dword [esi + 0x50], edx
je 0x4dd024
cmp eax, 0x5d
jne 0x4dcffc
test dword [esi + 0x50], edx
je 0x4dcf9b
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004de437
mov bl, 1
mov ecx, esi
call fcn.004dceac
test bl, bl
je 0x4dd01d
mov ecx, esi
call fcn.004de35d
mov cl, 1
jmp 0x4dcedc
push 6
jmp 0x4dd034
push 0xa
jmp 0x4dd034
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.004db876
int3

Function at 0x4e15ca
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5d9eb0
call fcn.00593b07
mov esi, ecx
call fcn.00414f54
test eax, eax
je 0x465dcf
mov ecx, esi
call fcn.0046600c
jmp 0x465de6
push 0xce
push str.C360SafeHbMgr::RunTask
push str.__s__d___not_run_OnTimerEver5Second
call fcn.0040a649
add esp, 0xc
call fcn.00466ec8
test eax, eax
je 0x465e5c
lea ecx, [ebp - 0x40]
call fcn.004251b3
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
push str.360browser_bkinfolocalbk_
lea ecx, [ebp - 0x28]
call fcn.0041154e
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465e38
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.00427db0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
mov al, 1
call fcn.00593ab1
ret
call fcn.00465e64
mov ecx, eax
jmp 0x465daf

Function at 0x4e16b5
Capabilities:
Check if file exists

Disassembly:
call fcn.004511b9
jmp fcn.00450f4b
Function at 0x4e28f2
Capabilities:
Check if file exists

Disassembly:
push 0x74
mov eax, 0x5ef2af
call fcn.00593b07
xor ebx, ebx
lea ecx, [ebp - 0x58]
mov edi, ebx
mov dword [ebp - 0x74], edi
call fcn.004c3ef9
push 0x62b0fc
lea edx, [ebp - 0x58]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
call fcn.0041154e
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e2a29
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00426e0a
test eax, eax
je 0x4e2a21
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
lea edx, [ebp - 0x80]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.00427bdf
mov esi, dword [ebp - 0x80]
jmp 0x4e2a10
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x70]
call fcn.00430a1f
add esp, 0x18
mov byte [ebp - 4], 4
or edi, 1
mov ecx, eax
mov dword [ebp - 0x74], edi
call fcn.00426fd8
test al, al
je 0x4e29d7
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov ecx, esi
cmovae edx, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x4e29cc
mov ecx, dword [esi]
call fcn.004270e4
test eax, eax
jns 0x4e29d7
mov bl, 1
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 3
and edi, 0xfffffffe
call fcn.00404812
test bl, bl
je 0x4e2a0a
sub esp, 0x18
lea ecx, [ebp - 0x58]
mov eax, esp
push esi
push ecx
push eax
call fcn.00429700
add esp, 0xc
mov cl, 1
call fcn.00425b4a
add esp, 0x18
push 0
add esi, 0x18
pop ebx
cmp esi, dword [ebp - 0x7c]
jne 0x4e2986
lea ecx, [ebp - 0x80]
call fcn.004132f0
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x58]
call fcn.0040b67e
call fcn.00593ab1
ret
Function at 0x4e2a47
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x5dd231
call fcn.00593b07
mov esi, ecx
push 0x216
mov ebx, str.TaskRunner::RelaunchProcess
push ebx
push str.__s__d___Update:_RelaunchProcess
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0x62b0fc
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004c41a8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040b67e
add esi, 0x30
push 8
pop edi
mov ecx, esi
cmp dword [esi + 0x14], edi
jb 0x4e2aa4
mov ecx, dword [esi]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x219
push ebx
push str.__s__d___szExePath___s_m_strCmd__s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x4e2b14
push 0x21c
push ebx
push str.__s__d___ShellExecute_start___
call fcn.0040a649
add esp, 0xc
cmp dword [esi + 0x14], edi
jb 0x4e2af2
mov esi, dword [esi]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push esi
push eax
push 0x6311f8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
call fcn.00593ab1
ret
Function at 0x4eba60
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x4ebaff
push edi
call fcn.004fdd90
add esp, 4
test al, al
jne 0x4ebaff
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4eba88
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.00508f80
add esp, 0xc
test eax, eax
je 0x4ebabc
sub eax, edi
push eax
push 0x2e
push edi
call fcn.00508f80
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4ebabe
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4ebaf7
mov al, byte [edi]
push eax
call fcn.004f9d40
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x4ebad6
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
ret
xor eax, eax
pop edi
ret