joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push esi
push ebx
add esp, 4
and esi, 0x45c7
xor esi, 0x11816
sub esi, 0x16c90
pop esi
push eax
or eax, 0xd91
and eax, 0x62a7
add eax, 0x10d34
and eax, 0xe23
pop eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
inc dword [ebx - 0x166b43]
inc dword [eax]
jne 0x4133eb
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4136dc
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x413413
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4136dc
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x413445
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x4136dc
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x41346a
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x4136dc
mov eax, dword [ebp - 0x778]
cmp dword [ebp - 0x3f8], 0
je 0x4137b7
push eax
push esi
add esp, 4
jmp 0x4136f6
or eax, 0x10698
add eax, 0x5a07
pop eax
push edx
push eax
add esp, 4
and edx, 0x4cbf
sub edx, 0x40cc
or edx, 0x182d9
pop edx
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x19b4], ecx
push eax
xor eax, 0x4556
add eax, 0x78d2
sar byte [eax], cl
add byte [ecx + 0x287ac0], al
add byte [eax + 0x51], bl
push eax
add esp, 4
add ecx, 0x7811
or ecx, 0x1145e
sub ecx, 0xe17c
add ecx, 0x59ff
pop ecx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
invalid
xchg ebp, eax
dec eax
invalid

Function at 0x4137d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edx
inc edx
dec ebx
dec ecx
dec edi
inc edi
push ebx
push edx
add esp, 4
call 0x41378a
add byte [edi], dh
inc ecx
xor edi, dword [edx]
dec ebx
cmp bh, byte [ecx]
dec ebp
add esp, 4
or ebx, 0x5ede
pop ebx
push edi
and edi, 0x902e
jmp 0x4137a1
xor edi, 0x12c51
pop edi
mov dword [ebp - 0xab4], 0
jmp 0x413ea2
push esi
push ecx
add esp, 4
jmp 0x4137c5
or esi, 0x9a9e
call 0x4137d9
add byte [ebx + 0x32], cl
inc ebp
dec ecx
dec esi
inc ecx
xor al, byte ds:[ebx + 0x575e04c4]
push edi
add esp, 4
add edi, 0x5dd4
pop edi
mov ecx, dword fs:[0x18]

Function at 0x4137f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push edi
jmp 0x41381a
or edi, 0xc5b
or edi, 0x178d3
pop edi
push edi
or edi, 0x11c67
pop edi
push edx
Function at 0x4139b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [eax], 0xfeb8100
jne 0x4139b9
add byte [ecx + 0x652bf3], al
add byte [ecx + 0xfc2bc3], al
add byte [ebx + 0x56], bl
Function at 0x413b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec edi
dec ecx
add esp, 4
xor ecx, 0x1335b
sub ecx, 0x148ad
pop ecx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x413ba5
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x413e96
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
inc dword [ebx]
inc edx
cmp al, 0x89
test dword [ecx + ebp*8 - 1], esi
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x413e96
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x413bff
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x413e96
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x413c24
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x413e96
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x413c7e
mov eax, dword [ebp - 0x78c]
add eax, 1
mov dword [ebp - 0x78c], eax
invalid
invalid

Function at 0x413b65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
dec edi
dec ecx
add esp, 4
xor ecx, 0x1335b
sub ecx, 0x148ad
pop ecx
mov dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0
jne 0x413ba5
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x413e96
mov edx, dword [ebp - 0x1688]
mov eax, dword [ebp - 0x338]
inc dword [ebx]
inc edx
cmp al, 0x89
test dword [ecx + ebp*8 - 1], esi
push dword [ebp + 0x11]
mov ecx, dword [ebp - 0x794]
mov dword [ebp - 0x520], ecx
jmp 0x413e96
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x168c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1690], edx
cmp dword [ebp - 0x1690], 0
jne 0x413bff
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x520], eax
jmp 0x413e96
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x788], ecx
jne 0x413c24
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x520], edx
jmp 0x413e96
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19c4], ecx
mov edx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x338]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19c8], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19cc], edx
mov dword [ebp - 0x78c], 0
jmp 0x413c7e
mov eax, dword [ebp - 0x78c]
add eax, 1
mov dword [ebp - 0x78c], eax
invalid
invalid
Function at 0x436f70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, esi
mov byte [esi + 0x410], 0
call fcn.00437130
test al, al
jne 0x436fa3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004845b0
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._SystemDrive_
call edi
cmp eax, 3
jne 0x437111
push 2
lea eax, [ebp - 0x20c]
push eax
lea ebx, [esi + 0x208]
push ebx
call fcn.0047f911
add esp, 0xc
test eax, eax
jne 0x437111
cmp word [ebp - 0x208], ax
jne 0x437111
push 0x208
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004845b0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._windir_
call edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0047f291
add esp, 8
test eax, eax
jne 0x437111
push 0x208
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004845b0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._SystemRoot_
call edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0047f291
add esp, 8
test eax, eax
jne 0x437111
push 0x208
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004845b0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._ComSpec_
call edi
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4370c0
sub eax, edx
sar eax, 1
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0047f911
add esp, 0xc
test eax, eax
jne 0x437111
lea ecx, [ebp + edi*2 - 0x20c]
push str.cmd.exe
push ecx
call fcn.0047f291
add esp, 8
test eax, eax
jne 0x437111
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
mov byte [esi + 0x410], al
pop ebx
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret

Function at 0x437130
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
cmp word [esi], 0
jne 0x43715a
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 3
jb 0x437151
cmp eax, 0x104
jb 0x43715a
xor eax, eax
mov word [esi], ax
xor al, al
pop esi
ret
add esi, 0x208
cmp word [esi], 0
jne 0x437187
push 0x103
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 3
jb 0x43717e
cmp eax, 0x104
jb 0x437187
xor ecx, ecx
mov word [esi], cx
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x437190
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x208]
push edi
push str.windir
call ebx
push edi
push str.SystemRoot
call ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x21e]
push ecx
mov word [ebp - 0x220], ax
call fcn.004845b0
mov eax, dword [0x4b2624]
mov edx, dword [str.cmd.exe]
mov ecx, dword [0x4b2628]
mov dword [ebp - 0x14], eax
mov ax, word [0x4b2630]
mov dword [ebp - 0x18], edx
mov edx, dword [0x4b262c]
mov word [ebp - 8], ax
mov eax, esi
mov dword [ebp - 0xc], edx
add esp, 0xc
mov dword [ebp - 0x10], ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x437214
sub eax, edx
lea ecx, [ebp - 0x220]
mov edx, ecx
sar eax, 1
mov edi, 0x104
sub esi, edx
lea edx, [edi + 0x7ffffefa]
test edx, edx
je 0x437252
movzx edx, word [esi + ecx]
test dx, dx
je 0x437252
mov word [ecx], dx
add ecx, 2
sub edi, 1
jne 0x437232
jmp 0x437256
test edi, edi
jne 0x437259
sub ecx, 2
xor edx, edx
mov word [ecx], dx
mov ecx, 0x104
sub ecx, eax
lea edx, [ebp + eax*2 - 0x220]
je 0x437284
cmp ecx, 0x7fffffff
ja 0x437284
push SysReAllocString
lea eax, [ebp - 0x18]
push eax
call fcn.004516d0
lea ecx, [ebp - 0x220]
push ecx
push str.ComSpec
call ebx
lea eax, [ebp - 0x220]
push eax
xor edx, edx
push str.SystemDrive
mov word [ebp - 0x21c], dx
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret

Function at 0x4380e0
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x62c]
push 0
push eax
mov ebx, 1
mov byte [ebp - 0x21c], 0
mov byte [ebp - 0x21b], 0
call fcn.004845b0
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x424]
push 0
push ecx
call fcn.004845b0
add esp, 0xc
lea esi, [ebp - 0x62c]
call fcn.00436f70
test al, al
je 0x438161
mov eax, esi
call fcn.00437130
test al, al
je 0x43817c
call fcn.00436f70
test al, al
je 0x43817c
mov ecx, esi
call fcn.00437190
jmp 0x43817c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
lea edi, [ebp - 0x62c]
call fcn.00436ea0
test al, al
je 0x4381fd
push 0x206
xor esi, esi
lea eax, [ebp - 0x212]
xor edx, edx
push esi
push eax
mov word [ebp - 0x214], dx
call fcn.004845b0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4381fd
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x630]
push eax
push 4
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x630], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4381fd
mov ecx, dword [ebp - 0x630]
movzx edx, word [ecx]
mov ecx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.004374f0
add esp, 8
test al, al
je 0x4381fd
xor ebx, ebx
mov ecx, dword [ebp - 8]
test ebx, ebx
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret
Function at 0x43f950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x43f963
lea eax, [esi + 0xd]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
xor edi, edi
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x43f970
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x43fe90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [ebp - 0x218]
push esi
xor edi, edi
or eax, 0x2001f
push eax
push edi
push edx
push ecx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x214]
mov esi, eax
cmp esi, edi
jne 0x43ff11
xor eax, eax
cmp ecx, edi
je 0x43fef9
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x210], edi
mov esi, eax
mov dword [ebp - 0x214], ecx
cmp eax, edi
je 0x43ff1f
cmp ecx, edi
je 0x43ffe0
push ecx
jmp 0x43ffda
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x20c]
push eax
push edi
push ecx
mov dword [ebp - 0x21c], 0x100
call esi
test eax, eax
jne 0x43ffa0
nop
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x214]
call fcn.0043fe90
mov dword [ebp - 0x218], eax
cmp eax, edi
jne 0x43fff5
lea edx, [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x214]
push edi
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push edi
push edx
mov dword [ebp - 0x21c], 0x100
call esi
test eax, eax
je 0x43ff50
mov eax, dword [ebp - 0x214]
cmp eax, edi
je 0x43ffb7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], edi
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebx]
push eax
push ecx
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x214]
cmp eax, edi
je 0x43ffe0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x214]
cmp ecx, edi
je 0x43ffe2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret 4
Function at 0x440b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49f5d6
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x4c9614]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
mov eax, dword [0x4c9614]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x440], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ecx
push 2
push ecx
push eax
mov byte [esp + 0x44c], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x440b85
call fcn.0043f2e0
mov esi, eax
jmp 0x440c53
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x440b9e
call fcn.0043f2e0
jmp 0x440c4a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x440bb8
call fcn.0043f2e0
jmp 0x440c4a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x440bef
lea eax, [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x440bdc
lea eax, [esp + 0x24]
call fcn.0043f9e0
lea esi, [esp + 0x18]
call fcn.0043f9a0
mov eax, 0x8007000e
jmp 0x440c72
lea esi, [esp + 0x24]
call fcn.0043f2a0
mov dword [esp + 0x440], 1
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x440c12
mov esi, 0x8007000e
jmp 0x440c4c
mov ecx, dword [esp + 0x14]
push ebx
push eax
push ebx
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x440c2f
call fcn.0043f2e0
jmp 0x440c4a
mov ecx, dword [esp + 0x24]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x24]
push edx
lea edx, [esp + 0x20]
call fcn.004409a0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x440c70
lea eax, [esp + 0x24]
call fcn.0043f9e0
jmp 0x440c70
mov eax, esi
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4435c0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x1f0]
test eax, eax
je 0x443614
push 0x4e20
push eax
mov byte [esi + 0x1ec], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4435f3
mov eax, dword [esi + 0x1f0]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1f0], 0
mov dword [esi + 0x1b0], 0
ret
Function at 0x445ed0
Capabilities:
Get common file path

Disassembly:
cmp dword [0x4d0b48], 0
jne 0x445fcc
push 0x4d0b4c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4d0b48], 0
jne 0x445fc1
xor ecx, ecx
push ecx
push 0x28
push 0x4d0730
xor eax, eax
push ecx
mov dword [0x4d0938], 0
mov dword [0x4d0b44], 0
mov word [0x4d0730], ax
mov word [0x4d093c], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x445fb7
push 0x4d0730
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, 0x4d0730
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445f44
push 0x104
sub eax, edx
push 0x4d093c
sar eax, 1
push 0x4d0730
mov dword [0x4d0938], eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x445f78
cmp eax, 0x104
jb 0x445f81
xor edx, edx
mov word [0x4d093c], dx
push 0x4d093c
push 0x4d0730
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x445f9b
mov word [0x4d093c], ax
mov eax, 0x4d093c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445fa3
sub eax, edx
sar eax, 1
mov dword [0x4d0b44], eax
mov dword [0x4d0b48], 1
push 0x4d0b4c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret
Function at 0x44c700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a10e7
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4c9614]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
cmp ecx, 3
jge 0x44c741
xor al, al
jmp 0x44c8d0
push 2
push eax
push 0x4aac48
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x44c8c1
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.004845b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 2
lea esi, [ebp - 0x224]
mov edx, edi
call fcn.00408bd0
mov ebx, eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 0
call fcn.00403ba0
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov eax, 3
xor ecx, ecx
mov byte [ebp - 4], 1
call fcn.00408d30
push eax
lea edx, [ebp - 0x22c]
push edx
mov esi, str.360SANDBOXSHADOW_
mov byte [ebp - 4], 2
call fcn.00403790
push ebx
push eax
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 3
call fcn.00408b30
add esp, 0x14
mov byte [ebp - 4], 4
call fcn.00409700
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c824
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c84a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c870
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c896
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44c8ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x44c8ce
push str.360SANDBOXSHADOW_
push 3
push edi
call fcn.0041b6a0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047e6eb
mov esp, ebp
pop ebp
ret