joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b446
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
mov dword [ebp - 0x110], ecx
push 0
mov ecx, dword [ebp - 0x110]
call fcn.0040ba0a
mov ecx, dword [ebp - 0x110]
add ecx, 0x40
call fcn.00404070
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b486
mov dword [0x53e6b0], 1
jmp 0x40b490
mov dword [0x53e6b0], 0
cmp dword [0x53e6b0], 0
je 0x40b5fb
cmp dword [0x53e6ac], 0
jne 0x40b5fb
mov dword [0x53e6ac], 1
push 0x4c1898
call fcn.0047cac0
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x114]
call dword [edx + 0x14]
test eax, eax
je 0x40b4de
jmp 0x40b5f0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10c], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4c2360
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00407f00
push 0x4c18b8
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00407f00
lea eax, [ebp - 0x108]
push eax
push 0xeb
push 0x4c236c
call fcn.0047d080
add esp, 0xc
test eax, eax
jne 0x40b561
jmp 0x40b5f0
push 0x4c1898
lea ecx, [ebp - 0x108]
push ecx
call fcn.0047cac0
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x118]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x118]
call dword [eax + 8]
test eax, eax
je 0x40b5f0
call fcn.0047cac0
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x11c]
call dword [edx + 0xc]
test eax, eax
je 0x40b5f0
call fcn.0047cac0
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x120]
call dword [edx + 0x18]
test eax, eax
je 0x40b5f0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.SYSTEMCurrentControlSetServicesTorjanFW
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00443017
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x110]
cmp dword [ecx + 0x410], 0
jne 0x40b67b
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 0x58c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x110]
push ecx
push 0
push 0x413d11
call fcn.00448a90
mov ecx, eax
call fcn.00448ce5
mov edx, dword [ebp - 0x110]
mov dword [edx + 0x410], eax
push 0
push 0x3ea
mov ecx, dword [ebp - 0x110]
add ecx, 4
call fcn.00402ad0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x3e9
mov ecx, dword [ebp - 0x110]
add ecx, 4
call fcn.00402ad0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x4c239c
push 0x439
mov ecx, dword [ebp - 0x110]
add ecx, 4
call fcn.004152c0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b774
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
cmp dword [0x53e6bc], 0
jne 0x40b81f
mov dword [0x53e6bc], 1
push 0x4c2400
mov eax, dword [ebp - 0x24]
push eax
call fcn.0040ba78
add esp, 8
mov ecx, dword [ebp - 0x24]
push ecx
push 0
push 0x40b69c
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b80e
push 0xa
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40b80e
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40b7ff
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x1c], 0x519
jne 0x40b80c
xor eax, eax
jmp 0x40b824
jmp 0x40b7c2
push 0x53e6c8
mov eax, dword [ebp - 0x24]
push eax
call fcn.0040ba78
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41126c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x138], ecx
mov dword [ebp - 8], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41130c
mov dword [ebp - 0x134], 0x128
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x138]
cmp dword [edx + 0x434], 0
jne 0x411302
cmp dword [ebp - 0xc], 0
je 0x411302
mov eax, dword [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x138]
call fcn.0040c915
cmp eax, 0xffffffff
jne 0x4112ed
mov dword [ebp - 8], 0xffffffff
jmp 0x411302
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0xc], eax
jmp 0x4112b1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x414451
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ade50
push 0x4a7764
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffa90
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x580], ecx
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Tasks_
push 0x104
lea ecx, [ebp - 0x120]
push ecx
call fcn.00407f00
lea edx, [ebp - 0x120]
push edx
call sub.ntdll.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x120]
mov dword [ebp - 0x1c], eax
push str..job
push 0x104
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00409000
lea edx, [ebp - 0x268]
push edx
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffff
je 0x4146fa
lea ecx, [ebp - 0x23c]
push ecx
push 0x104
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00409000
mov eax, dword [ebp - 0x268]
and eax, 0x10
test eax, eax
je 0x414545
jmp 0x4146d1
mov dword [ebp - 0x26c], 0
mov dword [ebp - 4], 0
push 0x4c2d74
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jne 0x4145a2
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x128]
add eax, 1
mov dword [ebp - 0x128], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x4146d1
mov byte [ebp - 0x57c], 0
mov ecx, 0xc2
xor eax, eax
lea edi, [ebp - 0x57b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x103
push 0x41
lea ecx, [ebp - 0x478]
push ecx
call fcn.00416780
add esp, 0xc
mov edx, dword [ebp - 0x26c]
push edx
push 0x206
push 1
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 0x270], 0
jmp 0x41460a
mov ecx, dword [ebp - 0x270]
add ecx, 1
mov dword [ebp - 0x270], ecx
cmp dword [ebp - 0x270], 0x103
jge 0x41463c
mov edx, dword [ebp - 0x270]
xor eax, eax
mov ax, word [ebp + edx*2 - 0x478]
test eax, eax
jne 0x41463a
mov ecx, dword [ebp - 0x270]
mov word [ebp + ecx*2 - 0x478], 0x41
jmp 0x4145fb
lea edx, [ebp - 0x120]
push edx
push 0x104
lea eax, [ebp - 0x57c]
push eax
call fcn.00409000
lea ecx, [ebp - 0x57c]
push ecx
mov ecx, dword [ebp - 0x580]
add ecx, 0x5a0
call fcn.00416bb0
mov edx, dword [ebp - 0x26c]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x26c], 0
mov dword [ebp - 4], 0xffffffff
jmp 0x4146c2
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
lea edx, [ebp - 0x268]
push edx
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41451e
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414711
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push edi
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
call fcn.0042fcf0
lea ecx, [ebp - 4]
call fcn.0042fcf0
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x13c]
add ecx, 0x414
call fcn.004172b0
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
jmp 0x414768
push 0
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0xc]
call fcn.00417310
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
add ecx, 0x414
call fcn.00436710
push eax
lea ecx, [ebp - 0xc]
call fcn.00448ed0
and eax, 0xff
test eax, eax
je 0x414982
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0xc]
call fcn.00416c20
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [ebp - 0x130]
push edx
mov ecx, dword [ebp - 0x13c]
add ecx, 0x5a0
call fcn.004172b0
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x4147fd
push 0
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 4]
call fcn.00417310
lea edx, [ebp - 0x138]
push edx
mov ecx, dword [ebp - 0x13c]
add ecx, 0x5a0
call fcn.00436710
push eax
lea ecx, [ebp - 4]
call fcn.00416c40
and eax, 0xff
test eax, eax
je 0x41497d
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0xc]
call fcn.00416c20
add eax, 4
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x41485b
mov dword [ebp - 0x140], 0
jmp 0x4148a9
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
shl eax, 1
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x144], esp
mov ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x144]
push eax
call fcn.00415370
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 4]
call fcn.00416c20
add eax, 0x104
push eax
call fcn.00416810
add esp, 8
test eax, eax
jne 0x41495e
lea edx, [ebp - 0x110]
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x11c], 0
jne 0x4148ef
mov dword [ebp - 0x148], 0
jmp 0x41493d
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
shl eax, 1
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x14c], esp
mov ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call fcn.00415370
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
push ecx
lea ecx, [ebp - 4]
call fcn.00416c20
add eax, 0x104
push eax
call fcn.00416810
add esp, 8
test eax, eax
je 0x414978
lea ecx, [ebp - 4]
call fcn.00416c20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x41497d
jmp 0x4147ec
jmp 0x414757
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
lea esp, [ebp - 0x150]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x417ba0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x417bbe
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jbe 0x417be9
mov edx, dword [ebp - 4]
imul edx, edx, 0x1000193
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 4]
xor edx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x417bb5
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4199d5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 0x414], ecx
push 0
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00401480
push 0x438
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x24
call fcn.004043d0
push str.._superkiller.ini
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4c2f30
push str.learn_detail
push str.360_link
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x419a57
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x414]
add ecx, 0x24
call fcn.00404260
jmp 0x419a6a
push str.http:__baike.360.cn_4005462_20836539.html_recommend1
mov ecx, dword [ebp - 0x414]
add ecx, 0x24
call fcn.00404260
push 0x435
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
mov edx, dword [ebp - 0x414]
mov dword [edx + 0x20], eax
push 1
mov ecx, dword [ebp - 0x414]
add ecx, 0x20
call fcn.004164e0
push 0x418
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.004029a0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x64
push 0
push 0x4c2fbc
push 0
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402b90
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10e
push 0
push 0x4c2fc4
push 1
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402b90
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x5a
push 0
push 0x4c2fcc
push 2
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402b90
push 0
push 0x20
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00402aa0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419c50
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5416c4], eax
cmp dword [0x53e778], 0
je 0x419c92
mov eax, dword [0x53e778]
jmp 0x419db7
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4c38e0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.Newkernel32.dll
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x419cfb
xor eax, eax
jmp 0x419db7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x21c], eax
push 4
push 0
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x21c], 0
jne 0x419d40
xor eax, eax
jmp 0x419db7
push 0x4c3900
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5416c4], eax
cmp dword [0x5416c4], 0
jne 0x419d7d
mov edx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5416c4], edx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x419db7
jmp 0x419da1
mov dword [ebp - 4], 0xffffffff
mov dword [0x53e778], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419e58
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x419ebe
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0xc]
push ecx
push 0x4c391c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 4], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x41a311
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0
jne 0x41a35d
push 0x24
push 0x4c39c0
push 0x4c39c8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jne 0x41a35b
push 5
push 0
push 0
push 0x4c39f4
push 0x4c3a08
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x41a3dc
jmp 0x41a3da
cmp dword [ebp + 0xc], 1
jne 0x41a37b
push 0
push 0x4c3a10
push 0x4c3a18
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41a3da
cmp dword [ebp + 0xc], 2
jne 0x41a399
push 0
push 0x4c3a4c
push 0x4c3a54
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41a3da
cmp dword [ebp + 0xc], 3
jne 0x41a3da
push 0x24
push 0x4c3a8c
push 0x4c3a94
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jne 0x41a3da
push 5
push 0
push 0
push 0x4c3ad4
push 0x4c3ae8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x41a3dc
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41a3e9
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x41a3e0
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x41a3e0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
pop ebp
ret

Function at 0x41ae36
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
call fcn.0041add4
test eax, eax
je 0x41ae4d
jmp 0x41af49
cmp dword [ebp + 0x10], 0
jne 0x41af2f
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x208]
push edx
push str.__s___s
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a150
add esp, 0x14
mov dword [ebp - 0x314], 0x104
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4c3c04
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442d8a
test eax, eax
jne 0x41aefa
cmp dword [ebp - 0x314], 0
jbe 0x41aefa
cmp dword [ebp - 0x20c], 1
jne 0x41aefa
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.00402980
add esp, 8
test eax, eax
jne 0x41aefa
jmp 0x41af49
lea ecx, [ebp - 0x104]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x104]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
push 0x4c3c38
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442f8d
jmp 0x41af49
mov ecx, dword [ebp + 8]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.004430fd
mov esp, ebp
pop ebp
ret
Function at 0x41b3a6
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 4], 1
push 0
push 0x26
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x41b3fb
push str.360safe360safe.exe
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00407f00
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41b3fb
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x41b432
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.0041ad62
add esp, 8
test eax, eax
jne 0x41b41d
xor eax, eax
jmp 0x41b465
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x41b432
xor eax, eax
jmp 0x41b465
call fcn.0041b469
test eax, eax
jne 0x41b442
mov eax, 1
jmp 0x41b465
call fcn.0041b29e
test eax, eax
jne 0x41b452
mov eax, 2
jmp 0x41b465
call fcn.0041b814
test eax, eax
jne 0x41b462
mov eax, 3
jmp 0x41b465
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x41b531
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x4c3ec4
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b586
push 9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp + 8], 0
jbe 0x41b581
push 0x168
mov edx, dword [ebp + 8]
push edx
push 0x52c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41b610
call fcn.0041b4f7
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41b5d9
cmp dword [ebp + 8], 0
jbe 0x41b5d7
push 0x3e8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push str.Q360SafeMainClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b5d7
push 0x168
mov edx, dword [ebp + 8]
push edx
push 0x52c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x41b610
mov dword [ebp - 0xc], 0x4c3eec
push 0x30
push 0x4c3f48
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push 0
push 0
push str.http:__www.360.cn
push 0x4c3f64
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x41b614
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x41b669
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
jmp 0x41b66b
xor eax, eax
mov esp, ebp
pop ebp
ret