joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aa94
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407494]
call fcn.00405198
xor eax, eax
push ebp
push 0x45ac35
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4686fc], 0
jne 0x45aaef
mov ecx, dword [0x4e0680]
mov dl, 1
mov eax, dword [0x407a60]
call fcn.0040c36c
call fcn.00404170
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403238
mov eax, ebx
call fcn.00405068
mov dword [ebp - 0x24], eax
mov esi, 0x45ac44
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040612c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405078
test eax, eax
jle 0x45abd8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45abc4
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404998
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x45ab6a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004049b0
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x45ab80
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004049b0
mov eax, dword [ebp - 0x54]
call fcn.00404bec
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404998
mov eax, dword [ebp - 0x58]
call fcn.00404bec
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x45abc6
xor eax, eax
test al, al
je 0x45abd1
mov ebx, 0x15
jmp 0x45abdd
mov ebx, 0x10
jmp 0x45abdd
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4686fc]
call fcn.0045a918
mov eax, dword [ebp - 4]
call fcn.0045a918
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ac3c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040474c
lea eax, [ebp - 0xc]
mov edx, dword [0x407494]
call fcn.00405268
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sym._strlen
mov esi, eax
xor eax, eax
test esi, esi
je 0x4016b7
cmp byte [ebx + esi - 1], 0xa
je 0x40168b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov edx, 0x4060a4
lock xchg dword [edx], eax
mov dword [esp], 2
call dbg.__acrt_iob_func
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._fwrite
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401df0
mov eax, dword fs:[0x18]
mov edi, dword [0x4060a4]
cmp dword [eax + 0x24], edi
je 0x401de3
test byte [0x40401c], 8
jne 0x401d90
lea ebx, [ebp - 0xe0]
mov edi, ebx
test byte [0x40402c], 8
jne 0x401d50
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401ce2
cmp esi, 3
ja 0x401ce2
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x40549c]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym.__snprintf
mov dword [esp], 2
call dbg.__acrt_iob_func
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401cf2
mov esi, edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
shr esi, 0x10
test edx, 0x8080
mov dword [esp], ebx
cmove edx, esi
lea esi, [ecx + 2]
mov eax, edx
cmove ecx, esi
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call sym._fwrite
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x40402c
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401c7d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x401c7d
mov dword [esp], 0x40401c
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401c68
call sym._GetTickCount_0
mov edx, 0x10624dd3
mov ecx, eax
lea ebx, [ebp - 0xe0]
mul edx
mov dword [esp + 4], str._3u._03u:
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x401c70
add esp, 0xfc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x401d3e

Function at 0x402420
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable
Function at 0x402480
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x406440]
test esi, esi
jle 0x40256d
mov edi, dword [0x406444]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4024b4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x402566
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x4024a0
mov dword [esp], eax
mov esi, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x4025aa
mov esi, dword [0x406444]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x406444]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40258a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40255f
sub eax, 0x40
and eax, 0xffffffbf
je 0x40255f
mov eax, dword [esp + 0x20]
add ebx, dword [0x406444]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x402574
add dword [0x406440], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x4024be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x406444]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]

Function at 0x402a40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406458
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406450]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402a95
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402a8e
test esi, esi
je 0x402a8e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402a70
mov dword [esp], 0x406458
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x411aa0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
dec edi
lea esi, [ebp - 0x1c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, esi
push str._360seup_manual_
call fcn.0048fb00
cmp byte [esi + 0xb], 0
jns 0x411ad6
mov esi, dword [ebp - 0x1c]
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x411b74
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x411afd
xor esi, esi
inc esi
jmp 0x411b76
lea ebx, [ebp - 0x28]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
push 0x8f0
push ebx
call fcn.004162e0
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x411b1f
mov ebx, dword [ebp - 0x28]
xor eax, eax
push ebx
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x411b5c
mov edi, eax
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x411b45
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x1d], 0
jns 0x411b74
push dword [ebp - 0x28]
call fcn.00459b3c
add esp, 4
xor esi, esi
cmp byte [ebp - 0x11], 0
jns 0x411b87
push dword [ebp - 0x1c]
call fcn.00459b3c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x413840
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x214], esi
mov eax, dword [ecx]
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x230], ecx
or ecx, 0x2001f
lea edi, [ebp - 0x210]
mov dword [edi], esi
push edi
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4138a9
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ebx, dword [ebp - 0x210]
lea eax, [ebp - 0x21c]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x230]
and ecx, 0x300
mov dword [eax + 4], ecx
xor eax, eax
dec eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0x228]
mov dword [eax], 0x100
push 0x200
push 0xff
push edi
call fcn.00463600
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x413933
lea ecx, [ebp - 0x21c]
push edi
call fcn.00413840
test eax, eax
jne 0x413966
mov dword [ebp - 0x228], 0x100
mov ebx, dword [ebp - 0x21c]
jmp 0x4138f3
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x41394e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x22c]
push dword [ebp + 8]
call fcn.00413f40
mov ebx, eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x413890
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413890
Function at 0x414c70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x814
mov esi, ecx
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x820]
movdqu xmmword [eax], xmm0
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea edi, [ebp - 0x810]
push 0x800
push 0
push edi
call fcn.00463600
add esp, 0xc
push dword [esi + 0x64]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x400
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x414d4b
lea ebx, [ebp + 8]
push 1
push dword [ebx]
call dword [sym.imp.GDI32.dll_SetBkMode]
xor eax, eax
push eax
push eax
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push dword [ebx]
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test byte [esi + 0x44], 4
je 0x414d1f
xor eax, eax
inc eax
push eax
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esi + 0x68]
sub dword [ebp - 0x81c], eax
push 0x25
lea eax, [ebp - 0x820]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_DrawTextW]
push edi
push dword [ebx]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
add esp, 0x814
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4162e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
movsd qword [edi], xmm0
mov dword [edi + 8], 0
mov eax, dword [0x4f36e0]
cmp eax, 0x4f36e4
jne 0x4163f5
mov ecx, dword [0x4f26c8]
mov eax, esi
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
mov dword [ebp - 0x20], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x416397
mov ebx, eax
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x416397
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x416397
mov edi, eax
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setg cl
and esi, 0xf
je 0x416388
test eax, eax
jle 0x416388
mov edx, edi
add edx, eax
dec esi
movzx eax, word [edi]
lea edi, [edi + eax*2]
add edi, 2
cmp edi, edx
setb cl
add esi, 0xffffffff
jae 0x416388
cmp edi, edx
jb 0x416371
test cl, cl
je 0x416397
movzx eax, word [edi]
test eax, eax
je 0x416397
test edi, edi
jne 0x41640c
call fcn.004b7db0
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [eax + 0x14]
cmp ecx, edi
je 0x41639f
cmp byte [eax + 0x1f], 0
js 0x4163d0
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
movsd xmm0, qword [ecx]
movsd qword [edi], xmm0
jmp 0x41639f
mov ecx, edi
push dword [eax + 0x18]
push dword [eax + 0x14]
call fcn.0042a420
jmp 0x41639f
mov ecx, edx
mov edx, dword [edx]
test edx, edx
jne 0x4163df
mov eax, ecx
cmp ecx, 0x4f36e4
je 0x416317
cmp dword [eax + 0x10], esi
je 0x4163b3
mov edx, dword [eax + 4]
test edx, edx
jne 0x4163df
mov ecx, dword [eax + 8]
cmp dword [ecx], eax
mov eax, ecx
jne 0x416401
jmp 0x4163e7
add edi, 2
lea ecx, [ebp - 0x1c]
push eax
push edi
call fcn.00490f90
mov edi, dword [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x41642c
push dword [edi]
call fcn.00459b3c
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
jmp 0x4163ca
Function at 0x416970
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.360se6
push 0x4d820e
push 0x103
push 0x4f36f2
call fcn.00491080
add esp, 0x10
cmp word [0x4f690c], 0
jne 0x4169e0
xor edi, edi
lea esi, [ebp - 0x218]
push 0x208
push edi
push esi
call fcn.00463600
add esp, 0xc
mov ebx, 0x104
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x4f690c
push esi
call fcn.00417030
add esp, 0xc
push 0x4f690c
push 0x4d820e
push 0x103
push 0x4f38fa
call fcn.00491080
add esp, 0x10
cmp word [0x4f690c], 0
jne 0x416a3a
xor edi, edi
lea esi, [ebp - 0x218]
push 0x208
push edi
push esi
call fcn.00463600
add esp, 0xc
mov ebx, 0x104
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x4f690c
push esi
call fcn.00417030
add esp, 0xc
mov esi, dword [ebp + 8]
mov ebx, 0x4d820e
mov edi, 0x103
push 0x4f690c
push ebx
push edi
push 0x4f3b02
call fcn.00491080
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push ebx
push edi
push 0x4f3d0a
call fcn.00491080
add esp, 0x10
call fcn.00416b80
push 0x4f6b14
push ebx
push edi
push 0x4f4b42
call fcn.00491080
add esp, 0x10
cmp word [0x4f6404], 0
jne 0x416ae9
lea esi, [ebp - 0x214]
push 0x110
push 0
push esi
call fcn.00463600
add esp, 0xc
mov dword [esi - 4], 0x114
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x416ae6
lea eax, [ebp - 0x204]
push eax
push dword [eax - 8]
push dword [eax - 0xc]
push dword [eax - 0x10]
push str._d._d._d__s
push 0x7f
push 0x4f6404
call fcn.00491080
add esp, 0x1c
mov esi, dword [ebp + 8]
push 0x4f6404
push ebx
push edi
push 0x4f4732
call fcn.00491080
add esp, 0x10
call fcn.00416c60
push 0x4f6504
push ebx
push edi
push 0x4f4f52
call fcn.00491080
add esp, 0x10
call fcn.00416d30
push 0x4f6604
push ebx
push edi
push 0x4f4d4a
call fcn.00491080
add esp, 0x10
push dword [esi]
push 0x4d8214
push edi
push 0x4f4322
call fcn.00491080
add esp, 0x10
push esi
call fcn.00416e40
add esp, 4
push 0x104
push 0x4f493a
call fcn.00416f80
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push edi
push 1
push esi
push str.SOFTWAREMacromediaFlashPlayer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
test eax, eax
cmove esi, ecx
je 0x416bf7
push str.0.0.0.0
push 0x80
push 0x4f6b14
call fcn.0047e478
add esp, 0xc
mov word [0x4f6c12], 0
test esi, esi
je 0x416be1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045bb2d
mov eax, 0x4f6b14
add esp, 0xc
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
mov dword [eax], 0x100
push eax
push 0x4f6b14
push edi
push 0
push str.CurrentVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416bb6
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x416bb6
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x416c46
test al, 1
jne 0x416bb6
cmp word [eax + 0x4f6b12], 0
jne 0x416bb6
jmp 0x416bcd
mov word [0x4f6b14], 0
jmp 0x416bcd

Function at 0x416c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp word [0x4f6504], 0
jne 0x416cb5
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push edi
push 1
push esi
push str.Software360360se6Chrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [edi]
test eax, eax
cmove esi, ecx
je 0x416ccb
cmp word [0x4f6504], 0
je 0x416d0e
test esi, esi
je 0x416cb5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045bb2d
mov eax, 0x4f6504
add esp, 0xc
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
mov dword [eax], 0x100
push eax
push 0x4f6504
push edi
push 0
push 0x4d8292
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416ca0
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
ja 0x416ca0
cmp dword [ebp - 0x14], 0
jne 0x416ca0
mov word [0x4f6504], 0
jmp 0x416ca0
push str.360se
push 0x4d820e
push 0x7f
push 0x4f6504
call fcn.00491080
add esp, 0x10
jmp 0x416caa