joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ae7f
Capabilities:
Hide graphical window

Disassembly:
push 0x20
mov eax, 0x497572
call fcn.00462660
mov edi, ecx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x43b084
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [edi + 0x218], ebx
call fcn.0042783a
mov esi, eax
call fcn.0042d117
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
je 0x43b05c
cmp esi, ebx
je 0x43b05c
lea eax, [ebp - 0x14]
push eax
call fcn.0042c5cf
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00427216
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040e14c
cmp dword [ebp - 0x2c], 0x168
je 0x43b050
push str._._colorrgb_1_77_135__boldtrue_fsize_15__._
lea ecx, [ebp + 8]
call fcn.004130cd
mov eax, dword [ebp - 0x24]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.0040e275
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x498
push dword [edi + 4]
call esi
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x49ec08
push dword [ebp - 0x24]
call fcn.00461ee1
pop ecx
pop ecx
push 0x4a4
push dword [edi + 4]
test eax, eax
jne 0x43afad
call esi
push 1
push 0x12
push 0x64
push 0x188
push 0x104
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ebx, 0x4a5
push ebx
push dword [edi + 4]
call esi
push 1
push 0x18
push 0x18
push 0x181
push 0xeb
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x4a4
push dword [edi + 4]
call esi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [edi + 4]
call esi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43afe8
call esi
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 0x4a5
push ebx
push dword [edi + 4]
call esi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [edi + 4]
call esi
push 1
push 0
push 0
push 0x181
push 0xeb
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [edi + 0x54], 0
jne 0x43b035
lea ecx, [edi + 0x58]
call fcn.00446d05
push dword [ebp - 0x1c]
push dword [edi + 0x220]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0043995f
push eax
lea ecx, [edi + 0x200]
mov byte [ebp - 4], 4
call fcn.004119d8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0040e14c
mov ecx, edi
call fcn.00439faf
jmp 0x43b046
mov ecx, edi
mov dword [edi + 0x218], 1
call fcn.0043a021
lea ecx, [ebp + 8]
call fcn.0040e14c
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041aa48
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.0042bb4c
test eax, eax
jne 0x43b077
mov ecx, dword [ebp - 0x10]
push 1
call fcn.0042bb4c
test eax, eax
je 0x43b07a
xor ebx, ebx
inc ebx
push ebx
mov ecx, edi
call fcn.004367b4
jmp 0x43b08a
mov dword [edi + 0x218], ebx
call fcn.00462738
ret 8
Function at 0x43bf89
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x420
mov eax, 0x49781d
call fcn.004626c9
mov esi, ecx
mov dword [ebp - 0x42c], esi
call fcn.004383e1
xor edi, edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.0041a582
mov dword [esi + 0x48], vtable.CBaseUIImpl_class_CFeedInfoDlg_.0
mov dword [esi + 0x4c], vtable.WTL::CMessageFilter.0
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CFeedInfoDlg.2.0
mov dword [esi + 0x48], vtable.CFeedInfoDlg.1.0
mov dword [esi + 0x4c], vtable.CFeedInfoDlg.0
call fcn.00446b62
lea ecx, [esi + 0x19c]
mov byte [ebp - 4], 2
call fcn.0041a208
mov eax, dword [0x4bd024]
mov dword [esi + 0x1f8], eax
mov eax, dword [0x4bd024]
mov dword [esi + 0x1fc], eax
push 0x4ad860
lea ecx, [esi + 0x200]
mov byte [ebp - 4], 5
call fcn.004130cd
mov eax, dword [0x4bd024]
mov dword [esi + 0x204], eax
mov eax, dword [0x4bd024]
mov dword [esi + 0x208], eax
push 0x4ad860
lea ecx, [esi + 0x20c]
mov byte [ebp - 4], 8
call fcn.004130cd
or dword [esi + 0x214], 0xffffffff
mov dword [esi + 0x218], edi
mov dword [esi + 0x21c], edi
mov dword [esi + 0x220], edi
mov dword [esi + 0x22c], edi
mov dword [esi + 0x230], edi
mov dword [esi + 0x234], edi
mov dword [esi + 0x23c], edi
mov dword [esi + 0x240], edi
mov dword [esi + 0x244], edi
mov dword [esi + 0x24c], edi
mov dword [esi + 0x250], edi
mov dword [esi + 0x254], edi
lea ecx, [esi + 0x25c]
push ecx
mov dword [ebp - 0x428], esp
lea eax, [ebp - 0x421]
mov dword [ebp - 0x428], esp
push eax
mov byte [ebp - 4], 0xc
call fcn.0043852e
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov byte [ebp - 4], 0xd
call fcn.00461390
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.0041c225
add esp, 0x14
push str.Utils360ScreenCapture.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x1f8]
call fcn.00411a2b
xor eax, eax
push 0x206
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.00461390
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0041c38b
add esp, 0x14
lea eax, [ebp - 0x420]
push eax
lea ecx, [esi + 0x1fc]
call fcn.00411a2b
push dword [esi + 0x1fc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43c16b
push edi
push dword [esi + 0x1fc]
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [esi + 0x210], edi
mov dword [esi + 0x54], edi
mov eax, esi
call fcn.0046274c
ret

Function at 0x43d01a
Capabilities:
Create process on windows

Disassembly:
push 5
xor eax, eax
push eax
push eax
push str.http:__bbs.360safe.com_forum_141_1.html
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x43de84
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x43de91
lea esi, [ecx - 0x20]
jmp 0x43de93
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x43dec7
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x43deb8
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43decd
cmp dword [ebp + 0xc], 0
jne 0x43dec7
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x43dee2
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x20]
call fcn.0043d7a9
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x43eef2
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push 5
push eax
push eax
cmp dword [0x4c7d08], eax
je 0x43ef07
push str.http:__chrome.360.cn_bbsjump.html
jmp 0x43ef0c
push str.http:__bbs.360.cn_forum.php_modforumdisplayfid141filtertypeidtypeid10550
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x43fdf4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x43fe01
lea esi, [ecx - 0x20]
jmp 0x43fe03
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x43fe37
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x43fe28
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43fe3d
cmp dword [ebp + 0xc], 0
jne 0x43fe37
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x43fe52
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x20]
call fcn.0043f7a9
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x441313
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4
Function at 0x441f2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push eax
mov byte [ebp - 0x84], 0x30
mov dword [ebp - 0x80], edi
mov byte [ebp - 0x7c], 0x31
mov dword [ebp - 0x78], 1
mov byte [ebp - 0x74], 0x32
mov dword [ebp - 0x70], 2
mov byte [ebp - 0x6c], 0x33
mov dword [ebp - 0x68], 3
mov byte [ebp - 0x64], 0x34
mov dword [ebp - 0x60], 4
mov byte [ebp - 0x5c], 0x35
mov dword [ebp - 0x58], 5
mov byte [ebp - 0x54], 0x36
mov dword [ebp - 0x50], 6
mov byte [ebp - 0x4c], 0x37
mov dword [ebp - 0x48], 7
mov byte [ebp - 0x44], 0x38
mov dword [ebp - 0x40], 8
mov byte [ebp - 0x3c], 0x39
mov dword [ebp - 0x38], 9
mov byte [ebp - 0x34], 0x61
mov dword [ebp - 0x30], 0xa
mov byte [ebp - 0x2c], 0x62
mov dword [ebp - 0x28], 0xb
mov byte [ebp - 0x24], 0x63
mov dword [ebp - 0x20], 0xc
mov byte [ebp - 0x1c], 0x64
mov dword [ebp - 0x18], 0xd
mov byte [ebp - 0x14], 0x65
mov dword [ebp - 0x10], 0xe
mov byte [ebp - 0xc], 0x66
mov dword [ebp - 8], 0xf
call fcn.00492cd8
cmp byte [eax], 0x30
pop ecx
mov edx, eax
jne 0x44200c
cmp byte [eax + 1], 0x58
jne 0x44200c
lea edx, [eax + 2]
mov byte [ebp - 0x85], 1
mov esi, 0x2f30
jmp 0x442045
xor ebx, ebx
cmp cl, byte [ebp + ebx*8 - 0x84]
je 0x44202d
inc ebx
cmp ebx, 0x10
jl 0x44201c
jmp 0x44204e
cmp byte [ebp - 0x85], 0
jne 0x442039
shl edi, 4
or edi, dword [ebp + ebx*8 - 0x80]
inc edx
mov byte [ebp - 0x85], 0
mov cl, byte [edx]
movsx ebx, cl
cmp ebx, esi
jne 0x44201a
push eax
call fcn.004611cd
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461ffa
leave
ret

Function at 0x444ac7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x444ad4
lea esi, [ecx - 0x20]
jmp 0x444ad6
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x444b0a
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x444afb
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x444b10
cmp dword [ebp + 0xc], 0
jne 0x444b0a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x444b25
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x20]
call fcn.00444483
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x4451a1
Capabilities:
Delete file

Disassembly:
push 0
push 0
push 0x3400
push dword [0x4c7d4c]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0042d117
test eax, eax
je 0x4451c6
mov ecx, eax
jmp fcn.0042d225
ret
Function at 0x445c63
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x445c70
lea esi, [ecx - 0x20]
jmp 0x445c72
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x445ca6
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x445c97
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x445cac
cmp dword [ebp + 0xc], 0
jne 0x445ca6
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x445cc1
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x20]
call fcn.0044561f
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x446171
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
call fcn.0042d117
test eax, eax
je 0x446185
mov ecx, eax
pop ebp
jmp fcn.0042cde2
pop ebp
ret 8

Function at 0x446776
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x30]
test ecx, ecx
je 0x4467dc
push esi
mov esi, dword [ebx + 0xb4]
sub esi, dword [ebx + 0xb0]
push edi
sar esi, 2
mov edi, esi
imul edi, edi, 0x6c
push 5
push ecx
add edi, 0x20
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x4467a9
push esi
jmp 0x4467b5
cmp esi, 1
je 0x4467b3
cmp esi, 2
jne 0x4467ca
push 1
push 0x44
push 0x5e
push 0x11e
push edi
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x4467da
cmp esi, 3
jne 0x4467da
push 0
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
ret
Function at 0x447105
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x4984d9
call fcn.00462660
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x10]
push edi
test eax, eax
jne 0x44712d
push eax
jmp 0x447231
call fcn.00446c2a
test eax, eax
jne 0x447238
call fcn.004166de
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x447281
mov eax, dword [edi]
mov edx, dword [esi]
push ebx
push eax
mov ecx, esi
call dword [edx + 0xc]
test eax, eax
je 0x4471ab
push 8
call fcn.00461b07
pop ecx
cmp eax, ebx
je 0x447172
mov ecx, dword [0x4bd024]
mov dword [eax], ecx
mov edi, eax
jmp 0x447174
xor edi, edi
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004119d8
mov dword [edi + 4], esi
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 0xb0]
call fcn.00446e48
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x447281
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, dword [edi]
cmp dword [eax - 8], ebx
je 0x447281
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x447281
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x44722c
push 0x9c70
lea ecx, [ebp - 0x14]
call fcn.004130cd
mov esi, eax
push 0x9c7e
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004130cd
mov esi, dword [esi]
mov eax, dword [eax]
push ebx
push ebx
push 0x30
push esi
push eax
mov byte [ebp - 4], 1
call fcn.004169ba
add esp, 0x14
lea ecx, [ebp + 8]
call fcn.0040e14c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040e14c
mov ecx, dword [ebp - 0x10]
push edi
push ebx
call fcn.00446171
jmp 0x447281
push 0x9c70
lea ecx, [ebp - 0x18]
call fcn.004130cd
mov esi, eax
push 0x9c82
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call fcn.004130cd
xor ebx, ebx
push ebx
push ebx
push 0x30
push dword [esi]
mov byte [ebp - 4], 3
push dword [eax]
call fcn.004169ba
add esp, 0x14
lea ecx, [ebp - 0x10]
call fcn.0040e14c
lea ecx, [ebp - 0x18]
call fcn.0040e14c
call fcn.00462738
ret 4

Function at 0x448461
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x44846e
lea esi, [ecx - 0x20]
jmp 0x448470
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x4484a4
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x448495
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4484aa
cmp dword [ebp + 0xc], 0
jne 0x4484a4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x4484bf
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x20]
call fcn.00447e1d
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x449711
Capabilities:
Get memory capacity

Disassembly:
push 0x7c
mov eax, 0x4986b7
call fcn.004626c9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0xc]
push 0x40
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x10]
pop esi
xor edi, edi
push esi
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x70]
push edi
push eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
call fcn.00461390
push 0x20
mov dword [ebp - 0x70], esi
pop esi
push esi
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.00461390
add esp, 0x18
push str.Kernel32.dll
mov dword [ebp - 0x30], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.GlobalMemoryStatusEx
push ebx
call esi
push 0x4a0438
push ebx
mov dword [ebp - 0x7c], eax
call esi
mov esi, eax
cmp ebx, edi
je 0x4497c0
cmp dword [ebp - 0x7c], edi
je 0x4497c0
cmp esi, edi
je 0x4497c0
lea eax, [ebp - 0x70]
push eax
call dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call esi
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
shld ecx, eax, 0xa
shl eax, 0xa
push ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4497e4
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
push dword [ebp - 0x74]
lea eax, [ebp - 0x7c]
push dword [ebp - 0x78]
push eax
call fcn.00449665
add esp, 0xc
mov ecx, dword [ebp - 0x84]
push eax
mov dword [ebp - 4], edi
call fcn.004119d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.0040e14c
push dword [ebp - 0x64]
lea eax, [ebp - 0x84]
push dword [ebp - 0x68]
push eax
call fcn.00449665
add esp, 0xc
mov ecx, dword [ebp - 0x80]
xor esi, esi
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.004119d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.0040e14c
push dword [ebp - 0x5c]
lea eax, [ebp - 0x80]
push dword [ebp - 0x60]
push eax
call fcn.00449665
add esp, 0xc
mov ecx, dword [ebp - 0x88]
push eax
mov dword [ebp - 4], 2
call fcn.004119d8
lea ecx, [ebp - 0x80]
call fcn.0040e14c
mov eax, esi
call fcn.0046274c
ret
Function at 0x44b129
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push edi
push 0x49d91c
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00463072
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x44b1a3
push esi
push 2
push edi
push ebx
call fcn.00468b4b
push ebx
call fcn.00468a5c
push edi
push edi
push ebx
mov esi, eax
call fcn.00468b4b
push esi
call fcn.0045fbe4
mov edi, dword [ebp + 0xc]
push ebx
push esi
push 1
push eax
mov dword [edi], eax
call fcn.004675f3
add esp, 0x30
cmp eax, esi
jne 0x44b190
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp - 4], 1
jmp 0x44b19b
push dword [edi]
call int.00460f5c
and dword [edi], 0
pop ecx
push ebx
call fcn.00462d6f
pop ecx
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x44c235
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x44c28c
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
push 0x3e8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x44c265
inc edi
cmp edi, 0xf
jl 0x44c24a
cmp edi, 0xf
pop edi
jne 0x44c27f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xfffffffffffffff6
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
xor eax, eax
inc eax
pop esi
ret

Function at 0x44c4c9
Capabilities:
Check http status code
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x4ad860
mov byte [ebp - 0x205], bl
mov byte [ebp - 0x206], bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x20c], eax
cmp eax, ebx
jne 0x44c50b
xor al, al
jmp 0x44c5d3
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
push 0x84000000
push ebx
push ebx
push str.http:__profile.se.360.cn_proxyerr.php
push dword [ebp - 0x20c]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
cmp esi, ebx
je 0x44c5b7
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push ebx
push eax
call fcn.00461390
add esp, 0xc
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push 0x13
push esi
mov dword [ebp - 0x210], 0x100
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x44c595
lea eax, [ebp - 0x204]
push eax
call fcn.00461f4e
pop ecx
cmp eax, 0x193
je 0x44c5a4
cmp eax, 0x197
je 0x44c5a4
mov byte [ebp - 0x205], bl
mov byte [ebp - 0x206], 1
jmp 0x44c5b4
push esi
call fcn.0044c4a3
test al, al
pop ecx
setne byte [ebp - 0x205]
push esi
call edi
cmp byte [ebp - 0x205], bl
jne 0x44c513
push dword [ebp - 0x20c]
call edi
mov al, byte [ebp - 0x206]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00461ffa
leave
ret
Function at 0x44c5f4
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00461390
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str._feedback_ui.cab
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004569a0
mov edi, eax
lea eax, [ebp - 0x43c]
push eax
push 0xffffffffffffffff
push edi
call fcn.00454e7a
mov ebx, dword [ebp - 0x43c]
add esp, 0x14
cmp ebx, esi
jle 0x44c6aa
lea eax, [ebp - 0x43c]
push eax
push esi
push edi
call fcn.00454e7a
lea eax, [ebp - 0x438]
push eax
push esi
push edi
call fcn.00456a21
add esp, 0x18
inc esi
cmp esi, ebx
jl 0x44c686
push edi
call fcn.00456a56
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461ffa
leave
ret

Function at 0x44c6d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.joininexperience
push str.Software360360se6Chrome
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 4], 0
setne al
leave
ret