joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a7d0
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47a829
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x47a83e
mov eax, dword [esp]
test eax, eax
je 0x47a838
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x47a84d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x47a860
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x47a8cb
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47a8cb
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x47a894
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47a8bc
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x47a8d2
mov eax, dword [esp + 4]
test eax, eax
je 0x47a8cb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x47a8e1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x47a8f0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x47aa7b
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x47aa7b
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x47aa7b
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47aa7b
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47aa3c
cmp dword [esp + 0xc], 0x378
jne 0x47aa3c
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00484060
add esp, 8
test eax, eax
je 0x47aa5c
cmp dword [esp + 0x154], 1
jne 0x47aa5c
cmp dword [esp + 0x178], 2
jne 0x47aa5c
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x66f4e4
push edx
call fcn.00483b53
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
push eax
push ecx
push edx
mov ecx, esi
call fcn.0047a7d0
test eax, eax
je 0x47aa3c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x47aa4f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x47aa46
push eax
call esi
jmp 0x47aa42
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x47aa5c
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x47aa6b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x47aa90
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x47abfc
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x47abfc
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x47abfc
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x47abfc
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47abe0
cmp dword [esp + 0x10], 0x378
jne 0x47abe0
cmp dword [esp + 0x158], 1
jne 0x47ac09
cmp dword [esp + 0x17c], 2
jne 0x47ac09
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x66f4e4
push ecx
call fcn.00483b53
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
call esi
test eax, eax
jne 0x47abe0
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.0047ac40
test eax, eax
je 0x47abe0
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.0047a740
test eax, eax
je 0x47abe0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x47ac09
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x47abf1
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x47abfc
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x47ac1a
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x47ac25
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x47ac40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x47ad01
mov eax, dword [esp + 0x488]
test eax, eax
je 0x47ad01
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47ad01
cmp dword [esp], 0x378
jne 0x47ad01
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47ad01
lea edx, [esp + 4]
push edx
call fcn.0047a6d0
add esp, 4
test eax, eax
je 0x47ad01
cmp dword [esp + 0x234], 1
jne 0x47acf3
cmp dword [esp + 0x258], 2
jne 0x47acf3
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x47ad01
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47ad01
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x47ad10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x47ad6f
push esi
call fcn.0047a6d0
add esp, 4
test eax, eax
je 0x47ad6f
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47ad6f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x47ad6f
push str.SetPara
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x47ae00
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x47ae34
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0047ad10
test eax, eax
jne 0x47ae4d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.0047ad80
cmp eax, 1
je 0x47afda
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x47ae86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x47af02
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x47af82
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.0047ac40
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x47af99
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x47aea2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x47af50
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.0047a8f0
test eax, eax
je 0x47af82
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x47af1e
cmp dword [esp + 0x18], 1
jb 0x47af82
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.0047a7d0
cmp eax, 1
je 0x47afcb
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x47afa9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x47af82
push ebp
mov ecx, ebx
call fcn.0047aff0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47afda
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x47aff0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x47b022
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.0047ad80
test eax, eax
jne 0x47b03f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x47b066
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x47b0b4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.0047aa90
test eax, eax
jne 0x47b09d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x47b083
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.0047a860
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x47b0d7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x494677
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4946af
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049271c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004926f4
jmp 0x4946bb
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x495d69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x495dab
call fcn.0049b91c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x495dab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x495da2
xor eax, eax
jmp 0x495db3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00495db9
pop edi
pop esi
pop ebx
ret 4
Function at 0x49be4c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49be7a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49be98
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049bdb2
jmp 0x49be98
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49be98
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049bdb2
test edi, edi
mov eax, edi
jne 0x49be82
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401703
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401742
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401742
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401742
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401742
cmp dword [ecx + 0x74], 0xe
jbe 0x401742
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402279
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4022b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4022b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4022b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4022a0
cmp esi, eax
jb 0x4022ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402a50
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x81c
mov eax, dword [0x4d9b30]
xor eax, esp
mov dword [esp + 0x814], eax
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.004586e0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x402ad4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.0045875a
add esp, 0x81c
ret
push str.360ver.dll
lea edx, [esp + 0x1c]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402ab8
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x14], 0
call fcn.00402770
add esp, 0xc
cmp dword [esp + 8], 0
je 0x402ab8
lea edx, [esp + 0x18]
push edx
call fcn.00402950
mov esi, eax
test esi, esi
je 0x402ab8
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x81c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0045875a
add esp, 0x81c
ret
Function at 0x402b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1008
call fcn.004597e0
mov eax, dword [0x4d9b30]
xor eax, esp
mov dword [esp + 0x1004], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x1000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004586e0
add esp, 0xc
push 0x800
lea ecx, [esp + 0xc]
push 0x4cdf38
push ecx
call fcn.0045980b
add esp, 0xc
push 0x800
lea edx, [esp + 0xc]
push esi
push edx
call fcn.0045ce3e
add esp, 0xc
push 0x800
lea eax, [esp + 0xc]
push 0x4cdf40
push eax
call fcn.0045ce3e
add esp, 0xc
push 0x800
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.0045ce3e
add esp, 0xc
push 0x800
lea edx, [esp + 0xc]
push str.vL
push edx
call fcn.0045ce3e
add esp, 0xc
push 0x800
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0045ce3e
add esp, 0xc
push 0x800
lea ecx, [esp + 0xc]
push 0x4cdf90
push ecx
call fcn.0045ce3e
add esp, 0xc
push 0x14
push esi
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
cmp esi, 6
jne 0x402c94
push 0xc8
push 0x4cdec0
push str.http:__down.360safe.com_setup.exe
call fcn.00459ac6
add esp, 0xc
test eax, eax
jne 0x402c7c
call fcn.00402a50
test eax, eax
je 0x402c7c
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x402c87
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp + 0x10], 0
je 0x402ca1
push 0
call fcn.0045cda6
mov ecx, dword [esp + 0x100c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0045875a
mov esp, ebp
pop ebp
ret

Function at 0x402cc0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x4d9b30]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402d13
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0045875a
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x402d9b
cmp dword [esp + 0xc], 0x40
jne 0x402d9b
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x402d9b
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x144]
jne 0x402d9b
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x402d9b
cmp dword [esp + 0xc], 0xf8
jne 0x402d9b
cmp dword [esp + 0x10], 0x4550
jne 0x402d9b
cmp word [esp + 0x16], bx
je 0x402d9b
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0045875a
mov esp, ebp
pop ebp
ret
Function at 0x403300
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push edi
xor edi, edi
mov dword [esp + 0xc], 3
mov dword [esp + 8], edi
mov dword [esp + 0x10], 4
cmp esi, edi
je 0x4033f9
push ebx
mov ebx, dword [sym.imp.WININET.dll_HttpSendRequestW]
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetQueryOptionW]
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x4033f7
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4033b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f0d
je 0x403368
cmp eax, 0x2f19
jne 0x4033a4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1f
push esi
mov dword [esp + 0x2c], 4
call ebp
or dword [esp + 0xc], 0x3180
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x403330
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403330
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x20000013
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov edi, eax
test edi, edi
je 0x4033a8
cmp dword [esp + 0x10], 0xc8
je 0x4033f7
xor edi, edi
jmp 0x403330
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret