joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000768d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
inc esp
cmp eax, 0xc4833b38
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x2f4]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x36c], edx
push ecx
push ecx
add esp, 4
or ecx, 0xcf71
sub ecx, 0xcf30
sub ecx, 0x15b7c
pop ecx
push ecx
xor ecx, 0x11add
pop ecx
push esi
jmp 0x100076c6
xor esi, 0x1ef
jmp 0x100076d1
pop esi
mov dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0
jne 0x10007702
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x100079f3
mov edx, dword [ebp - 0x1690]
mov eax, dword [ebp - 0x36c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1694], eax
jne 0x1000772a
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x524], ecx
jmp 0x100079f3
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1694]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1698], edx
cmp dword [ebp - 0x1698], 0
jne 0x1000775c
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x524], eax
jmp 0x100079f3
mov ecx, dword [ebp - 0x36c]
add ecx, dword [ebp - 0x1698]
mov dword [ebp - 0x78c], ecx
jne 0x10007781
mov edx, dword [ebp - 0x798]
mov dword [ebp - 0x524], edx
jmp 0x100079f3
mov eax, dword [ebp - 0x78c]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19d0], ecx
mov edx, dword [ebp - 0x78c]
mov eax, dword [ebp - 0x36c]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19d4], eax
mov ecx, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x36c]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19d8], edx
mov dword [ebp - 0x790], 0
jmp 0x100077db
mov eax, dword [ebp - 0x790]
add eax, 1
mov dword [ebp - 0x790], eax
mov ecx, dword [ebp - 0x78c]
mov edx, dword [ebp - 0x790]
cmp edx, dword [ecx + 0x18]
jae 0x100079e7
mov eax, dword [ebp - 0x790]
mov ecx, dword [ebp - 0x19d0]
mov edx, dword [ebp - 0x36c]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x794], edx
mov eax, dword [ebp - 0x790]
mov ecx, dword [ebp - 0x19d4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19d8]
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19dc], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x1000784b
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x794]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100078fd
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x100078fd
push ecx
call 0x10007888
add byte [eax + 0x47], al
inc ebx
dec esi
dec ebx
dec ebp
inc esp
dec edx
add esp, 4
and ecx, 0x1800b
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x1540c
sub ebx, 0x840f
sub ebx, 0x140b9
pop ebx
mov ecx, dword [ebp - 0x794]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
invalid
invalid
pushal

Function at 0x1000fc62
Capabilities:
Encode data using xor

Disassembly:
sar byte [ebx + 0x17], 1
cmp bl, cl
xor bl, byte [ebx + edx*4 - 0x6ff9f904]
pushfd
ja 0x1000fc65
push es
push es
adc edx, dword [edx + 0x6fc938c]
push es
nop
invalid
Function at 0x100241a2
Capabilities:
Enumerate device drivers on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10151d70
mov eax, dword fs:[0]
push eax
mov eax, 0x4834
call fcn.1012ba20
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x1c], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4840], eax
jne 0x100241ed
xor eax, eax
jmp 0x100242e0
lea eax, [ebp - 0x483c]
mov esi, 0x4000
push eax
push esi
lea eax, [ebp - 0x4830]
push eax
call sub.PSAPI.DLL_EnumDeviceDrivers
test eax, eax
je 0x100242dd
cmp dword [ebp - 0x483c], esi
jae 0x100242dd
push 0x820
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.1012db70
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x4838], esi
push 0x40f
lea eax, [ebp - 0x830]
push eax
push dword [ebp + esi*4 - 0x4830]
call sub.PSAPI.DLL_GetDeviceDriverBaseNameW
test eax, eax
je 0x100242ca
mov eax, dword [edi + 4]
xor ebx, ebx
mov ecx, dword [edi]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x100242ca
mov esi, dword [ebp - 0x4840]
push dword [ecx + ebx*4]
lea eax, [ebp - 0x830]
push eax
call fcn.100534d3
pop ecx
pop ecx
test eax, eax
je 0x100242b5
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x4834]
call fcn.100088c7
and dword [ebp - 4], 0
lea eax, [ebp - 0x4834]
push eax
mov ecx, esi
call fcn.10008790
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4834]
lea ecx, [ecx - 0x10]
call fcn.100078bc
mov eax, dword [edi + 4]
inc ebx
mov ecx, dword [edi]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x1002426a
mov esi, dword [ebp - 0x4838]
inc esi
mov dword [ebp - 0x4838], esi
cmp esi, 0x410
jb 0x10024238
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012b632
leave
ret 8

Function at 0x1002c2df
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
mov ebx, ecx
lea edi, [ebp - 0x24]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebx], vtable.CMemoryHelper.0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
and dword [ebx + 4], 0
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
push str.ntdll
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1002c342
push str.ZwQueryVirtualMemory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push edi
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx + 0x14], eax
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1004197b
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push edi
push 0
push eax
mov dword [esi], vtable.CBootInIWriteWorker.0
call fcn.1012db70
and dword [esi + 4], 0
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x210], edi
xor edi, edi
inc edi
mov dword [ebp - 0x214], edi
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1010e24e
mov ecx, eax
call fcn.1010d6c7
cmp word [ebp - 0x20c], 0
je 0x10041a14
push str.0804
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jmp 0x10041a22
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, 0x804
cmp ax, cx
jne 0x10041a27
mov dword [esi + 4], edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret

Function at 0x10041a79
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
push 0x208
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.1012db70
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
mov dword [esi], ebx
lea eax, [ebp - 0x414]
mov ecx, edi
push 0x208
push eax
call fcn.10041f82
test eax, eax
je 0x10041b3c
push 0x208
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10042160
test eax, eax
je 0x10041b3c
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x10041b10
xor eax, eax
inc eax
mov dword [esi], eax
jmp 0x10041b3e
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
lea eax, [ebp - 0x414]
mov ecx, edi
push eax
call fcn.10042097
test eax, eax
je 0x10041b3c
mov eax, dword [ebp - 0x418]
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x10041b3e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 4
Function at 0x10041bbf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov ebx, 0x208
mov esi, ecx
push ebx
push 0
and dword [edi], 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push ebx
push eax
call fcn.10042160
test eax, eax
je 0x10041c61
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x10041c5a
push ebx
push ebx
push 0x1018d75c
call fcn.1005869a
add esp, 0xc
test eax, eax
je 0x10041c5a
cmp eax, 1
jne 0x10041c61
cmp dword [esi + 4], ebx
jne 0x10041c55
push ebx
push ebx
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
call fcn.1005869a
add esp, 0xc
test eax, eax
je 0x10041c5a
xor eax, eax
inc eax
jmp 0x10041c63
xor eax, eax
inc eax
mov dword [edi], eax
jmp 0x10041c63
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 4

Function at 0x10041f82
Capabilities:
Manipulate boot configuration

Disassembly:
push 0xa24
mov eax, 0x10157398
call fcn.1012b6ae
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
push esi
push eax
call fcn.1012db70
add esp, 0xc
test ebx, ebx
jne 0x10041fb6
xor eax, eax
jmp 0x1004208f
push 0x43
pop edi
push edi
push str._c:_boot.ini
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.10015ce6
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call fcn.10010313
test eax, eax
jne 0x10041feb
inc edi
cmp edi, 0x5a
jle 0x10041fb9
jmp 0x10041faf
lea ecx, [ebp - 0xa30]
call fcn.1011ef02
mov dword [ebp - 4], esi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa30]
call fcn.1011f0e8
test eax, eax
je 0x1004207e
mov edi, 0x800
lea eax, [ebp - 0xa18]
push edi
push esi
push eax
call fcn.1012db70
add esp, 0xc
jmp 0x10042052
push str._boot_loader_
call fcn.10130fe5
pop ecx
push eax
push str._boot_loader_
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x1004206b
xor eax, eax
mov word [ebp - 0xa18], ax
push edi
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xa30]
call fcn.1007bc9e
test eax, eax
jne 0x10042027
jmp 0x1004207e
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.100100b8
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.1011ef42
mov eax, esi
call fcn.1012b658
ret 8
Function at 0x100421d5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x824]
push edi
mov edi, 0x410
push edi
push 0
push eax
call fcn.1012db70
push edi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x824]
mov edi, 0x208
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
ja 0x10042278
test eax, eax
je 0x10042278
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1018da90
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10042278
push str..ini
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test eax, eax
je 0x10042278
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
push esi
call fcn.100100b8
xor eax, eax
inc eax
jmp 0x1004227a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret 8

Function at 0x100425ab
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, 0x208
xor ebx, ebx
push edi
push ebx
push eax
call fcn.1012db70
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x20c]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x102
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x414]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [ebp - 0x414]
push eax
call fcn.10130fe5
mov dword [esp], str.partition_
push esi
lea ebx, [ebp + eax*2 - 0x416]
call fcn.101160fa
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100426a7
mov cx, word [ebx]
lea eax, [ebp - 0x20c]
add edi, 0x14
push 0x104
push eax
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, 0x101811bc
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.101160fa
push ebx
push edi
mov esi, eax
call fcn.101160fa
add esp, 0x10
mov edi, eax
test esi, esi
je 0x100426a2
test edi, edi
je 0x100426a2
push esi
push esi
call fcn.10130fe5
pop ecx
inc eax
push eax
push edi
call fcn.10019f19
xor eax, eax
inc eax
jmp 0x100426a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret 8
Function at 0x10042bbd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x20c]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push edi
push eax
call fcn.10042160
test eax, eax
je 0x10042c59
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.ONLYONCE
push str.UPLOAD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edi, edi
inc edi
test eax, eax
jne 0x10042c78
push ebx
push ebx
push 0x1018d75c
call fcn.1005869a
add esp, 0xc
cmp eax, edi
jne 0x10042c78
push ebx
push ebx
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
call fcn.1005869a
add esp, 0xc
cmp eax, edi
jne 0x10042c78
cmp dword [esi + 4], ebx
je 0x10042c6a
push 0x1018d75c
call fcn.10057cc9
pop ecx
test eax, eax
je 0x10042c71
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret
push str.360safe_System_Repair__select_this_if_the_system_cant_startup_
jmp 0x10042c4f
mov ecx, esi
call fcn.10042c7c
mov eax, edi
jmp 0x10042c5b

Function at 0x100434d8
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 0x814
push edi
push 0
lea esi, [ebx + 4]
push esi
call fcn.1012db70
add esp, 0xc
mov dword [esi], edi
mov edi, str.360safe
lea eax, [ebx + 8]
mov esi, 0x200
push edi
push esi
push eax
call fcn.100100b8
push str.newspy_killer
push esi
lea eax, [ebx + 0x208]
push eax
call fcn.100100b8
push 0
push 0x1a
lea esi, [ebx + 0x408]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10043591
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call edi
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call esi
push str.LogInfo
lea eax, [ebx + 0x408]
push eax
call edi
push 0
lea eax, [ebx + 0x408]
push eax
call esi
push 0x104
lea esi, [ebx + 0x610]
push esi
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....360verify.dll
push esi
call edi
lea eax, [ebx + 4]
push eax
call fcn.101120d7
mov ecx, eax
call fcn.10113539
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1004be83
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x208
push ebx
push eax
call fcn.1012db70
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1012db70
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1004bee5
cmp eax, 0x104
jbe 0x1004bf09
push esi
push 0x208
lea eax, [ebp - 0x414]
push eax
call fcn.100100b8
push 0x1018cfec
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x1018f720
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1004bf97
lea eax, [ebp - 0x20c]
push eax
call fcn.10130fe5
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10008f20
push 0x2a
call fcn.10010082
pop ecx
push ebx
test eax, eax
je 0x1004bf5c
lea ecx, [ebp - 0x20c]
push ecx
push esi
call eax
jmp 0x1004bf6a
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1004bf97
push 0xc
call fcn.10010082
pop ecx
push 0x80
test eax, eax
je 0x1004bf8a
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x1004bf97
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012b632
leave
ret

Function at 0x1004c265
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x10247ec8], esi
jne 0x1004c2a1
push esi
push esi
push esi
push 0x10056de9
push 0x30d40
push esi
mov dword [0x10247ec4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10247ec8], eax
jmp 0x1004c299
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10247ec4], esi
je 0x1004c291
mov eax, dword [0x10247ec0]
pop esi
ret
Function at 0x1004faba
Capabilities:
Get storage device properties

Disassembly:
push 0x38
mov eax, 0x10159840
call fcn.1012b6ae
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x38], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x800
mov dword [ebp - 0x1c], esi
push edi
mov dword [ebp - 0x18], esi
call fcn.1012b7a9
mov ebx, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], esi
push edi
push esi
push ebx
call fcn.1012db70
add esp, 0x10
lea eax, [ebp - 0x38]
push esi
push eax
push edi
push ebx
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x2d1400
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1004fb88
cmp byte [ebx + 0xa], 0
jne 0x1004fb88
mov eax, dword [ebx + 0x1c]
test eax, eax
jle 0x1004fb88
cmp eax, 3
jle 0x1004fb36
add eax, 0xfffffff8
cmp eax, 3
ja 0x1004fb88
push 6
pop ecx
push esi
xor eax, eax
mov dword [ebp - 0x38], esi
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0x18
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push 0x70000
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1004fb88
cmp dword [ebp - 0x2c], 0xc
jne 0x1004fb88
mov eax, dword [ebp - 0x34]
or eax, dword [ebp - 0x30]
je 0x1004fb88
cmp dword [ebp - 0x28], 0
je 0x1004fb88
cmp dword [ebp - 0x24], 0
je 0x1004fb88
cmp dword [ebp - 0x20], 0x200
jne 0x1004fb88
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.1012b7b2
pop ecx
mov eax, esi
call fcn.1012b658
ret
Function at 0x100553f7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push str.Q360DownloadMain
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x10055452
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], esi
je 0x10055452
push dword [ebp - 4]
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10055452
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1005544b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret
Function at 0x1007750e
Capabilities:
Read .ini file

Disassembly:
push 0x214
mov eax, 0x1015ff14
call fcn.1012b6ae
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x10077667
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...uiitem.dat
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x220]
call fcn.100413a9
mov dword [ebp - 4], ebx
xor edi, edi
inc edi
mov byte [ebp - 0x219], 0x4c
push edi
lea eax, [ebp - 0x219]
push eax
push edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.10113d34
test eax, eax
jne 0x100775a8
mov dword [esi + 0x10], edi
jmp 0x10077658
lea ecx, [ebp - 0x220]
call fcn.101130bc
mov edi, eax
test edi, edi
je 0x10077651
cmp word [edi], bx
je 0x100775ff
push 0xa
pop eax
push eax
push edi
call fcn.1012e97a
pop ecx
pop ecx
mov ebx, eax
mov ecx, esi
push edi
test ebx, ebx
je 0x100775ec
xor eax, eax
mov word [ebx], ax
call fcn.10076d11
push 0xa
pop eax
mov word [ebx], ax
lea edi, [ebx + 2]
jmp 0x100775f1
call fcn.10076d11
test ebx, ebx
je 0x100775ff
xor eax, eax
cmp word [edi], ax
push 0xa
pop eax
jne 0x100775c5
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x1024b9f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._netconf.dat
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push 0x5dc
push str.Umxc
push str.MAIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x10], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.1011194f
call fcn.1012b658
ret

Function at 0x1007af9b
Capabilities:
Initialize winsock library

Disassembly:
push 0x19c
mov eax, 0x1016057f
call fcn.1012b6ae
mov esi, ecx
mov dword [ebp - 0x1a4], esi
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], esi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
and dword [ebp - 4], 0
lea ecx, [esi + 8]
and dword [esi + 4], 0
mov dword [esi], vtable.CHostNetworkInfo.0
mov dword [ebp - 0x1a4], ecx
call fcn.1007af5e
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
call fcn.10008950
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.1012b658
ret

Function at 0x1007b6ec
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push 0
push eax
mov edi, ecx
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov esi, eax
lea ecx, [edi + 0x1c]
lea eax, [ebp - 0x108]
push eax
call fcn.10008b31
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.1012b632
leave
ret