joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4161c0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x4163c9
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x4163c8
cmp eax, 0x29
jne 0x4161f8
cmp dword [esi + 0x10], 0
jne 0x4163c8
test dword [esi + 0x50], 0x10000000
je 0x4163cd
cmp eax, 0x2e
jne 0x41624f
push 5
lea ecx, [esi + 0x24]
call fcn.004198a0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x416243
cmp byte [eax], 0x5c
jne 0x416241
inc eax
cmp eax, ecx
je 0x416241
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x41622e
mov dl, byte [eax]
cmp dl, 0x28
je 0x41623f
cmp dl, 0x29
je 0x41623f
test cl, 0x10
jne 0x416241
mov cl, byte [eax]
cmp cl, 0x7b
je 0x41623f
cmp cl, 0x7d
jne 0x416241
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.0041a880
jmp 0x4163b5
cmp eax, 0x5c
jne 0x4162f4
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x416294
cmp byte [eax], 0x5c
jne 0x416292
inc eax
cmp eax, ecx
je 0x416292
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x41627f
mov dl, byte [eax]
cmp dl, 0x28
je 0x416290
cmp dl, 0x29
je 0x416290
test cl, 0x10
jne 0x416292
mov cl, byte [eax]
cmp cl, 0x7b
je 0x416290
cmp cl, 0x7d
jne 0x416292
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.0041a880
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4162c1
cmp byte [esi + 0x48], 0x62
jne 0x4162c1
push 4
lea ecx, [esi + 0x24]
call fcn.004198a0
mov ecx, esi
call fcn.00419910
jmp 0x4163bc
test eax, eax
je 0x4162e8
cmp byte [esi + 0x48], 0x42
jne 0x4162e8
push 4
lea ecx, [esi + 0x24]
call fcn.004198a0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00419910
jmp 0x4163bc
mov ecx, esi
call fcn.00416460
jmp 0x4163b5
cmp eax, 0x5b
jne 0x416317
mov ecx, esi
call fcn.00419910
mov ecx, esi
call fcn.00416af0
push 4
push 0x5d
mov ecx, esi
call fcn.00418630
jmp 0x4163b5
cmp eax, 0x28
jne 0x416341
mov ecx, esi
call fcn.00419910
mov ecx, esi
call fcn.0041aad0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00418630
test bl, bl
je 0x4163bc
jmp 0x4163b5
cmp eax, 0x5e
jne 0x416359
push 2
lea ecx, [esi + 0x24]
call fcn.004198a0
mov ecx, esi
call fcn.00419910
jmp 0x4163bc
cmp eax, 0x24
jne 0x416371
push 3
lea ecx, [esi + 0x24]
call fcn.004198a0
mov ecx, esi
call fcn.00419910
jmp 0x4163bc
cmp eax, 0x2a
je 0x4163e2
cmp eax, 0x2b
je 0x4163e2
cmp eax, 0x3f
je 0x4163e2
cmp eax, 0x7b
je 0x4163e2
cmp eax, 0x7d
jne 0x416393
test dword [esi + 0x50], 0x10000000
je 0x4163d4
cmp eax, 0x5d
jne 0x4163a1
test dword [esi + 0x50], 0x10000000
je 0x4163db
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00415750
mov ecx, esi
call fcn.00419910
mov ecx, esi
call fcn.00419ab0
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x4161d0
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.004252a9
push 6
call fcn.004252a9
push 4
call fcn.004252a9
push 0xa
call fcn.004252a9
int3
Function at 0x41b6e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41b711
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41b700
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x423350
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b440
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x462078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
push 0
push 0
push 0
push str.Yandex_downloader
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
jne 0x4233af
push str.Failed_to_open_session_for_statistics_n
push dword [0x4636d8]
call fcn.0041f170
lea eax, [esi + 1]
jmp 0x423531
push 0x423280
push esi
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackA]
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [ebp - 0x64]
push 4
push eax
push 2
push esi
mov dword [ebp - 0x64], 0x7d0
call edi
test eax, eax
je 0x42351c
push 4
lea eax, [ebp - 0x64]
push eax
push 5
push esi
call edi
test eax, eax
je 0x42351c
push ebx
lea eax, [ebp - 0x40]
push 0x463a80
push eax
call fcn.004231b0
push 0x463a98
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00423170
add esp, 0x18
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00410030
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x60]
push ecx
push 1
push SysReAllocString
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 0x60], 0
cmovae eax, dword [ebp - 0x28]
push str.Accept:__
push eax
push esi
call fcn.004232a0
mov edi, dword [ebp - 0x60]
add esp, 0x1c
mov esi, eax
test edi, edi
je 0x423488
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
push str.An_attempt_to_open_statistics_url_generated_an_exception:__d_n
push dword [0x4636d8]
call fcn.0041f170
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, 3
call fcn.00410030
mov eax, esi
jmp 0x423534
test esi, esi
jne 0x4234f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2ef1
jne 0x4234f1
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x60]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
push eax
call fcn.00423550
lea ecx, [ebp - 0x59]
push ecx
lea ecx, [ebp - 0x58]
push dword [eax]
push esi
call fcn.00421d30
cmp dword [eax + 0x14], 8
jb 0x4234c7
mov eax, dword [eax]
push eax
push str.Statistics_sent:__s_n
push dword [0x4636d8]
call fcn.0041f170
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.004014f0
lea ecx, [ebp - 0x28]
xor esi, esi
call fcn.00410030
mov eax, esi
jmp 0x423534
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.Failed_to_send_statistics_n
push dword [0x4636d8]
call fcn.0041f170
add esp, 8
lea ecx, [ebp - 0x28]
mov esi, 4
call fcn.00410030
mov eax, esi
jmp 0x423534
push str.Failed_to_set_internet_options_for_statistics_n
push dword [0x4636d8]
call fcn.0041f170
mov eax, 2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426898
mov esp, ebp
pop ebp
ret
Function at 0x4237e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x4237f4
xor al, al
pop edi
pop ebp
ret 4
mov ecx, 0x5a4d
push esi
cmp word [eax], cx
jne 0x423857
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x423857
mov ecx, dword [ecx + eax + 0x98]
test ecx, ecx
je 0x423857
lea esi, [ecx + eax]
test esi, esi
je 0x423857
lea eax, [esi + 8]
test eax, eax
je 0x423857
cmp byte [eax], 0x30
lea edx, [eax + 1]
jne 0x423857
mov al, byte [edx]
cmp al, 0x82
jne 0x423857
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
je 0x423857
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], eax
mov al, 1
pop esi
pop edi
pop ebp
ret 4
pop esi
xor al, al
pop edi
pop ebp
ret 4

Function at 0x423860
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42387f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x423896
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4238a8
push eax
call edi
mov dword [esi + 4], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x42396e
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x423936
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x423931
push 0x1c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
push ecx
push eax
movups xmmword [ebp - 0x18], xmm0
movq qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x423931
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [esi + 8]
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42394b
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x42395c
push eax
call edi
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x42396e
push eax
call edi
mov dword [esi + 4], 0xffffffff
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4241b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b4e3
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x462078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xf8], 0
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0xfc]
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp + 0xc]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x424235
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x44d3bc
mov ecx, esi
call fcn.00409490
mov ecx, dword [ebp + 0x20]
cmp ecx, 8
jb 0x42436d
inc ecx
push ecx
jmp 0x424362
push ebx
call fcn.00426dbc
mov edi, eax
add esp, 4
test edi, edi
jne 0x424255
push 0x44d3bc
mov ecx, esi
call fcn.00409490
jmp 0x424358
xor eax, eax
mov dword [ebp - 0xdc], 7
mov dword [ebp - 0xe0], 0
mov word [ebp - 0xf0], ax
cmp dword [ebp + 0x20], 8
push edi
mov dword [ebp - 0xf4], eax
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push ebx
push 0
push eax
mov byte [ebp - 4], 1
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4242f3
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x44e418
push edi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 0xf4]
test ecx, ecx
je 0x4242f3
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0xd8]
push 0x44ecb0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00423a50
push edi
call fcn.00426dc5
xor eax, eax
mov dword [esi + 0x14], 7
add esp, 4
mov dword [esi + 0x10], 0
mov word [esi], ax
mov ecx, esi
lea eax, [ebp - 0xf0]
push eax
call fcn.00403430
mov eax, dword [ebp - 0xdc]
cmp eax, 8
jb 0x42433b
inc eax
lea ecx, [ebp - 0xf0]
push eax
push dword [ebp - 0xf0]
call fcn.00401d50
xor eax, eax
mov dword [ebp - 0xdc], 7
mov dword [ebp - 0xe0], 0
mov word [ebp - 0xf0], ax
mov eax, dword [ebp + 0x20]
cmp eax, 8
jb 0x42436d
inc eax
push eax
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00401d50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426898
mov esp, ebp
pop ebp
ret

Function at 0x43d613
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043d492
Function at 0x402260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402279
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4022b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4022b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4022b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4022a0
cmp esi, eax
jb 0x4022ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402820
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d2f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x458320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call fcn.004025e0
test eax, eax
je 0x40286f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x402884
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402856
cmp dword [ebp + 0x10], ebx
je 0x40289e
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402cb0
add esp, 4
test eax, eax
sete al
cmp al, bl
jne 0x402856
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], ebx
cmp esi, ebx
je 0x4028aa
mov dword [esi], ebx
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
lea ebx, [ebp + 0xc]
lea edi, [ebp + 0x10]
call fcn.00402770
test esi, esi
je 0x4028c4
mov edx, dword [ebp + 0xc]
mov dword [esi], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402cb0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x458320]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402d04
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0042669e
add esp, 0x144
ret
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x402d8c
cmp dword [esp + 0xc], 0x40
jne 0x402d8c
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x402d8c
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x144]
jne 0x402d8c
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x402d8c
cmp dword [esp + 0xc], 0xf8
jne 0x402d8c
cmp dword [esp + 0x10], 0x4550
jne 0x402d8c
cmp word [esp + 0x16], bx
je 0x402d8c
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042669e
add esp, 0x144
ret

Function at 0x403320
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push edi
xor edi, edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], edi
mov dword [esp + 0x10], 4
cmp esi, edi
je 0x403419
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpSendRequestW]
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetQueryOptionW]
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x403417
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4033d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f0d
je 0x403388
cmp eax, 0x2f19
jne 0x4033c4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1f
push esi
mov dword [esp + 0x2c], 4
call ebp
or dword [esp + 0xc], 0x3180
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x403350
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403350
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x20000013
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov edi, eax
test edi, edi
je 0x4033c8
cmp dword [esp + 0x10], 0xc8
je 0x403417
xor edi, edi
jmp 0x403350
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x403aa0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
sub esp, 0x834
mov eax, dword [0x458320]
xor eax, esp
mov dword [esp + 0x82c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebp
push esi
push edi
lea eax, [esp + 0x220]
push eax
xor esi, esi
push 0x104
mov dword [esp + 0x18], esi
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360ini.cab
lea ecx, [esp + 0x224]
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
lea ecx, [esp + 0x220]
call fcn.00403420
test eax, eax
jne 0x403b14
push 0x3e8
call edi
inc esi
cmp esi, 3
jb 0x403af0
xor eax, eax
jmp 0x403c13
lea edx, [esp + 0x18]
push edx
push 0x104
call ebx
lea esi, [esp + 0x630]
call fcn.00403170
mov eax, esi
push eax
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x403b6e
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.00401860
mov eax, dword [eax]
push eax
push 0
mov dword [esp + 0x18], 1
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x403b6e
mov bl, 1
jmp 0x403b70
xor bl, bl
test byte [esp + 0x10], 1
je 0x403b97
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x403b0d
lea ecx, [esp + 0x18]
push ecx
push 0x403220
push 0
lea edx, [esp + 0x22c]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov esi, eax
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x403b0d
push str.360ini.dll
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x430]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x403b0d
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403b0d
lea esi, [esp + 0x428]
call fcn.00405980
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042669e
add esp, 0x834
ret
Function at 0x403c30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d326
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x458320]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, 1
test byte [0x45c43c], bl
jne 0x403cbe
or dword [0x45c43c], ebx
xor eax, eax
mov dword [esp + 0x20], 0
mov ecx, 0x45c424
mov dword [0x45c424], eax
mov dword [0x45c428], eax
mov dword [0x45c42c], eax
mov dword [0x45c430], eax
mov dword [0x45c434], eax
mov dword [0x45c438], eax
call fcn.00405800
test eax, eax
jge 0x403ca9
push eax
call fcn.00402370
push 0x44d520
call fcn.004273c4
add esp, 4
mov dword [esp + 0x20], 0xffffffff
mov eax, 2
test byte [0x45c43c], al
jne 0x403ce8
or dword [0x45c43c], eax
push 0x44d500
mov dword [0x45c41c], 0
call fcn.004273c4
add esp, 4
push 0x45c424
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x45c420], 0
jne 0x403d54
cmp dword [0x45c41c], 0
jne 0x403d54
push str.A2CE3D3C_15E7_4985_B2C5_58F681DD07A5
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x45c41c], eax
test eax, eax
jne 0x403d54
push str.A2CE3D3C_15E7_4985_B2C5_58F681DD07A5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x45c41c], eax
test eax, eax
jne 0x403d54
push 0x45c424
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x45c424
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x45c41c]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x14], 0x45c41c
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [esp + 0x10], bl
mov dword [esp + 0x20], ebx
cmp dword [0x45c420], 0
jne 0x403db4
call fcn.00403aa0
mov dword [0x45c420], eax
test eax, eax
jne 0x403db4
mov ecx, dword [0x45c41c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x45c41c]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp + 8]
mov ecx, dword [0x45c420]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4064e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x56c
mov eax, dword [0x458320]
xor eax, esp
mov dword [esp + 0x568], eax
mov eax, dword [esp + 0x570]
push ebp
push esi
push edi
push 0x11c
lea ecx, [esp + 0x4c]
push 0
push ecx
mov dword [esp + 0x18], eax
call fcn.004266b0
push 0x11c
push 0
push ebx
mov dword [esp + 0x60], 0x11c
call fcn.004266b0
add esp, 0x18
push ebx
mov dword [ebx], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebx + 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jne 0x406584
push str.IsWow64Process
push str.kernel32
call ebp
push eax
call edi
mov esi, eax
mov dword [esp + 0x10], 0
test esi, esi
je 0x406584
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x406584
cmp dword [esp + 0x10], 0
jne 0x40664b
push str.RtlGetVersion
push str.ntdll
call ebp
push eax
call edi
test eax, eax
je 0x40659e
lea ecx, [esp + 0x48]
push ecx
call eax
mov eax, dword [ebx + 4]
lea edx, [eax + eax*4]
mov eax, dword [ebx + 8]
lea edi, [eax + edx*2]
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*2]
cmp eax, edi
jle 0x4065cb
mov ecx, 0x47
lea esi, [esp + 0x48]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0x16e]
push ecx
mov word [esp + 0x170], ax
call fcn.004266b0
add esp, 0xc
lea esi, [esp + 0x164]
call fcn.004063e0
test eax, eax
jl 0x40664b
lea edx, [esp + 0x14]
push edx
mov eax, esi
call fcn.00406680
test eax, eax
je 0x40664b
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x10
movzx ecx, cx
lea edx, [eax + eax*4]
lea edx, [ecx + edx*2]
cmp edi, edx
jge 0x40663e
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 8], ecx
mov ecx, dword [esp + 0xc]
shr eax, 0x10
mov dword [ebx + 0xc], eax
mov dword [ecx + 4], 1
jmp 0x406656
mov edx, dword [esp + 0xc]
mov dword [edx + 4], 0
jmp 0x406656
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0
mov ecx, dword [esp + 0x574]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0042669e
add esp, 0x56c
ret 4
Function at 0x406680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 2
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x4066fe
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4066f7
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4066f6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4066ef
push ebp
call fcn.00427a03
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4066ef
mov ecx, dword [esp + 0x10]
push ebp
push ecx
push ebx
call fcn.0042f920
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
cmp ebx, esi
je 0x406742
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0x453afc
push ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x406739
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x18]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, 1
push ebx
call fcn.00427501
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret 4