joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ba8c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffed8
mov ebp, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x128
call fcn.00403568
mov dword [esp], 0x128
xor edx, edx
mov eax, 0xf
call fcn.0046c1ac
mov edi, eax
mov edx, esp
mov eax, edi
call fcn.0046c1cc
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x48bafd
cmp ebp, dword [esp + 0x18]
jne 0x48baee
mov eax, dword [esp + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x48baee
push 0
push esi
call sub.kernel32.dll_TerminateProcess
mov edx, esp
mov eax, edi
call fcn.0046c1ec
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48bacc
push ebp
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x48bb19
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push edi
call sub.kernel32.dll_CloseHandle
add esp, 0x128
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48bb2c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa8
xor eax, eax
push ebp
push 0x48bc63
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x12d]
xor ecx, ecx
mov edx, 0x128
call fcn.00403568
mov dword [ebp - 0x12d], 0x128
xor edx, edx
mov eax, 0xf
call fcn.0046c1ac
mov esi, eax
lea edx, [ebp - 0x12d]
mov eax, esi
call fcn.0046c1cc
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x48bc2f
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 4]
call fcn.00408be4
mov eax, dword [ebp - 0x134]
push eax
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x109]
mov ecx, 0x104
call fcn.00404d98
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00408be4
mov eax, dword [ebp - 0x138]
pop edx
call fcn.00408df0
test eax, eax
jne 0x48bc1c
call sub.kernel32.dll_GetCurrentProcessId
mov edi, dword [ebp - 0x125]
cmp eax, edi
je 0x48bc1c
push 0
push edi
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov byte [ebp - 5], 1
lea edx, [ebp - 0x12d]
mov eax, esi
call fcn.0046c1ec
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x48bbab
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bc6a
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.00404b4c
lea eax, [ebp - 4]
call fcn.00404b28
ret
Function at 0x48d178
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x48d190
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x48d189
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403568
xor edx, edx
mov eax, str.80_
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x48d1f7
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x48d1ae
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x48d440
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x48d459
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x48d452
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x48d46b
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x48d464
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0048d030
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x48d485
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.0048d140
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x48d50d
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x48d52b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0048d0c0
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x48d555
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49b3a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49b3ce
mov eax, ebx
call fcn.0049be54
cmp dword [ebx + 0x40], 0
je 0x49b3c7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49b43f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x49b431
cmp dword [ebx + 8], 0
je 0x49b3f0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x49b402
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49b431
cmp dword [ebx + 8], 0
je 0x49b3e3
cmp eax, 3
je 0x49b415
dec eax
jne 0x49b3e3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49b3e3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49b3e3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x49b45d
cmp dword [ebx + 0x14], 0xcc
je 0x49b45d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049b468
pop ebx
ret

Function at 0x4ab950
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
jmp 0x4ab9ea
mov eax, dword [edi + 0xc]
add eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
mov ebx, dword [edi + 0x10]
add ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [edi + 4], 0xffffffff
jne 0x4ab9e2
mov ebx, dword [edi]
add ebx, dword [ebp + 8]
jmp 0x4ab9e2
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4ab9dc
test byte [ebx + 3], 0x80
je 0x4ab9b8
mov eax, dword [ebx]
and eax, 0xffff
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
jmp 0x4ab9cc
mov eax, dword [ebp + 8]
add eax, dword [ebx]
add eax, 2
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
add ebx, 4
add esi, 4
cmp dword [ebx], 0
jne 0x4ab98b
add edi, 0x14
cmp dword [edi + 0x10], 0
je 0x4ab9fa
cmp dword [edi + 0xc], 0
jne 0x4ab961
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ae5ac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404d98
add esp, 0x10c
pop ebx
ret
Function at 0x4b5c8c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x4b3d04
call fcn.00406d80
mov ebx, dword [0x4b9edc]
xor eax, eax
push ebp
push 0x4b5d5e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.00462cb4
mov eax, dword [ebx]
mov edx, 0x4b5d74
call fcn.0046276c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403298
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409cec
mov edx, dword [ebp - 0x14]
mov eax, 0x4c6b30
mov ecx, 0x4b5d84
call fcn.00404e40
mov eax, dword [0x4c6b30]
call fcn.00409954
test al, al
jne 0x4b5d07
mov eax, dword [ebx]
mov byte [eax + 0x5b], 0
push 0
mov eax, dword [ebx]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
push 0x80
push 0xffffffffffffffec
mov eax, dword [ebx]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
mov ecx, dword [0x4b9b88]
mov eax, dword [ebx]
mov edx, dword [0x4ad3e0]
call fcn.00462ccc
cmp dword [ebx], 0
mov eax, dword [ebx]
call fcn.00462d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5d65
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404b4c
ret
Function at 0x401a6c
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42e]
mov word [ebp - 0x430], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x18]
pop edi
mov esi, 0x103
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4160f0
push 0x4160c0
push 0x80000002
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x430], bx
je 0x401c22
lea eax, [ebp - 0x430]
mov word [ebp - 0x3f0], bx
push eax
push str.pq.f.360.cn
call fcn.00401d3d
pop ecx
cmp eax, edi
pop ecx
je 0x401c22
cmp eax, ebx
jne 0x401afe
xor al, al
jmp 0x401c24
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x124]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x124]
push str.midserver.ini
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x124]
push eax
push str.http:__pq.conf.f.360.cn_getconf.php
call fcn.0040203b
pop ecx
test al, al
pop ecx
je 0x401c15
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x227]
mov byte [ebp - 0x228], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push esi
push eax
push 0x41a824
push str.server
push 0x416070
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [ebp - 1]
push 0xa
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x14]
push 0x2c
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.00401c29
add esp, 0x10
cmp dword [ebp - 0x10], ebx
je 0x401c0d
mov esi, dword [ebp - 0xc]
sub esi, dword [ebp - 0x10]
sar esi, 4
cmp esi, ebx
jle 0x401c0d
push ebx
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
pop ecx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
idiv esi
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
cmp eax, ebx
jne 0x401bed
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x430]
push ecx
push eax
call fcn.00401d3d
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x14]
setne bl
call fcn.00402196
mov al, bl
jmp 0x401c24
lea ecx, [ebp - 0x14]
call fcn.00402196
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401eaf
Capabilities:
Check http status code
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.0040cdd0
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x416180
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x402035
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x40202c
push edi
push ebx
lea ecx, [ebp - 0x20]
push 0x4000000
push ecx
push ebx
push str.HTTP_1.0
push str._midinfo.php
push str.POST
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x41613c
mov dword [ebp - 0x18], ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 8], edi
je 0x402022
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x402018
push 4
lea eax, [ebp + 0x10]
pop esi
or dword [ebp - 0xc], 0xffffffff
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp + 0x10], esi
push eax
push 0x20000013
push edi
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
call edi
cmp dword [ebp - 0xc], 0xc8
jne 0x402018
lea eax, [ebp + 0x10]
push ebx
or dword [ebp + 0xc], 0xffffffff
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0x10], esi
push eax
push 0x20000005
push dword [ebp - 8]
call edi
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x201f]
mov byte [ebp - 0x2020], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2020]
push 0x1fff
push eax
push dword [ebp - 8]
mov dword [ebp + 8], ebx
xor edi, edi
call esi
test eax, eax
je 0x402018
cmp dword [ebp + 8], ebx
je 0x402014
mov eax, dword [ebp + 0x18]
sub eax, edi
cmp dword [ebp + 8], eax
ja 0x401fe6
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2020]
push eax
mov eax, dword [ebp + 0x14]
add eax, edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2020]
push 0x1fff
push eax
push dword [ebp - 8]
jmp 0x401fce
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
push dword [ebp - 0x10]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
push dword [ebp - 0x14]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x40203b
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2214
call fcn.0040cdd0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp byte [edi], bl
je 0x40218f
mov esi, dword [ebp + 0xc]
cmp byte [esi], bl
je 0x40218f
push ebx
push ebx
push ebx
push ebx
push 0x416180
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40218f
lea ecx, [ebp - 0x10]
push 4
push ecx
push 2
push eax
mov dword [ebp - 0x10], 0x3a98
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push 0x80000000
push ebx
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x402186
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
push 0x13
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x40217d
lea eax, [ebp - 0x210]
push 0x416214
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x40217d
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40217d
mov ecx, 0x800
xor eax, eax
lea edi, [ebp - 0x2213]
mov byte [ebp - 0x2214], bl
rep stosd dword es:[edi], eax
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0x2214]
push 0x2000
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402176
cmp dword [ebp + 8], ebx
je 0x402176
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x2214]
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x402121
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
xor al, al
pop ebx
leave
ret

Function at 0x402d17
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ecx + 0x30]
push esi
lea esi, [ecx + 0x30]
cmp dword [eax - 8], 0
jne 0x402da4
and word [ebp - 0x210], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov dword [ebp - 4], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x402da4
lea eax, [ebp - 0x210]
test eax, eax
je 0x402d95
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
push ecx
push eax
mov ecx, esi
call fcn.004039b5
mov eax, dword [esi]
pop esi
leave
ret
Function at 0x402da9
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], bx
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x208]
lea edi, [esi + 0x1c]
push eax
push str._s360chrome
push edi
call fcn.00403493
add esp, 0xc
add esi, 0x20
mov ecx, esi
push edi
call fcn.00403443
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [esi]
call ebx
mov edi, 0x416364
mov eax, edi
test eax, eax
je 0x402e22
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, esi
call fcn.004039f4
push 0
push dword [esi]
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403269
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040cdd0
and word [ebp - 0x1000], 0
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0xffe]
push dword [ebx + 0x24]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1000]
push 0x800
push eax
push 0x41ab44
push dword [ebp + 0xc]
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1000]
test eax, eax
je 0x4032cd
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1000]
push ecx
push eax
mov ecx, esi
call fcn.004039b5
push 0x4165d0
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_wcsstr]
pop ecx
test eax, eax
pop ecx
je 0x403351
cmp word [ebp - 0x1000], 0
je 0x403351
push dword [ebp + 0xc]
push dword [ebx + 0x20]
push str._s_s.png
push esi
call fcn.00403493
add esp, 0x10
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403325
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 3
pop edi
push dword [esi]
lea eax, [ebp - 0x1000]
push eax
call fcn.00402e3b
pop ecx
test eax, eax
pop ecx
jne 0x403341
dec edi
test edi, edi
jg 0x403328
test edi, edi
jne 0x403351
mov ecx, esi
call fcn.0040340c
or eax, 0xffffffff
jmp 0x403353
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x405762
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
lea eax, [esi + 0x2c]
push dword [ebp + 0xc]
push eax
call edi
test eax, eax
je 0x4057aa
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 2
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x405808
push dword [ebp + 0x10]
lea eax, [esi + 0x4c]
push dword [ebp + 0xc]
push eax
call edi
test eax, eax
je 0x4057e4
mov eax, dword [esi + 0xf8]
test eax, eax
jne 0x4057dd
push 5
push eax
push eax
push str.http:__chrome.360.cn_dlcse.html_feature5
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x405808
cmp eax, 2
jne 0x405808
jmp 0x4057f4
push dword [ebp + 0x10]
lea eax, [esi + 0x3c]
push dword [ebp + 0xc]
push eax
call edi
test eax, eax
je 0x405804
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 1
jmp 0x40579a
and dword [esi + 0x20], 0
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4068fb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x80]
cmp eax, 0xffffffff
jne 0x406931
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [esi + 0x20]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
call ebx
push dword [esi + 4]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4069b9
lea edi, [eax + 1]
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0040cdd0
mov dword [ebp - 4], esp
push edi
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4069b9
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor ecx, ecx
test al, 1
je 0x406992
push 1
jmp 0x4069a0
test al, 2
je 0x40699a
push 2
jmp 0x4069a0
test al, 0xb
je 0x4069a1
push 0x24
pop ecx
or cx, 0x210
lea eax, [ebp - 0x18]
push ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x406f3d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x417238
cmp byte [esi + 0x1c], 0
jne 0x406f50
mov ecx, 0x417230
mov eax, dword [0x41c4b8]
push ecx
movzx ecx, word [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x406f6f
or eax, 0xffffffff
jmp 0x406faa
mov ecx, dword [0x41c4b8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [0x41c4b8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esi + 0x14], eax
je 0x406f6a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov dword [esi + 0x18], eax
test eax, eax
setne cl
dec ecx
mov eax, ecx
pop esi
ret 4