joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443511
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x28]
push 1
call fcn.004269a9
push 1
push 0
push 1
push dword [edi + 4]
lea ecx, [ebp - 0x40]
call fcn.00419f27
cmp dword [ebp - 0x30], 0
je 0x4435a0
push 1
lea ecx, [ebp - 0x40]
call fcn.0042689c
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x18]
push str.safemon_skin_browserfix_backgroud.png
push dword [0x577c88]
mov dword [ebp - 0x14], 9
push eax
mov dword [ebp - 0x10], 0xb
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 8], 0x1f
call fcn.0041bbfe
mov ecx, dword [esi]
lea edx, [ebp - 0x14]
add esp, 0xc
push edx
push 7
push dword [eax]
push esi
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x5f8
push dword [edi + 4]
call ebx
push 1
push eax
lea ecx, [edi + 0x1f8]
call fcn.004707ab
push 0x5d4
push dword [edi + 4]
call ebx
push 1
push eax
lea ecx, [edi + 0x54]
call fcn.004707ab
push dword [edi + 4]
lea ecx, [edi + 0x430]
call fcn.004cc381
push 0xa0
mov dword [0x574b08], edi
mov dword [ebp - 0x20], 0x17
mov dword [ebp - 0x1c], 0x74
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x443617
push dword [edi + 0x28]
lea ecx, [ebp - 0x20]
push ecx
push dword [edi + 4]
mov ecx, eax
call fcn.0044497b
jmp 0x443619
xor eax, eax
push 0x60f
push dword [edi + 4]
mov dword [edi + 0x40c], eax
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x610
push dword [edi + 4]
call ebx
push 0
push eax
call esi
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov edx, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
test edx, edx
je 0x443661
push dword [ebp - 0x28]
mov ecx, dword [edx]
push edx
call dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00522d04
leave
ret 8

Function at 0x4454cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
push dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
call fcn.004451a2
mov edi, dword [ebp + 0xc]
cmp edi, 2
je 0x445522
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x445522
mov eax, dword [esi + 0x30]
mov edx, dword [ecx]
push dword [eax + 0x28]
call dword [edx + 0xbc]
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [esi + 0x3c]
call fcn.0044479f
mov ecx, dword [esi + 0x34]
mov eax, dword [ebp - 8]
push 0
mov edx, dword [ecx]
push dword [eax + 0x14]
push 0x51
call dword [edx + 0xc]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov dword [esi + 0x24], 1
pop esi
leave
ret 0xc
Function at 0x4455b5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
mov edi, ecx
lea ecx, [ebp - 0x30]
push 0
push 1
push dword [edi + 4]
call fcn.00419f27
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x44562e
push str.safemon_skin_browserfixcategory_menu_background.png
push dword [0x577c88]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x84
push eax
mov dword [ebp - 0x10], 0x1b
mov dword [ebp - 0xc], 0x108
mov dword [ebp - 8], 0x36
call fcn.0041bbfe
mov ecx, dword [esi]
lea edx, [ebp - 0x14]
add esp, 0xc
push edx
push 7
push dword [eax]
push esi
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
push str.safemon_skin_browserfixcategory_menu_close.png
push dword [0x577c88]
lea eax, [ebp - 0x18]
push eax
call fcn.0041bbfe
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
mov esi, dword [eax]
push 2
push dword [edi + 4]
call ebx
push 1
push 3
push esi
xor esi, esi
push esi
push eax
call fcn.0042067a
mov ecx, dword [ebp - 0x18]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.004042e9
push 2
push dword [edi + 4]
call ebx
push 0x41
push esi
push esi
push 0xa
push 0x177
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.0041bcb9
mov dword [edi + 0x28], eax
test eax, eax
je 0x4456c3
push str.safemon_skin_browserfix_single_dot.png
push dword [0x577c88]
lea eax, [ebp - 0x18]
push eax
call fcn.0041bbfe
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov edx, dword [ecx]
push esi
push dword [eax]
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
call fcn.0041bcb9
mov dword [edi + 0x2c], eax
test eax, eax
je 0x4456fc
push str.safemon_skin_browserfixcategory_menu_dot.png
push dword [0x577c88]
lea eax, [ebp - 0x18]
push eax
call fcn.0041bbfe
mov ecx, dword [edi + 0x2c]
add esp, 0xc
mov edx, dword [ecx]
push esi
push dword [eax]
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
push 0x7fbc
push dword [edi + 4]
call ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0
push dword [edi + 4]
call esi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004042e9
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00522d04
leave
ret 8

Function at 0x445c64
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub eax, ecx
sar eax, 2
cmp dword [ebp + 0xc], edi
je 0x445c9d
test eax, eax
je 0x445cbb
push 5
push dword [ecx + edi*4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
inc edi
mov ecx, dword [esi]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x445c81
jmp 0x445cbb
test eax, eax
je 0x445cbb
push 0
push dword [ecx + edi*4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
inc edi
mov ecx, dword [esi]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x445ca1
pop edi
pop esi
pop ebp
ret 8
Function at 0x4469e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], edx
je 0x446a5a
push edi
lea ecx, [ebp - 4]
mov dword [ebp + 8], edx
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 4
push ecx
push edx
push eax
push str.Software360Safe360DiagnoseScan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp + 8]
push 2
pop edi
cmp eax, edi
jae 0x446a47
push dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push dword [esi]
push str.Software360Safe360DiagnoseScan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, dword [ebp + 8]
push esi
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.0044691a
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4479df
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
test edx, edx
je 0x447b5e
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x447b5e
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x447b5e
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x447b5e
xor esi, esi
cmp edi, 2
jbe 0x447ab7
mov dword [ebp - 8], 4
mov al, byte [edx]
sub edi, 3
mov ah, byte [edx + 1]
mov bl, byte [edx + 2]
add edx, 3
mov byte [ebp - 2], al
and al, 3
shl al, 4
mov byte [ebp + 0xb], al
mov al, ah
shr al, 4
and ah, 0xf
add byte [ebp + 0xb], al
mov al, bl
shl ah, 2
shr al, 6
add ah, al
mov byte [ebp - 1], bl
mov ebx, dword [ebp + 0x10]
mov byte [ebp - 3], ah
cmp dword [ebp - 8], ecx
ja 0x447b51
movzx eax, byte [ebp - 2]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], al
movzx eax, byte [ebp + 0xb]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], al
movzx eax, byte [ebp - 3]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 2], al
movzx eax, byte [ebp - 1]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 3], al
add esi, 4
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp edi, 2
ja 0x447a25
test edi, edi
je 0x447b4d
xor bl, bl
mov word [ebp + 9], 0
xor ah, ah
mov byte [ebp + 8], bl
xor cl, cl
test edi, edi
je 0x447ae9
push edi
push edx
lea eax, [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
mov ah, byte [ebp + 0xa]
add esp, 0xc
mov cl, byte [ebp + 9]
mov bl, byte [ebp + 8]
mov al, cl
shr ah, 6
mov dl, bl
shr al, 4
and bl, 3
shr dl, 2
and cl, 0xf
shl bl, 4
shl cl, 2
add bl, al
add cl, ah
lea eax, [esi + 4]
cmp eax, dword [ebp + 0x14]
ja 0x447b51
movzx eax, dl
mov edx, dword [ebp + 0x10]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, bl
mov ebx, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], al
cmp edi, 1
jne 0x447b35
mov al, 0x3d
jmp 0x447b3e
movzx eax, cl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ecx, dword [ebp + 0x14]
mov byte [esi + ebx + 2], al
mov byte [esi + ebx + 3], 0x3d
add esi, 4
cmp esi, ecx
jb 0x447b56
or eax, 0xffffffff
jmp 0x447b60
mov byte [esi + ebx], 0
mov eax, esi
jmp 0x447b60
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448c9a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp - 0x220]
push 1
mov dword [ebp - 0x214], ebx
call fcn.004269a9
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x43c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
call fcn.00403a64
push eax
lea ecx, [ebp - 0x210]
call fcn.00402a6b
call fcn.0041c55b
test eax, eax
mov eax, str._._size12_boldtrue_colorrgb_101_101_101____.__s
jne 0x448d1a
mov eax, str._._size14_boldtrue_colorrgb_101_101_101____.__s
push eax
lea ecx, [ebp - 0x218]
call fcn.00402af5
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00415254
add esp, 0xc
lea ecx, [esi - 0x10]
call fcn.004042e9
mov esi, dword [ebp - 0x210]
push esi
push 0x43c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0xffffffffffffffff
push dword [ebx + 4]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
call ebx
push 1
push edi
push edi
push 0x1ae
push 0x1e
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
call edi
mov eax, dword [ebp - 0x214]
push 0x43c
push dword [eax + 4]
call ebx
push 1
xor ecx, ecx
push ecx
push ecx
push 0x4c
push 0x1e
push ecx
push eax
call edi
mov edi, dword [ebp - 0x214]
push 0x450
push dword [edi + 4]
call ebx
push eax
lea ecx, [edi + 0x30]
call fcn.0046db4e
push 5
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x200000
push 0
lea ecx, [edi + 0x34]
call fcn.0041a732
lea ecx, [esi - 0x10]
call fcn.004042e9
mov edx, dword [ebp - 0x21c]
pop edi
pop esi
pop ebx
test edx, edx
je 0x448df6
push dword [ebp - 0x220]
mov ecx, dword [edx]
push edx
call dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00522d04
leave
ret 8

Function at 0x44929b
Capabilities:
Create thread

Disassembly:
push esi
xor eax, eax
mov esi, ecx
push eax
push eax
push esi
push 0x4492bd
push eax
push eax
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi + 0xdc], eax
xor eax, eax
inc eax
pop esi
ret
Function at 0x44a22f
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
push edi
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x414]
push edi
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
test ebx, ebx
je 0x44a3dd
push 0x104
lea eax, [ebp - 0x61c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.modules
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
jne 0x44a2e9
push str.sdsp
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
jne 0x44a311
push 0x103
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll_wcsncpy
add esp, 0xc
push 0x533310
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x620]
push eax
call fcn.004db073
mov dword [esp], str.Microsoft_Corporation
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x620]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00402f5d
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.0044b29f
add esp, 0xc
test al, al
je 0x44a38b
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call sub.msvcrt.dll_wcsncpy
mov ecx, dword [ebp - 0x620]
xor edi, edi
add esp, 0xc
inc edi
lea ecx, [ecx - 0x10]
jmp 0x44a3d8
call fcn.0044b4f2
test eax, eax
je 0x44a3cf
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xb
push str.dbgeng.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0051b550
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44a368
mov ecx, dword [ebp - 0x620]
add ecx, 0xfffffff0
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x44a4c1
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x224], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], ebx
push esi
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], esi
lea eax, [ebp - 0x214]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x44a60f
push edi
push 0x577e22
xor ecx, ecx
lea eax, [ebx + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f4050
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x44a60e
push edi
push ebx
push dword [ebp - 0x214]
push dword [ebp - 0x21c]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44a607
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44a607
mov ecx, dword [ebp - 0x220]
push 0x52f8b0
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044b53c
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44a607
mov ebx, dword [ebp - 0x224]
inc esi
test ebx, ebx
je 0x44a607
cmp dword [ebp - 0x210], 0
je 0x44a607
push dword [ebp - 0x210]
call sub.msvcrt.dll_wcslen
push eax
push dword [ebp - 0x210]
push dword [ebp + 0x10]
push ebx
call fcn.00516d90
add esp, 0x14
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x44b087
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0x44b0d5
push dword [ebp + 8]
call fcn.0044b50c
test eax, eax
je 0x44b0d5
mov eax, dword [ebp + 0xc]
push edi
push edi
push esi
push 0x44bde4
push edi
push edi
mov dword [esi], eax
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi + 8], eax
push 0x927c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x44b0dd
mov dword [esi + 0xc], 1
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x44b0d5
xor eax, eax
cmp dword [ebp + 8], 1
sete al
jmp 0x44b0d7

Function at 0x44b1b9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x44b28d
push ebx
push edi
call sub.msvcrt.dll__strlwr
mov ebx, str.ntkrnlmp.exentkrnlpa.exentkrpamp.exentoskrnl.exehalmacpi.dllhalaacpi.dllhalacpi.dllhal.dll_1394bus.sys1394ohci.sysafd.sysacpi.sysatapi.sysataport.SYSCdfs.SYScdrom.sysCLASSPNP.SYScng.sysdisk.sysdxg.sysFastfat.sysfileinfo.sysfltMgr.sysFs_Rec.sysfvevol.sysHdAudio.sysHidUsb.sysHTTP.sysi8042prt.syskbdclass.sysKbdHid.syskmixer.sysks.sysmodem.sysmonitor.sysmouclass.sysMsfs.SYSmssmbios.sysMup.sysNDIS.sysndistapi.sysnetbios.sysNETIO.SYSNpfs.SYSNtfs.SYSNull.SYSSCSIPORT.SYSsr.syssrv.syssrv2.systcpip.systdx.sysusbccgp.sysusbehci.sysusbhub.sysUsbHub3.sysusbohci.sysUSBPORT.SYSusbprint.sysUSBSTOR.SYSusbuhci.sysusbvideo.sysvolmgr.syswatchdog.sysWdf01000.syswin32k.sysdxgmms1.sysdxgkrnl.syspci.sysHDAudBus.sys
push ebx
call sub.msvcrt.dll__strlwr
push edi
push ebx
call sub.msvcrt.dll_strstr
add esp, 0x10
test eax, eax
jne 0x44b289
mov ebx, 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44b28c
push edi
lea eax, [ebp - 0x414]
push eax
push 0x533564
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004329e6
add esp, 0x14
test eax, eax
js 0x44b28c
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0044a4c1
add esp, 0x18
test eax, eax
je 0x44b28c
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll__wcslwr
lea eax, [ebp - 0x20c]
mov dword [esp], str.microsoft
push eax
call sub.msvcrt.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x44b28c
xor esi, esi
inc esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret 4
Function at 0x44bd80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x114], 6
ja 0x44bdd8
jne 0x44bdd6
cmp dword [ebp - 0x110], eax
jae 0x44bdd8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522d04
leave
ret

Function at 0x44bfde
Capabilities:
Check if file exists
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x44c0da
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_wcscpy
lea eax, [ebp - 0x20c]
push str.dbgfiles.cab
push eax
call sub.msvcrt.dll_wcscat
add esp, 0x10
mov ebx, str.http:__sdl.360safe.com_dbgfiles.cab
push ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
push esi
call sub.urlmon.dll_URLDownloadToFileW
pop ebx
test eax, eax
jne 0x44c0bc
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x418]
push eax
call fcn.004db073
add esp, 0x10
lea eax, [ebp - 0x414]
push str.360base.dll
push dword [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0044bf4e
pop ecx
pop ecx
test eax, eax
je 0x44c0ae
push edi
push 0x44beda
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
test eax, eax
je 0x44c0ae
inc esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.004042e9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44c0da
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret
Function at 0x44c0ea
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa34
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
mov ebx, 0x208
mov dword [ebp - 0xa34], esi
push ebx
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x61c]
push edi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x824]
push edi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0xa2c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x3c
mov ebx, edi
test esi, esi
je 0x44c2ef
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44c180
push str.SetDllDirectoryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [ebp - 0xa30]
push eax
call fcn.004db073
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x414]
mov dword [esp], str.modules
push dword [ebp - 0xa30]
push eax
call esi
push 0x533598
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x533310
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
push str.symsrv.dll
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push str.symsrv.yes
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x44c26b
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
je 0x44c26b
lea eax, [ebp - 0x824]
push eax
call esi
test eax, eax
je 0x44c26b
lea eax, [ebp - 0xa2c]
push eax
call esi
test eax, eax
je 0x44c26b
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
call sub.msvcrt.dll_wcsncpy
add esp, 0xc
test ebx, ebx
je 0x44c25d
lea eax, [ebp - 0x414]
push eax
call ebx
mov ecx, dword [ebp - 0xa30]
xor edi, edi
inc edi
lea ecx, [ecx - 0x10]
jmp 0x44c2ea
lea eax, [ebp - 0x414]
push 0x1d4c0
push eax
call fcn.0044bfde
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x44c236
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xc
push str.dbghelp.dll
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0051b550
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x44c2e1
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xa34]
call sub.msvcrt.dll_wcsncpy
add esp, 0xc
jmp 0x44c25d
mov ecx, dword [ebp - 0xa30]
add ecx, 0xfffffff0
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret