joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a3dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1005a3ec
pop dword [ebp - 0x34]
mov eax, 0x1b12050f
add eax, 0xf4f39edd
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7bf6659d
add dword [ebp - 0x44], 0xd25bdfae
mov dword [ebp - 0x40], 0xdeac46c6
add dword [ebp - 0x40], 0x5387057f
mov dword [ebp - 0x3c], 0xd9c80126
sub dword [ebp - 0x3c], 0x8d7bbcf8
mov dword [ebp - 0x38], 0xda26f17
sub dword [ebp - 0x38], 0xda26f17
lea eax, [ebp - 0x44]
push eax
mov eax, 0xbd764153
sub eax, 0xad6dd11f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x5339f026
sub dword [ebp - 0x44], 0xdec786d0
mov dword [ebp - 0x40], 0x143ea80e
add dword [ebp - 0x40], 0x2d2db967
mov dword [ebp - 0x3c], 0x5184826e
add dword [ebp - 0x3c], 0x11eae9fe
mov dword [ebp - 0x38], 0x33b6366f
sub dword [ebp - 0x38], 0x33b6366f
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb8dd206c
sub eax, 0xa8d4b048
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3d7ce
push 0
call eax
mov ecx, 0x6d646a41
sub ecx, 0x6d6421d4
mov ebx, eax
mov esi, 0x82920964
add esi, 0x8d79869c
add esi, dword [ebp - 0x34]
mov edi, 0xb4d08ece
sub edi, 0xc172d5da
xor dword [ebp - 8], ecx
mov edx, dword [esi]
xor dword [ebp - 0x28], esi
add edx, edi
xor dword [ebp - 0x14], edi
mov dword [ebx], edx
add dword [ebp - 4], ecx
add ebx, 0x8cf0a5eb
add ebx, 0x730f5a19
add esi, 0xfb0ba9db
sub esi, 0xfb0ba9d7
loop 0x1005a50e
add eax, 0x27c1aa03
add eax, 0xd83f6a84
xor ebx, ebx
add ebx, eax
add eax, 0x99633a7b
add eax, 0x669cc58a
mov ecx, 0x3991f9e1
sub ecx, 0x2991f9e1
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40596d
pop dword [ebp - 0x48]
mov eax, 0x40596d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x7155bed5
add dword [ebp - 0x58], 0xdcfc8676
mov dword [ebp - 0x54], 0x80d7f575
sub dword [ebp - 0x54], 0x4ea4a930
mov dword [ebp - 0x50], 0xb140d86e
add dword [ebp - 0x50], 0x9b0b6bc0
mov dword [ebp - 0x4c], 0x23641e1
sub dword [ebp - 0x4c], 0x23641e1
lea eax, [ebp - 0x58]
push eax
mov eax, 0x9e98c42c
add eax, 0x61a7ac34
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1d7d8483
add dword [ebp - 0x58], 0x56f4e4d3
mov dword [ebp - 0x54], 0x363cfa3
add dword [ebp - 0x54], 0x3e0891d2
mov dword [ebp - 0x50], 0x9ced53fc
add dword [ebp - 0x50], 0xc6821870
mov dword [ebp - 0x4c], 0xbc044769
add dword [ebp - 0x4c], 0x43fbb897
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xb587f4fa
sub eax, 0xb54783fa
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3653f
push 0
call eax
mov ecx, 0x4672
mov ebx, eax
mov esi, 0x7b961877
add esi, 0x84aae789
add esi, dword [ebp - 0x48]
mov edi, 0x8ce93f2c
add dword [ebp - 0x34], ecx
mov edx, dword [esi]
add dword [ebp - 4], 0x44349a9e
xor edx, edi
mov dword [ebx], edx
sub dword [ebp - 0x10], 0xfbc95742
add ebx, 0x889ff86b
sub ebx, 0x889ff867
add esi, 0xf7e606ed
add esi, 0x819f917
loop 0x405a7e
add eax, 0x34c3939c
add eax, 0xcb3d78ff
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x46f569e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x243a114a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1000e1bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000e1cb
pop dword [ebp - 0xc]
mov eax, 0x36f40776
add eax, 0xd90cda55
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3ae5d
push 0
mov eax, 0xf0acc00a
add eax, 0x1f54805a
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x4f91
mov esi, eax
mov edi, 0x10018600
add edi, dword [ebp - 0xc]
mov ebx, 0xf0a09e84
add ebx, 0x1cac0516
add dword [ebp - 4], 0x129038e1
mov edx, dword [edi]
sub dword [ebp - 4], ecx
add edx, ebx
xor dword [ebp - 8], 0x1262d826
mov dword [esi], edx
add dword [ebp - 8], ebx
add esi, 0x7883b3a4
sub esi, 0x7883b3a0
add edi, 4
loop 0x1000e21e
add eax, 0xe097dc02
add eax, 0x1f695515
mov ebx, eax
add eax, 0x533407f5
add eax, 0xaccbf810
mov ecx, 0x3257f458
sub ecx, 0x2257f458
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x25819ad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x25819ae7
pop dword [ebp - 0x30]
mov eax, 0x25819ae7
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x54ceddca
sub dword [ebp - 0x40], 0x67c987f
mov dword [ebp - 0x3c], 0x843c36da
sub dword [ebp - 0x3c], 0x5208ea95
mov dword [ebp - 0x38], 0x410291af
sub dword [ebp - 0x38], 0xf4b64d81
mov dword [ebp - 0x34], 0xdcbeb644
add dword [ebp - 0x34], 0x234149bc
lea eax, [ebp - 0x40]
push eax
mov eax, 0x7b17fc8c
sub eax, 0x55962c48
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xd68d7f4f
sub dword [ebp - 0x40], 0x621b15f9
mov dword [ebp - 0x3c], 0xa2218cbb
add dword [ebp - 0x3c], 0x9f4ad4ba
mov dword [ebp - 0x38], 0x52930a46
sub dword [ebp - 0x38], 0xef239dda
mov dword [ebp - 0x34], 0x18ce778d
add dword [ebp - 0x34], 0xe7318873
out 0x8d, eax
popfd
sar bh, 0xff
call dword [ebx + 0x50]
mov eax, 0xf9437218
add eax, 0x2c3e5e68
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3bad3
push 0
call eax
mov ecx, 0x4475
mov ebx, eax
mov esi, 0x4f67292c
add esi, 0xd61b6cd4
add esi, dword [ebp - 0x30]
mov edi, 0x94409399
sub edi, 0x88e2ae53
xor dword [ebp - 0x14], edx
mov edx, dword [esi]
mov dword [ebp - 0x24], 0x6c0cfd32
xor edx, edi
mov dword [ebp - 8], 0x1c00f72f
mov dword [ebx], edx
xor dword [ebp - 8], edi
clc
invalid
invalid
inc dword [ecx + 0x97b25c3]
inc ebx
sub ebx, 0x43097b21
add esi, 4
loop 0x25819bfe
add eax, 0xbec7e945
add eax, 0x41391b62
xor ebx, ebx
add ebx, eax
add eax, 0xd4a570ce
sub eax, 0xd4a570c9
mov ecx, 0x25800000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10003368
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10003377
pop dword [ebp - 0x1c]
mov eax, 0x10003377
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x123e2a69
add dword [ebp - 0x2c], 0x3c141ae2
mov dword [ebp - 0x28], 0x6ae699c8
sub dword [ebp - 0x28], 0x38b34d83
mov dword [ebp - 0x24], 0x22480394
sub dword [ebp - 0x24], 0xd5fbbf66
mov dword [ebp - 0x20], 0x7b6fb16e
sub dword [ebp - 0x20], 0x7b6fb16e
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd4abc1e8
sub dword [ebp - 0x2c], 0x60395892
mov dword [ebp - 0x28], 0xc4d42894
add dword [ebp - 0x28], 0x7c9838e1
mov dword [ebp - 0x24], 0xfa5a1c26
sub dword [ebp - 0x24], 0x96eaafba
mov dword [ebp - 0x20], 0x7264779a
add dword [ebp - 0x20], 0x8d9b8866
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x22946bb0
sub eax, 0x12942b34
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39403
push 0
call eax
mov ecx, 0x5294
xor edx, edx
add edx, eax
mov esi, 0x10009600
add esi, dword [ebp - 0x1c]
mov ebx, 0xac8b8da5
sub ebx, 0x1aa3ddea
mov edi, dword [esi]
add dword [ebp - 0x18], esi
xor edi, ebx
add dword [ebp - 0xc], edx
mov dword [edx], edi
mov dword [ebp - 8], 0x9202649b
add edx, 0x10f7761e
sub edx, 0x10f7761a
add esi, 4
loop 0x10003485
add eax, 0x4e2d8390
add eax, 0xb1d3b993
mov ebx, eax
add eax, 0x364996e5
add eax, 0xc9b66920
mov ecx, 0x5b4c47eb
sub ecx, 0x4b4c47eb
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40e7b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.waecTbTU
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40e7d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40e7d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40e7c8
mov eax, 1
add ebx, ebx
jne 0x40e7eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40e7e0
jne 0x40e7fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e7e0
xor ecx, ecx
sub eax, 3
jb 0x40e810
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40e882
mov ebp, eax
add ebx, ebx
jne 0x40e81b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40e828
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40e84c
inc ecx
add ebx, ebx
jne 0x40e838
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40e82d
jne 0x40e849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e82d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40e86c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40e85d
jmp 0x40e7ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40e86c
add edi, ecx
jmp 0x40e7ce
pop esi
mov edi, esi
mov ecx, 0x17b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40e88a
cmp byte [edi], 7
jne 0x40e88a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40e88f
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40e8fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe958]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe9b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40e8bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe9b8]
or eax, eax
je 0x40e8f8
mov dword [ebx], eax
add ebx, 4
jmp 0x40e8d9
call dword [esi + 0xe9b4]
mov ebp, dword [esi + 0xe9bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40e932
sub esp, 0xffffff80
jmp 0x402752
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458030]
jne 0x40107a
repz ret
jmp fcn.00401e51

Function at 0x408b0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d5a
and dword [ebp - 4], 0
cmp dword [0x45a848], 0
mov ebx, eax
jne 0x408bbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c6d
push eax
call fcn.00404ce8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45a848], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45a84c], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45a850], eax
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x45a858], eax
test eax, eax
je 0x408bbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x45a854], eax
mov eax, dword [0x45a854]
cmp eax, ebx
je 0x408c14
cmp dword [0x45a858], ebx
je 0x408c14
push eax
call fcn.00404d63
push dword [0x45a858]
mov esi, eax
call fcn.00404d63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408c14
test edi, edi
je 0x408c14
call esi
test eax, eax
je 0x408c0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408c0b
test byte [ebp - 0xc], 1
jne 0x408c14
or dword [ebp + 0x10], 0x200000
jmp 0x408c4d
mov eax, dword [0x45a84c]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c4d
mov eax, dword [0x45a850]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45a848]
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40adb0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x420
mov eax, dword [0x458030]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [0x2c3823c]
push ebx
mov ebx, dword [0x2c37f60]
push esi
mov esi, dword [0x458f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40adf1
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c3823c]
mov dword [0x45a9ec], esi
cmp eax, 0x114e
jne 0x40ae1b
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x2c3823c]
cmp eax, 0x2f
jne 0x40ae3b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
call fcn.0040aca0
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401070
add esp, 0x420
ret
Function at 0x409300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44aba6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x465944]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x4093ac
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x4093ac
call fcn.00407900
mov edi, eax
jmp 0x4094cb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4093cf
call fcn.00407900
jmp 0x4094be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4093ed
call fcn.00407900
jmp 0x4094be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40940e
mov edi, 0x8007000e
jmp 0x4094c0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x409504
jb 0x40942c
cmp eax, 0xffffffff
ja 0x409504
cmp eax, 0x400
jbe 0x409441
push eax
lea ecx, [ebp - 0x418]
call fcn.004076f0
jmp 0x409467
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x409467
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x40947e
mov edi, 0x8007000e
jmp 0x4094c0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40949e
call fcn.00407900
jmp 0x4094be
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00409160
mov edi, eax
test esi, esi
je 0x4094cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4094e4
lea ecx, [ebp - 0x418]
call fcn.00407bc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a853
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00407940
int3
Function at 0x40c100
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.0042a870
mov eax, dword [0x465944]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1804]
push 0x1000
push 0
push eax
call fcn.0042c930
add esp, 0xc
lea eax, [ebp - 0x1804]
push 0x44eeb8
push 0x800
push eax
call fcn.0040fba0
push esi
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.0040fba0
push 0x44eec0
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.0040fba0
push esi
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.0040fba0
push str.vL
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.0040fba0
push dword [ebp + 8]
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.0040fba0
push 0x44ef10
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.0040fba0
push 0x14
push esi
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
cmp ebx, 6
jne 0x40c2e6
push edi
push 0xc8
push 0x44edc0
push str.http:__down.360safe.com_setup.exe
call fcn.00433b5a
add esp, 0xc
test eax, eax
jne 0x40c2cd
push 0x800
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.0042c930
add esp, 0xc
mov dword [ebp - 0x180c], 1
lea eax, [ebp - 0x1808]
mov dword [ebp - 0x1808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x180c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40c2c0
push str.360ver.dll
lea eax, [ebp - 0x804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c2c0
lea eax, [ebp - 0x804]
push eax
call fcn.0040f880
add esp, 4
test eax, eax
je 0x40c2c0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40c2c0
push str.IsBetaVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x40c2cd
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x40c2d8
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
cmp dword [ebp + 0x10], 0
jne 0x40c2fe
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a853
mov esp, ebp
pop ebp
ret
push 0
call fcn.004339f9
int3
Function at 0x40d590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x465944]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x466d20]
test eax, eax
je 0x40d5b9
cmp dword [0x466d1c], 0
jne 0x40d6b5
push esi
push edi
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [0x466d18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x804]
push eax
call edi
xor esi, esi
cmp dword [0x466d14], esi
jle 0x40d602
nop dword [eax]
lea eax, [ebp - 0x804]
push eax
call edi
inc esi
cmp esi, dword [0x466d14]
jl 0x40d5f0
push str.MiniUI.dll
lea eax, [ebp - 0x804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call fcn.0040f880
add esp, 4
test eax, eax
lea eax, [ebp - 0x804]
pop edi
pop esi
push eax
jne 0x40d66b
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d69b
push 1
lea eax, [ebp - 0x804]
push section..data
push eax
call fcn.0040c100
add esp, 0xc
mov dword [0x466d1c], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a853
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x466d1c], eax
test eax, eax
je 0x40d6a5
push str.GetMiniUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x466d20], eax
test eax, eax
jne 0x40d6b5
push dword [0x466d1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x466d1c], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a853
mov esp, ebp
pop ebp
ret
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a853
mov esp, ebp
pop ebp
ret
Function at 0x40f530
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b338
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x465944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x10]
call fcn.004069b0
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.004106f0
mov ecx, dword [esi + 0x40]
call fcn.00410640
mov ecx, dword [esi + 0x40]
call fcn.00410310
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea edx, [ecx - 0xc]
cmp edx, dword [0x4644d8]
je 0x40f5b7
add ecx, 0xfffffff4
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f5b5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff4
push eax
call fcn.00425cdd
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410640
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b518
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x465944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x14]
call fcn.004069b0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
cmp dword [ebp - 0x10], edi
jle 0x4106b3
mov esi, eax
nop
push dword [esi + edi*4]
mov ecx, ebx
call fcn.00410330
inc edi
cmp edi, dword [ebp - 0x10]
jl 0x4106a0
mov esi, dword [ebp - 0x14]
lea eax, [esi - 0xc]
cmp eax, dword [0x4644d8]
je 0x4106d5
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4106d5
push esi
call fcn.00425cdd
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret