joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d96a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x6f262c]
xor eax, eax
mov dword [ebp - 0x240], ecx
cmp dword [0x6f2630], 0x10
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x6f261c
cmovae eax, dword [0x6f261c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.005b2600
push 8
xor eax, eax
lea edi, [ebp - 0x34]
cmp dword [0x6f2614], 0x10
pop ecx
push dword [0x6f2610]
rep stosd dword es:[edi], eax
mov eax, 0x6f2600
cmovae eax, dword [0x6f2600]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.005b2600
call fcn.0041d905
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x238]
call fcn.0041c49d
mov ebx, dword [esi + 0x10]
and ebx, 0xfffffff0
add ebx, 0x10
push ebx
call fcn.0059af42
add esp, 0x20
mov dword [ebp - 0x23c], eax
cmp dword [esi + 0x14], 0x10
jb 0x41da15
mov esi, dword [esi]
mov edx, esi
mov ecx, eax
call fcn.0041d91f
xor edi, edi
test ebx, ebx
je 0x41da5c
mov esi, dword [ebp - 0x23c]
xor ecx, ecx
lea eax, [esi - 0x10]
test edi, edi
lea edx, [ebp - 0x14]
cmovne edx, eax
mov al, byte [edx + ecx]
xor byte [esi + ecx], al
inc ecx
cmp ecx, 0x10
jl 0x41da37
push esi
mov edx, esi
lea ecx, [ebp - 0x238]
call fcn.0041c8f4
add edi, 0x10
add esi, 0x10
pop ecx
cmp edi, ebx
jb 0x41da2a
mov eax, ebx
push 3
cdq
pop ecx
idiv ecx
mov eax, ebx
test edx, edx
je 0x41da6e
sub eax, edx
add eax, ecx
cdq
idiv ecx
mov edi, eax
shl edi, 2
push edi
call fcn.0059af42
mov esi, eax
mov edx, ebx
mov ebx, dword [ebp - 0x23c]
mov ecx, ebx
push esi
call fcn.0041d7d7
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
push edi
push esi
call fcn.0040b5b4
push esi
call fcn.0059aa0f
push ebx
call fcn.0059aa0f
mov eax, dword [ebp - 0x240]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret
Function at 0x41e461
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
mov eax, edx
push 1
push accept
push ecx
mov dword [eax], ebx
mov dword [ebp - 4], eax
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41e50d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
test eax, eax
je 0x41e502
cmp eax, 0xffffffff
je 0x41e502
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41e502
mov eax, dword [esi]
add eax, 8
push 0x6dacd4
push eax
call fcn.0059b11b
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [eax], ecx
test ecx, ecx
jne 0x41e4d2
mov dword [esi], ebx
jmp 0x41e502
mov eax, dword [esi]
add eax, 8
push eax
push ebx
push ecx
call fcn.005b24a0
add esp, 0xc
mov dword [ebp + 8], ebx
lea eax, [ebp + 8]
push ebx
push eax
mov eax, dword [ebp - 4]
push dword [esi]
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, dword [esi]
sete bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x41e50f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e514
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
push 0x10
mov eax, 0x5e2269
call fcn.0059bba3
mov ebx, edx
mov dword [ebp - 0x18], ebx
mov edi, ecx
test edi, edi
je 0x41e5de
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x41e5de
test ebx, ebx
je 0x41e5de
mov eax, dword [0x6d3fd4]
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x10]
xor ebx, ebx
push 0x63619c
push eax
mov dword [ebp - 4], ebx
call fcn.00414053
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x41e5d2
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ebx
push ecx
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x14], esi
push dword [ebp - 0x1c]
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x41e5d2
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x10]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call fcn.0040a4ed
mov eax, ebx
jmp 0x41e5e0
xor eax, eax
call fcn.0059bb6c
ret
Function at 0x41e62a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0059b4a0
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push esi
push edi
push 0x4000
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x41e6e6
cmp eax, 0x3fff
ja 0x41e6e6
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41e6e6
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x633b6c
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41e6e6
mov ecx, dword [ebp - 0x4008]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
push edi
call fcn.00412a13
xor eax, eax
add esp, 0x1c
mov word [edi + ebx*2 - 2], ax
inc eax
jmp 0x41e6e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret

Function at 0x41e6f7
Capabilities:
Create directory

Disassembly:
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x41e719
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41e719
xor eax, eax
inc eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x41e955
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push 0x1c
push 0x687018
call fcn.0059c060
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
test edx, edx
je 0x41e974
mov dword [edx], eax
push 1
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call edi
mov esi, eax
push 0
push 0x80
push 3
push 0
push 1
push accept
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x41e9d2
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x1000002
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x41e9d2
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x24], eax
test eax, eax
cmovne ebx, eax
push esi
call edi
test ebx, ebx
je 0x41ea53
and dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x20], edi
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41ea3c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41ea3c
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ea3c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41ea3c
movzx esi, word [eax]
cmp esi, dword [ebp - 0x1c]
ja 0x41ea36
mov dword [ebp - 0x1c], esi
add esi, 3
and esi, 0xfffffffc
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x28], 0xfeef04bd
je 0x41ea41
push 0xd
pop edi
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x41ea56
push 0xd
pop edi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x41ea64
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41ea72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x41ea81
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esi*2 + 4]
neg esi
sbb esi, esi
and eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41eaa5
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push 0x1c
push 0x687038
call fcn.0059c060
mov ebx, ecx
xor esi, esi
mov edi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp + 8], 2
jae 0x41ead2
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41ebd5
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x24], eax
push esi
push 0x80
push 3
push esi
push 1
push accept
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x41eb27
push esi
push esi
push esi
push 0x1000002
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x41eb27
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
test eax, eax
cmovne edi, eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test edi, edi
je 0x41eba8
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41eba8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
test ecx, ecx
je 0x41eba8
mov dword [ebp - 4], esi
movzx edi, word [ecx]
mov dword [ebp - 0x24], edi
lea eax, [edi*2 + 4]
cmp eax, dword [ebp + 8]
jbe 0x41eb74
mov edi, dword [ebp + 8]
shr edi, 1
sub edi, 4
mov dword [ebp - 0x24], edi
xor esi, esi
inc esi
push edi
push ecx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.005b2600
add esp, 0xc
mov dword [edi + ebx], 0x58324546
test esi, esi
je 0x41eb90
mov word [ebx], di
xor esi, esi
inc esi
jmp 0x41eb9e
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ebb6
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41ebc4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x41ebd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41f09c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
xor eax, eax
push eax
push esi
push 0x41f1c2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
ret
Function at 0x41fd2f
Capabilities:
Check http status code
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push eax
push eax
push eax
push eax
push 0x6335fc
mov bl, al
mov bh, al
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
jne 0x41fd66
xor al, al
jmp 0x41fe06
push edi
xor eax, eax
push eax
push 0x84000000
push eax
push eax
push str.http:__profile.se.360.cn_proxyerr.php
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
je 0x41fdf4
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push 0
push eax
lea eax, [ebp - 0x204]
push eax
push 0x13
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41fde9
lea eax, [ebp - 0x204]
push eax
call fcn.005c2955
pop ecx
cmp eax, 0x193
je 0x41fddb
cmp eax, 0x197
jne 0x41fde9
mov ecx, edi
call fcn.0041fd0f
test al, al
setne bl
jmp 0x41fded
xor bl, bl
mov bh, 1
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test bl, bl
jne 0x41fd67
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bh
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret

Function at 0x420d0d
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, 0x6d4560
call fcn.00404698
xor eax, eax
push eax
push eax
push eax
push 0x420a20
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x421049
Capabilities:
Read file on windows

Disassembly:
push 0x46c
mov eax, 0x5e263a
call fcn.0059bc45
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x474], esi
test edi, edi
jne 0x42107a
push 0x627e3e
call fcn.004045aa
mov eax, esi
jmp 0x4210ef
and dword [ebp - 4], 0
lea ecx, [ebp - 0x470]
call fcn.00421851
mov byte [ebp - 4], 1
mov ebx, 0x400
jmp 0x4210a7
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x470]
call fcn.004219cd
push edi
push ebx
lea eax, [ebp - 0x414]
push 1
push eax
call fcn.005c421b
add esp, 0x10
test eax, eax
jg 0x421094
push edi
call fcn.005c2c80
pop ecx
push esi
lea ecx, [ebp - 0x470]
call fcn.004218d2
jmp 0x421076
call fcn.0059bb92
ret

Function at 0x421851
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.CMD5Checksum.0
push eax
call fcn.005b24a0
and dword [esi + 0x48], 0
add esp, 0xc
and dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret
Function at 0x421b56
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x208
mov esi, ecx
lea eax, [esp + 0x2c]
push 0
mov dword [esp + 0x14], esi
push eax
mov dword [esp + 0x18], esi
call fcn.005b24a0
add esp, 0xc
lea eax, [esp + 0x28]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360base.dll
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
jne 0x421c23
lea ecx, [esp + 0x10]
call fcn.00421ac3
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call edi
test eax, eax
je 0x421c08
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x28]
push 0
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x10]
call fcn.0040b67e
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
jne 0x421c23
push 0x6335fc
jmp 0x421c28
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.0040b0d5
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret

Function at 0x4222ab
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d10
call fcn.0059b4a0
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x2d10], eax
test eax, eax
je 0x4223e9
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.00422d90
add esp, 0x10
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4223d8
and dword [ebp - 0x2d0c], 0
lea eax, [ebp - 0x2d08]
push 0xc
push 0
push eax
call fcn.005b24a0
xor eax, eax
push 0x2710
push eax
mov dword [ebp - 0x2d08], eax
mov dword [ebp - 0x2d04], eax
lea eax, [ebp - 0x2cfc]
push eax
call fcn.005b24a0
add esp, 0x18
lea eax, [ebp - 0x2d0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4223cd
push 0x3e8
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.005b24a0
mov edx, dword [ebp - 0x2ce4]
lea eax, [ebp - 0x5ec]
add esp, 0xc
push eax
push ecx
lea ecx, [ebp - 0x2cfc]
call fcn.004160d2
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2d10]
lea eax, [ebp - 0x5ec]
push eax
push 0x64
pop edx
call fcn.00422d64
xor ecx, ecx
inc ecx
test eax, eax
cmove edi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x4223e2
inc esi
cmp esi, 0x10
jl 0x4222d9
mov eax, edi
pop edi
pop esi
pop ebx
jmp 0x4223eb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059a7a2
leave
ret
Function at 0x422648
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4f4], esi
test esi, esi
je 0x42280d
push edi
push 0x64
xor edi, edi
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x4e0]
push eax
push 8
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4227ed
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x4e4], edi
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x4e8], 0x104
push eax
push edi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4227e5
mov esi, dword [ebp - 0x4e4]
lea eax, [ebp - 0x4e4]
push eax
push 1
push 0
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4227ab
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x4f0], 1
push eax
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4ec], 0x208
push eax
lea eax, [ebp - 0x4f0]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x4e4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4227a3
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.005b24a0
pop ecx
pop ecx
lea edx, [ebp - 0xcc]
lea ecx, [ebp - 0x4dc]
call fcn.0042254d
pop ecx
test eax, eax
je 0x4227a3
cmp byte [ebp - 0x68], 0
je 0x42278b
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4227a3
push accept
lea eax, [ebp - 0xcc]
push eax
push ecx
push 0x64
pop edx
lea ecx, [ebp - 0x68]
call fcn.00422d26
push dword [ebp - 0x4e4]
call edi
xor eax, eax
mov dword [ebp - 0x4e8], 0x104
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x4e8]
inc esi
push eax
lea eax, [ebp - 0x2d4]
push eax
push esi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4226e3
mov esi, dword [ebp - 0x4f4]
push dword [ebp - 0x4e0]
call edi
cmp byte [ebp - 0x68], 0
pop edi
je 0x42280d
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
push 0x64
pop edx
call fcn.00422d64
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
jmp 0x42280f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059a7a2
leave
ret
Function at 0x4229e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x422b03
mov eax, 0x400
mov dword [ebp - 0x510], 1
push eax
mov dword [ebp - 0x50c], eax
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x510]
push eax
push 0x636bdc
push str.Software360SafeLiveup
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x422b03
lea eax, [ebp - 0x508]
push eax
call fcn.005b69b0
pop ecx
cmp eax, 0x40
jne 0x422b03
push 0x20
lea eax, [ebp - 0x508]
mov ebx, 0x80
push eax
push ecx
mov edx, ebx
lea ecx, [ebp - 0x88]
call fcn.00422d26
lea eax, [ebp - 0x4e8]
mov edx, ebx
push eax
lea ecx, [ebp - 0x108]
call fcn.00422d64
mov ebx, 0x400
lea eax, [ebp - 0x508]
push ebx
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea edx, [ebp - 0x508]
lea ecx, [ebp - 0x88]
push ebx
call fcn.00421e03
pop ecx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x422b03
lea eax, [ebp - 0x88]
mov edx, edi
push eax
mov ecx, esi
call fcn.00422d64
neg eax
sbb eax, eax
inc eax
jmp 0x422b05
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret
Function at 0x422e34
Capabilities:
Get common file path

Disassembly:
push 0x450
mov eax, 0x5e27d8
call fcn.0059bbd7
lea ecx, [ebp - 0x438]
call fcn.004cb925
xor ebx, ebx
lea eax, [ebp - 0x438]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x424], 8
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x422fb1
cmp byte [0x6d468c], bl
je 0x422eb8
push str.http:__dd.browser.360.cn_static_a_555.9893.gif
lea ecx, [ebp - 0x450]
mov byte [0x6d468c], bl
call fcn.0040b0d5
push 1
push ebx
xor dl, dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x450]
call fcn.004ce396
pop ecx
pop ecx
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], bl
call fcn.0040b67e
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push ebx
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.005b24a0
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
lea eax, [ebp - 0x420]
cmovae ecx, dword [ebp - 0x438]
add esp, 8
push eax
call fcn.0041e7f9
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x454]
push eax
call fcn.00423198
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x454]
cmp dword [eax - 8], ebx
jne 0x422f67
push 0x636c78
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005c5cae
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x454]
call fcn.0040a358
push ecx
lea eax, [ebp - 0x454]
mov dword [ebp - 0x458], esp
mov ecx, esp
push eax
call fcn.0040a2a8
mov byte [ebp - 4], 3
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
push ecx
cmovae eax, dword [ebp - 0x438]
mov ecx, esp
push eax
call fcn.00423634
mov byte [ebp - 4], 2
call fcn.004230dc
lea ecx, [ebp - 0x454]
call fcn.0040a4ed
lea ecx, [ebp - 0x438]
call fcn.0040b67e
call fcn.0059bb81
ret