joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412728
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
dec edi
lea esi, [ebp - 0x1c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, esi
push str._360seup_manual_
call fcn.00411fe0
cmp byte [esi + 0xb], 0
jns 0x41275e
mov esi, dword [ebp - 0x1c]
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x4127f7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4127fb
lea ebx, [ebp - 0x28]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
push 0x8f0
push ebx
call fcn.00417c5c
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x4127a2
mov ebx, dword [ebp - 0x28]
xor eax, eax
push ebx
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4127df
mov edi, eax
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4127c8
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x1d], 0
jns 0x4127f7
push dword [ebp - 0x28]
call fcn.00494236
add esp, 4
xor esi, esi
jmp 0x4127fe
xor esi, esi
inc esi
cmp byte [ebp - 0x11], 0
jns 0x41280f
push dword [ebp - 0x1c]
call fcn.00494236
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41375a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x414
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x418], ecx
xor esi, esi
mov dword [ebp - 0x41c], esi
lea ebx, [ebp - 0x410]
push 0x400
push 0xff
push ebx
call fcn.0049dcc0
add esp, 0xc
mov dword [ebx - 4], esi
push 0x60
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
jne 0x4137c2
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test eax, eax
je 0x413890
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41384e
mov edi, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41384e
mov dword [ebp - 0x420], eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, 0x8007000e
cmp eax, 0xffffffff
je 0x413855
mov ebx, eax
inc eax
lea ecx, [ebp - 0x414]
push eax
call fcn.0041389c
lea eax, [ebp - 0x414]
mov eax, dword [eax]
test eax, eax
je 0x413855
push ebx
push eax
push ebx
push dword [ebp - 0x420]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x41384e
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x414]
mov word [ecx + eax*2], 0
lea ecx, [ebp - 0x41c]
push edx
push dword [ebp - 0x414]
call fcn.004138d2
jmp 0x413853
call fcn.0041345f
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x414]
lea ebx, [ebp - 0x410]
cmp esi, ebx
je 0x413877
lea ecx, [ebp - 0x414]
call fcn.00415320
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, edi
add esp, 0x414
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor esi, esi
call fcn.0041345f
mov edi, eax
jmp 0x413868
Function at 0x414a68
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x214], esi
mov eax, dword [ecx]
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x230], ecx
or ecx, 0x2001f
lea edi, [ebp - 0x210]
mov dword [edi], esi
push edi
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x414abd
mov ebx, eax
jmp 0x414b8d
mov ebx, dword [ebp - 0x210]
lea eax, [ebp - 0x21c]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x230]
and ecx, 0x300
mov dword [eax + 4], ecx
xor eax, eax
dec eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0x228]
mov dword [eax], 0x100
push 0x200
push 0xff
push edi
call fcn.0049dcc0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x414b47
lea ecx, [ebp - 0x21c]
push edi
call fcn.00414a68
test eax, eax
jne 0x414b7a
mov dword [ebp - 0x228], 0x100
mov ebx, dword [ebp - 0x21c]
jmp 0x414b07
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x414b62
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x22c]
push dword [ebp + 8]
call fcn.0041522c
mov ebx, eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x414b8d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x41606c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x814
mov esi, ecx
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x820]
movdqu xmmword [eax], xmm0
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea edi, [ebp - 0x810]
push 0x800
push 0
push edi
call fcn.0049dcc0
add esp, 0xc
push dword [esi + 0x64]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x400
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x416147
lea ebx, [ebp + 8]
push 1
push dword [ebx]
call dword [sym.imp.GDI32.dll_SetBkMode]
xor eax, eax
push eax
push eax
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push dword [ebx]
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test byte [esi + 0x44], 4
je 0x41611b
xor eax, eax
inc eax
push eax
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esi + 0x68]
sub dword [ebp - 0x81c], eax
push 0x25
lea eax, [ebp - 0x820]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_DrawTextW]
push edi
push dword [ebx]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x814
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x417c5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
movsd qword [edi], xmm0
mov dword [edi + 8], 0
mov eax, dword [0x4ee6b0]
cmp eax, 0x4ee6b4
je 0x417cbc
cmp dword [eax + 0x10], esi
je 0x417d8b
mov edx, dword [eax + 4]
test edx, edx
je 0x417ca9
mov ecx, edx
mov edx, dword [edx]
test edx, edx
jne 0x417c9f
jmp 0x417cb2
mov ecx, dword [eax + 8]
cmp dword [ecx], eax
mov eax, ecx
jne 0x417ca9
mov eax, ecx
cmp ecx, 0x4ee6b4
jne 0x417c8f
mov ecx, dword [0x4ed688]
mov eax, esi
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
mov dword [ebp - 0x20], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x417d75
mov ebx, eax
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x417d75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x417d75
mov edi, eax
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setg cl
and esi, 0xf
je 0x417d35
test eax, eax
jle 0x417d35
mov edx, edi
add edx, eax
dec esi
movzx eax, word [edi]
lea edi, [edi + eax*2]
add edi, 2
cmp edi, edx
setb cl
add esi, 0xffffffff
jae 0x417d35
cmp edi, edx
jb 0x417d1e
test cl, cl
je 0x417d75
movzx eax, word [edi]
test eax, eax
je 0x417d75
test edi, edi
je 0x417d75
add edi, 2
lea ecx, [ebp - 0x1c]
push eax
push edi
call fcn.00417bc6
mov esi, dword [ebp + 8]
cmp byte [esi + 0xb], 0
jns 0x417d64
push dword [esi]
call fcn.00494236
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
jmp 0x417d7d
call fcn.0045eeb0
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
jmp 0x417da2
add eax, 0x14
mov ecx, edi
push eax
call fcn.00417daa
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418690
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, 0x4d42ee
mov edi, 0x103
push str.360se6
push ebx
push edi
push 0x4ee6c2
call fcn.00418795
add esp, 0x10
call fcn.004187f0
mov esi, 0x4f18dc
push esi
push ebx
push edi
push 0x4ee8ca
call fcn.00418795
add esp, 0x10
call fcn.004187f0
push esi
push ebx
push edi
push 0x4eead2
call fcn.00418795
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push ebx
push edi
push 0x4eecda
call fcn.00418795
add esp, 0x10
call fcn.0041885e
push 0x4f1ae4
push ebx
push edi
push 0x4efb12
call fcn.00418795
add esp, 0x10
call fcn.0041894a
push 0x4f13d4
push ebx
push edi
push 0x4ef702
call fcn.00418795
add esp, 0x10
call fcn.004189d2
push 0x4f14d4
push ebx
push edi
push 0x4eff22
call fcn.00418795
add esp, 0x10
call fcn.00418a9a
push 0x4f15d4
push ebx
push edi
push 0x4efd1a
call fcn.00418795
add esp, 0x10
mov esi, dword [ebp + 8]
push dword [esi]
push 0x4d42f4
push edi
push 0x4ef2f2
call fcn.00418795
add esp, 0x10
push esi
call fcn.00418b9a
add esp, 4
push 0x104
push 0x4ef90a
call fcn.00418cb0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41885e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [edi], eax
push edi
push 1
push eax
push str.SOFTWAREMacromediaFlashPlayer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4188b1
push str.0.0.0.0
push 0x80
push 0x4f1ae4
call fcn.004b8ad8
add esp, 0xc
mov word [0x4f1be2], 0
jmp 0x418928
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
mov dword [eax], 0x100
push eax
push 0x4f1ae4
push edi
push 0
push str.CurrentVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4188fd
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x4188fd
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x41893e
test al, 1
jne 0x4188fd
cmp word [eax + 0x4f1ae2], 0
je 0x418914
push str.0.0.0.0
push 0x80
push 0x4f1ae4
call fcn.004b8ad8
add esp, 0xc
mov word [0x4f1be2], 0
test esi, esi
je 0x418928
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004961ed
mov eax, 0x4f1ae4
add esp, 0xc
pop esi
pop edi
pop ebp
ret
mov word [0x4f1ae4], 0
jmp 0x418914
Function at 0x4189d2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp word [0x4f14d4], 0
jne 0x418a83
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push edi
push 1
push esi
push str.Software360360se6Chrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418a55
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
mov dword [eax], 0x100
push eax
push 0x4f14d4
push edi
push 0
push 0x4d4372
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418a55
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
ja 0x418a55
cmp dword [ebp - 0x14], 0
jne 0x418a55
mov word [0x4f14d4], 0
cmp word [0x4f14d4], 0
jne 0x418a78
push str.360se
push 0x4d42ee
push 0x7f
push 0x4f14d4
call fcn.00418795
add esp, 0x10
test esi, esi
je 0x418a83
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004961ed
mov eax, 0x4f14d4
add esp, 0xc
pop esi
pop edi
pop ebp
ret

Function at 0x418cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.0041b546
push edi
push esi
push 0x4f16d4
call fcn.00418d98
add esp, 0xc
test eax, eax
je 0x418ce6
xor ebx, ebx
inc ebx
jmp 0x418d19
lea eax, [ebp - 0x14]
mov dword [eax], 4
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
test eax, eax
jne 0x418d19
xor ebx, ebx
cmp word [esi], 0
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418d98
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x4010
call fcn.0049af20
mov ebx, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x4010]
push 0x4000
push 0
push edi
call fcn.0049dcc0
add esp, 0xc
lea eax, [ebp - 0x4014]
mov dword [eax], 0xffffffff
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [eax - 0x4000]
xor esi, esi
cmp ecx, 0xffffc001
jb 0x418e60
push edi
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x418e60
xor eax, eax
dec eax
lea ecx, [ebp - 0x4018]
mov dword [ecx], eax
lea edx, [ebp - 0x401c]
mov dword [edx], eax
push edx
push ecx
push 0x4d46f4
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x418e60
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x4018]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, 0xffff
mov edi, ecx
and edi, edx
shr ecx, 0x10
and edx, eax
shr eax, 0x10
mov ebx, dword [ebp + 0xc]
push edi
push ecx
push edx
push eax
push 0x4d46f8
push esi
push ebx
call fcn.00418795
add esp, 0x1c
mov word [ebx + esi*2 - 2], 0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
add esp, 0x4010
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x419148
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor esi, esi
lea edi, [ebp - 0x14]
mov dword [edi], esi
push edi
push eax
push esi
push str.Software360360se6Chrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x419183
mov bl, 1
jmp 0x4191f7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
xor edx, edx
dec edx
lea ecx, [ebp - 0x18]
mov dword [ecx], edx
mov edx, 4
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push edx
push ecx
push esi
push str.joininexperience
push eax
call ebx
mov eax, ebx
lea ecx, [ebp - 0x1c]
cmp dword [ecx], esi
lea ecx, [ebp - 0x18]
mov edx, 0xffffffff
mov dword [ecx], edx
setne bl
mov edx, 4
mov dword [ebp - 0x14], edx
lea edx, [ebp - 0x20]
mov dword [edx], esi
push edi
mov edi, dword [ebp - 0x24]
push edx
push ecx
push esi
push str.fulldump
push edi
call eax
lea eax, [ebp - 0x20]
cmp dword [eax], esi
je 0x4191ec
mov byte [0x4f0d94], 1
test edi, edi
je 0x4191f7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41920c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.00419148
test al, al
je 0x419275
mov edi, dword [ebp + 8]
call fcn.0041927a
sub esp, 4
call fcn.0041949c
add esp, 4
call fcn.0041a04a
mov esi, eax
push edi
call fcn.0041a476
add esp, 4
test esi, esi
je 0x419246
call fcn.0041ac30
mov eax, dword [0x4f0d78]
test eax, eax
je 0x419264
xor esi, esi
push 0x8000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x4f0d78], esi
call fcn.00418589
add eax, 0x5d120
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop edi
pop ebp
ret
Function at 0x41927a
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1470
call fcn.0049af20
mov esi, esp
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esi + 0x1468], eax
cmp byte [0x4ee6c0], 0
jne 0x419487
lea eax, [esi + 0x420]
push 0x1048
push 0
push eax
call fcn.0049dcc0
add esp, 0xc
call fcn.00418528
mov edi, eax
cmp byte [eax + 0xb], 0
jns 0x4192d2
mov edi, dword [edi]
test edi, edi
je 0x419333
push edi
call fcn.004b7fc0
add esp, 4
xor ebx, ebx
cmp eax, 0x3ffffffe
jg 0x419335
lea ecx, [eax + 1]
mov dword [esi + 0xc], ecx
lea ecx, [eax*2 + 2]
lea eax, [eax*2 + 5]
and eax, 0xfffffffc
call fcn.0049af20
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.0049dcc0
add esp, 0xc
mov word [ebx], 0
push dword [esi + 0xc]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove ebx, eax
jmp 0x419335
xor ebx, ebx
mov eax, 0x4efd1a
mov ecx, 0x4eead2
mov edi, 0x823
push 0x4eff22
push ebx
push eax
push 0x4ef90a
push 0x4ef702
push 0x4ef4fa
push 0x4ef2f2
push 0x4ef0ea
push 0x4eeee2
push ecx
push 0x4ee6c2
xor edx, edx
push edx
push edx
push ecx
push eax
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360se6bq_dim_kpid__guid__ver_dim_v360se6___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
push edi
lea eax, [esi + 0x420]
push eax
call fcn.00418795
add esp, 0x48
call fcn.00418589
mov edi, eax
mov ecx, eax
call fcn.0044e570
lea ebx, [edi + 0x5d530]
push 0x1048
xor eax, eax
push eax
push ebx
call fcn.0049dcc0
add esp, 0xc
mov eax, 0x4d42ee
lea ecx, [esi + 0x420]
push ecx
push eax
mov eax, 0x823
push eax
push ebx
call fcn.0041b740
add esp, 0x10
lea eax, [esi + 0x218]
mov ecx, 0x208
push ecx
xor ebx, ebx
push ebx
push eax
call fcn.0049dcc0
add esp, 0xc
lea eax, [esi + 0x10]
mov ecx, 0x208
push ecx
push ebx
push eax
mov ebx, eax
call fcn.0049dcc0
add esp, 0xc
mov eax, 0x103
lea ecx, [esi + 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push 0x4d4068
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ebx, [edi + 0x5d120]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.0049dcc0
add esp, 0xc
lea eax, [esi + 0x10]
push eax
mov eax, 0x4d42ee
push eax
mov eax, 0x103
push eax
push ebx
call fcn.0041b79c
add esp, 0x10
mov dword [edi + 0x2468], 1
mov dword [edi + 0x26a8], 0x1388
mov ecx, edi
call fcn.0044e2b0
mov ecx, edi
push 0x1f40
call fcn.0044e790
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x1468]
xor ecx, ebp
call fcn.004961ed
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41ac30
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x630
mov esi, esp
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esi + 0x628], eax
lea eax, [esi + 0xc]
mov dword [eax], 0
push eax
call fcn.0041b07e
add esp, 4
mov dword [0x4f0d78], eax
test eax, eax
je 0x41ae17
mov eax, 0x208
xor ecx, ecx
lea edi, [esi + 0x420]
push eax
push ecx
push edi
call fcn.0049dcc0
add esp, 0xc
mov eax, 0x103
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esi + 0x218]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.0049dcc0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push 0x4d4068
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call fcn.00418589
mov edi, eax
mov ecx, eax
call fcn.0044e570
lea ebx, [edi + 0x5d530]
push 0x1048
xor eax, eax
push eax
push ebx
call fcn.0049dcc0
add esp, 0xc
mov eax, 0x4d42ee
push str.http:__crash.browser.360.cn_interface_dumpinfo_
push eax
push 0x823
push ebx
call fcn.0041b740
add esp, 0x10
lea ebx, [edi + 0x5d120]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.0049dcc0
add esp, 0xc
lea eax, [esi + 0x218]
push eax
mov eax, 0x4d42ee
push eax
mov eax, 0x103
push eax
push ebx
call fcn.0041b79c
add esp, 0x10
mov dword [edi + 0x26a8], 0x2710
lea ecx, [esi + 0x10]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ecx
call fcn.0049dcc0
add esp, 0xc
sub esp, 0x54
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
xor eax, eax
dec eax
mov dword [ebx + 0x50], eax
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
mov word [ebx], 0
push 0x2a
push ebx
push eax
push str.___________________________7d9114302a0cb6
xor eax, eax
push eax
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove ebx, eax
push ebx
push str.multipart_form_data__boundary_s
mov eax, 0x103
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00418795
add esp, 0x10
mov eax, dword [esi + 0xc]
mov ecx, dword [0x4f0d78]
mov dword [edi + 0x2480], ecx
mov dword [edi + 0x2484], eax
lea ebx, [edi + 0x2488]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.0049dcc0
add esp, 0xc
lea eax, [esi + 0x10]
push eax
mov eax, 0x4d42ee
push eax
mov eax, 0x103
push eax
push ebx
call fcn.0041b79c
add esp, 0x10
mov ecx, edi
call fcn.0044e2b0
mov ecx, edi
push 0x2ee0
call fcn.0044e790
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x628]
xor ecx, ebp
call fcn.004961ed
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41aeba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x830
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x834]
push 0x824
push 0
push ebx
call fcn.0049dcc0
add esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x41afc5
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push 0x823
push ebx
call fcn.0041b023
add esp, 0x18
push ebx
call fcn.004b7fc0
add esp, 4
mov dword [ebp - 0x838], eax
push 0x4d4589
push esi
call fcn.004b3e5e
add esp, 8
test eax, eax
je 0x41b005
mov esi, eax
xor edi, edi
push 2
push edi
push eax
call fcn.004b5e2c
add esp, 0xc
push esi
call fcn.004b614f
add esp, 4
mov ebx, eax
push edi
push edi
push esi
call fcn.004b5e2c
add esp, 0xc
mov eax, dword [ebp - 0x838]
lea ecx, [eax + ebx]
add ecx, 2
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x41afb5
push dword [ebp - 0x838]
lea eax, [ebp - 0x834]
push eax
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x83c], ecx
call fcn.0049d740
add esp, 0xc
add edi, dword [ebp - 0x838]
push esi
push 1
push ebx
push edi
call fcn.004b5b3c
add esp, 0x10
mov word [ebx + edi], 0xa0d
mov edi, dword [ebp - 0x83c]
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
push esi
call fcn.004b53b5
add esp, 4
jmp 0x41b00e
push esi
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push 0x823
push ebx
call fcn.0041b023
add esp, 0x18
push ebx
call fcn.004b7fc0
add esp, 4
mov esi, eax
xor eax, eax
cmp esi, dword [edi]
jae 0x41b001
push esi
push ebx
push dword [ebp + 8]
call fcn.0049d740
add esp, 0xc
mov eax, esi
mov dword [edi], eax
jmp 0x41b00e
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x830
pop esi
pop edi
pop ebx
pop ebp
ret