joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ab30
Capabilities:
Check if file exists
Get common file path
Get file version info
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x52e8b0
lea ecx, [ebp - 0x224]
call fcn.0043caa0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004ed5e0
add esp, 0xc
push 0
push 0x26
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x49abb5
push str.Internet_Exploreriexplore.exe
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49abb5
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x224]
call fcn.0043cb20
lea ecx, [ebp - 0x224]
call fcn.0043cca0
movzx edx, al
test edx, edx
je 0x49abd7
push str.mshtml.dll
lea ecx, [ebp - 0x224]
call fcn.0043cb20
mov dword [ebp - 0x21c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x224]
call fcn.0043cc50
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x49ad11
mov ecx, dword [ebp - 0x220]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x49ad11
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x224]
call fcn.0043cc50
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49ad04
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x230]
push eax
push 0x52e90c
mov ecx, dword [ebp - 0x228]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x49ad04
cmp dword [ebp - 0x22c], 0
je 0x49ad04
mov edx, dword [ebp - 0x230]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp - 0x230]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x230]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x234], 1
lea ecx, [ebp - 0x224]
call fcn.0043cae0
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x49ad40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
cmp dword [0x55c664], 0
jne 0x49adc5
push 0x24
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004ed5e0
add esp, 0xc
push 0x52e910
push 0x52e924
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49ad8f
lea ecx, [ebp - 0x2c]
push ecx
call dword [ebp - 8]
jmp 0x49ad99
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x2c]
cmp eax, 9
je 0x49adab
movzx ecx, word [ebp - 0x2c]
cmp ecx, 6
jne 0x49adb4
mov dword [ebp - 4], 1
jmp 0x49adbb
mov dword [ebp - 4], 0
mov dword [0x55c664], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49add0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x114
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x49aec8
mov byte [ebp - 0x50], 0
push 0x3f
push 0
lea edx, [ebp - 0x4f]
push edx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x40
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 4]
push edx
push 0x52e934
push 0x52e958
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ae70
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 2
movsx ecx, byte [ebp - 0x50]
sub ecx, 0x30
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
lea eax, [ebp - 0x4e]
push eax
call fcn.004f0652
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
jmp 0x49aec8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
and edx, 0xffff
movzx eax, dx
and eax, 0xff
movzx ecx, al
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x54]
and eax, 0xffff
movzx ecx, ax
shr ecx, 8
and ecx, 0xff
movzx edx, cl
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov ecx, dword [ebp + 8]
mov edx, 4
cmp edx, dword [ecx + 4]
sbb eax, eax
neg eax
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 6
ja 0x49aee3
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 6
jne 0x49af53
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 2
jb 0x49af53
mov dword [ebp - 0x170], 0
push 0x110
push 0
lea edx, [ebp - 0x16c]
push edx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 0x170], 0x114
push 0x52e9b4
push 0x52e9c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x49af53
lea eax, [ebp - 0x170]
push eax
call dword [ebp - 0x58]
test eax, eax
jne 0x49af53
push 0x114
lea ecx, [ebp - 0x170]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ec360
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x49b7c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x49b818
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x49b7fa
xor eax, eax
jmp 0x49b89e
lea ecx, [ebp - 0x14]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x49b818
xor eax, eax
jmp 0x49b89e
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
lea edx, [ebp - 0x20]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x10
lea edx, [ebp - 0x24]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x49b876
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x49b89e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x49b899
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x49b89e
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x49b8c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.0043cca0
movzx eax, al
test eax, eax
je 0x49b8e7
jmp 0x49b984
xor ecx, ecx
mov word [ebp - 0x18], cx
xor edx, edx
mov dword [ebp - 0x16], edx
mov dword [ebp - 0x12], edx
mov dword [ebp - 0xe], edx
mov word [ebp - 0xa], dx
mov ecx, dword [ebp + 8]
call fcn.0043cc50
push eax
lea ecx, [ebp - 0xa0]
call fcn.0046a0b0
mov ecx, eax
call fcn.0046a140
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xa0]
call fcn.0046a110
mov eax, dword [ebp - 0x1c]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49b95f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
cmp dword [edx], 0
je 0x49b95f
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 0xa]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004ec360
add esp, 0xc
movzx eax, byte [ebp - 0x11]
push eax
movzx ecx, byte [ebp - 0x12]
push ecx
movzx edx, byte [ebp - 0x13]
push edx
movzx eax, byte [ebp - 0x14]
push eax
push 0x52eb1c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0043dc90
add esp, 0x18
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x49db90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x24]
call fcn.004752b0
lea ecx, [ebp - 4]
call fcn.0043ca60
lea eax, [ebp - 0x28]
push eax
call fcn.0043e510
add esp, 4
push eax
lea ecx, [ebp - 4]
call fcn.0043cb00
lea ecx, [ebp - 0x28]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cc80
test eax, eax
jg 0x49dbfb
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 0x24]
call fcn.004752e0
mov eax, dword [ebp - 0x2c]
jmp 0x49dce4
push str.SoftMgrNotifyDown.dll
lea ecx, [ebp - 4]
call fcn.0043e6d0
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49dc3a
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 0x24]
call fcn.004752e0
mov eax, dword [ebp - 0x30]
jmp 0x49dce4
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call fcn.0043e620
add esp, 4
test eax, eax
je 0x49dcd4
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call fcn.0046ebc0
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov edx, dword [ebp - 0x3c]
cmp dword [edx], 0
je 0x49dcb8
push str.Load360NotifyExe
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x3c]
mov dword [edx + 4], eax
push str.Get360NotifyExeWnd
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x3c]
mov dword [edx + 8], eax
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 0x24]
call fcn.004752e0
mov eax, dword [ebp - 0x34]
jmp 0x49dce4
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 0x24]
call fcn.004752e0
mov eax, dword [ebp - 0x38]
jmp 0x49dce4
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp - 0x24]
call fcn.004752e0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret

Function at 0x49e130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, 0xfeff
mov word [ebp - 0xc], ax
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
lea ecx, [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49e180
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.0043cae0
mov eax, dword [ebp - 0x10]
jmp 0x49e1c0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 2
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 1
lea ecx, [ebp + 8]
call fcn.0043cae0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x49e2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [0x52f3f8]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0043e510
add esp, 4
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.00483f90
add esp, 0xc
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0043cb00
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 8]
call fcn.0043cae0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x49e346
xor eax, eax
jmp 0x49e3fe
mov eax, dword [0x52f440]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
push 0x52f58c
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call fcn.0043dc90
add esp, 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49e381
xor eax, eax
jmp 0x49e3fe
mov ecx, dword [0x52f418]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
push 0x52f598
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
push ecx
call fcn.0043dc90
add esp, 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49e3bd
xor eax, eax
jmp 0x49e3fe
mov edx, dword [0x52f458]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
push 0x52f5a4
mov edx, dword [ebp - 0x10]
add edx, 0x10
push edx
call fcn.0043dc90
add esp, 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49e3f9
xor eax, eax
jmp 0x49e3fe
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x49e6f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jbe 0x49e719
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jae 0x49e719
mov ecx, dword [ebp + 8]
add ecx, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0043cc50
push eax
push 0
mov edx, dword [0x52f530]
push edx
mov eax, dword [0x52f514]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0043cc50
push eax
push 0
mov ecx, dword [0x52f548]
push ecx
mov edx, dword [0x52f514]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x49e77c
cmp dword [ebp - 4], 0
jne 0x49e780
xor eax, eax
jmp 0x49e7a1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jle 0x49e79f
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0xc]
jbe 0x49e79f
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
jae 0x49e79f
mov eax, 1
jmp 0x49e7a1
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x49e960
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + 8]
call fcn.0043cca0
movzx eax, al
test eax, eax
jne 0x49e9f4
lea ecx, [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49e9f4
lea ecx, [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x49e9e5
mov dword [ebp - 8], 1
mov edx, dword [ebp - 8]
not edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
and eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
lea ecx, [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x49e9e3
lea ecx, [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x49e9f4
lea ecx, [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.0043cae0
mov esp, ebp
pop ebp
ret 4
Function at 0x49f8f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.Utils360SafeChecker.dll
lea eax, [ebp - 0xc]
push eax
call fcn.0049ec40
add esp, 4
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00483f90
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49f939
lea ecx, [ebp - 4]
call fcn.0043cae0
jmp 0x49f9b3
cmp dword [0x55c6dc], 0
jne 0x49f9a1
push str.360SafeChecker.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49f97a
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call fcn.00483b50
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49f97a
lea ecx, [ebp - 4]
call fcn.0043cae0
jmp 0x49f9b3
push str.OpenTrustDlg
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x55c6dc], eax
cmp dword [0x55c6dc], 0
jne 0x49f9a1
lea ecx, [ebp - 4]
call fcn.0043cae0
jmp 0x49f9b3
mov eax, dword [ebp + 8]
push eax
call dword [0x55c6dc]
lea ecx, [ebp - 4]
call fcn.0043cae0
mov esp, ebp
pop ebp
ret

Function at 0x4a4520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4a453d
xor eax, eax
jmp 0x4a45a8
mov dword [ebp - 0x814], 0x400
push 0x808
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.004ed5e0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x810]
push edx
call fcn.004a4990
add esp, 8
lea eax, [ebp - 0x810]
push eax
call fcn.004a49b0
add esp, 4
push str.THEMES_
lea ecx, [ebp - 0x810]
push ecx
call fcn.00497730
add esp, 8
test eax, eax
je 0x4a459e
mov eax, 1
jmp 0x4a45a8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret

Function at 0x4a4a80
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4a4a98
xor eax, eax
jmp 0x4a4b28
mov ecx, dword [ebp - 8]
call fcn.004a5260
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0
call fcn.004a5570
add esp, 8
movzx edx, al
test edx, edx
je 0x4a4afa
mov ecx, dword [ebp - 8]
call fcn.004a4cc0
test eax, eax
jne 0x4a4ac8
xor eax, eax
jmp 0x4a4b28
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
call fcn.004a4dc0
mov ecx, eax
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 4]
call fcn.0043cae0
mov ecx, dword [ebp - 8]
call fcn.004a4b70
test eax, eax
jne 0x4a4afa
xor eax, eax
jmp 0x4a4b28
mov ecx, dword [ebp - 8]
call fcn.004a4e40
test eax, eax
jne 0x4a4b0a
xor eax, eax
jmp 0x4a4b28
mov ecx, dword [ebp - 8]
call fcn.004a5010
test eax, eax
jne 0x4a4b1a
xor eax, eax
jmp 0x4a4b28
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4a4e40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
add eax, 4
push eax
push 0
call fcn.004a5570
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4a4e68
xor eax, eax
jmp 0x4a4f00
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.004a5400
mov ecx, eax
call fcn.004a44c0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.004a55d0
lea ecx, [ebp - 8]
push ecx
push 0
call fcn.004a5620
add esp, 8
movzx edx, al
test edx, edx
je 0x4a4ee6
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004a4fb0
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a4ede
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push ecx
mov ecx, esp
push eax
call fcn.004a38f0
lea ecx, [ebp - 8]
call fcn.004a5450
mov ecx, eax
call fcn.004a5910
lea ecx, [ebp - 0xc]
call fcn.0043cae0
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 8]
call fcn.004a5430
lea ecx, [ebp - 4]
call fcn.004a4760
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4acb40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
call fcn.00442480
mov ecx, eax
call fcn.004b3500
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4acb8a
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x4acaf0
push 0
push 0
call fcn.004e96a2
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4acb8a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4aec70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x4aec8c
mov eax, 1
jmp 0x4aed12
call fcn.004ae920
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.004aebe0
test eax, eax
je 0x4aecaf
mov edx, dword [ebp - 8]
mov dword [edx + 8], 1
jmp 0x4aecbd
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
xor eax, eax
jmp 0x4aed12
mov ecx, dword [ebp - 8]
call fcn.004aec60
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x4aed70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x4aed0d
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
xor eax, eax
jmp 0x4aed12
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4aee40
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4aee57
mov eax, 1
jmp 0x4aee97
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xbb8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4aee88
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4b0de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x4b0df8
cmp dword [ebp + 0x10], 0
je 0x4b0df8
cmp dword [ebp + 0x14], 0
jne 0x4b0e0d
push 0x5310f4
mov ecx, dword [ebp + 8]
call fcn.0043caa0
mov eax, dword [ebp + 8]
jmp 0x4b0ec1
push 0x5310f8
lea ecx, [ebp - 0x10]
call fcn.0043caa0
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 8], 1
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e68e6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b0eaa
mov ecx, dword [ebp - 0xc]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004ed5e0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043cb20
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004ecc45
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043ca80
lea ecx, [ebp - 0x10]
call fcn.0043cae0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret