joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100124c0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
xor ebp, ebp
mov dword [esp + 8], ebp
call fcn.10047690
test eax, eax
je 0x10012517
push str.NtCreateThreadEx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001253e
push ebp
push ebp
push ebp
push ebp
push ebp
push esi
push edi
push ebx
push ebp
push 0x1fffff
lea ecx, [esp + 0x30]
push ecx
call eax
mov eax, dword [esp + 8]
test eax, eax
je 0x1001254d
mov ebp, 1
jmp 0x10012542
lea edx, [esp + 0xc]
push edx
push 0
push esi
push edi
push 0
push 0
push ebx
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [esp + 8], eax
test eax, eax
je 0x1001254d
mov ebp, 1
jmp 0x10012542
mov eax, dword [esp + 8]
test eax, eax
je 0x1001254d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10013000
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push esi
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.1004f670
mov eax, dword [esp + 0xc]
add esp, 4
push 0
push 0
push eax
push 0x10012e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x10013044
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x10013ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10013afd
pop edi
pop ebp
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10013b34
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10013b30
lea ebx, [ebx]
cmp esi, eax
jae 0x10013b34
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10013b20
cmp esi, eax
jb 0x10013b3b
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x10013d60
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10013db3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10079a05
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x10013e3b
cmp dword [esp + 0xc], 0x40
jne 0x10013e3b
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x10013e3b
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x144]
jne 0x10013e3b
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x10013e3b
cmp dword [esp + 0xc], 0xf8
jne 0x10013e3b
cmp dword [esp + 0x10], 0x4550
jne 0x10013e3b
cmp word [esp + 0x16], bx
je 0x10013e3b
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10079a05
mov esp, ebp
pop ebp
ret

Function at 0x10013f20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10097a60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call fcn.10013ce0
test eax, eax
je 0x10013f6f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 8], 0
je 0x10013f80
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10013f56
cmp dword [ebp + 0xc], 0
je 0x10013f98
push esi
call fcn.10013d60
add esp, 4
test eax, eax
sete al
test al, al
jne 0x10013f56
mov dword [ebp - 4], 0
push esi
xor esi, esi
call fcn.10013ed0
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10015d90
Capabilities:
Enumerate services

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, eax
mov dword [esp + 0xc], ebx
cmp ebp, ebx
je 0x10015e54
cmp edi, ebx
je 0x10015e54
push esi
push 4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebx
je 0x10015e4c
push ebx
push edi
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push 1
push 0x3b
mov dword [esp + 0x34], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
push esi
call ebx
test eax, eax
jne 0x10015df0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x10015e39
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10015e39
push eax
call fcn.100799bf
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x10015e39
mov ecx, dword [esp + 0x18]
push ecx
push 0
push eax
call fcn.1007dcf0
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp]
add esp, 0xc
push 0
push edi
lea edx, [esp + 0x20]
push edx
push eax
push ecx
push 1
push 0x3b
push esi
call ebx
mov edi, 1
test eax, eax
jne 0x10015e3d
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
pop edi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10017180
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10093fb1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
push 0xffffffffffffffff
mov dword [esp + 0x10], ebx
xor eax, eax
push ebx
mov word [esp + 0x1c], ax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
call fcn.10013690
mov dword [esp + 0x34], 1
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100171e0
sub eax, edx
sar eax, 1
push eax
push edi
lea eax, [esp + 0x18]
call fcn.10017390
push 0xffffffffffffffff
push ebx
xor edx, edx
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov eax, esi
mov word [esi + 4], dx
call fcn.10013690
mov dword [esp + 0xc], 1
mov byte [esp + 0x34], bl
cmp dword [esp + 0x28], 8
jb 0x10017235
mov eax, dword [esp + 0x14]
push eax
call fcn.100799fa
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x10018640
Capabilities:
Check for peb beingdebugged flag
Check if file exists
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10097726
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x1009f438
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
sub esp, 0x1c
mov esi, esp
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
lea eax, [esp + 0x34]
mov word [esi + 4], dx
mov dword [esp + 0x30], esp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100186c0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x38]
push eax
call fcn.10013510
mov dword [esp + 0x248], 0
sub esp, 0x1c
mov esi, esp
xor ecx, ecx
mov eax, str.http:__dl.360safe.com_gf_extdll.cab
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [esp + 0x48], esp
mov word [esi + 4], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10018710
sub eax, edx
sar eax, 1
push eax
push str.http:__dl.360safe.com_gf_extdll.cab
call fcn.10013510
mov byte [esp + 0x264], 1
mov dword [esp + 0x264], 0xffffffff
call fcn.10036a10
add esp, 0x3c
test eax, eax
je 0x100187b5
push 0x100dddf0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10018774
push 0x100dddf0
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x10018774
cmp eax, 0x50
je 0x10018774
cmp eax, 0xb7
jne 0x100187b5
push 0x100dddf0
push 0x1002d5d0
push 0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x100187b5
push 0x100ddff8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100187b5
mov ecx, 0x100ddff8
call fcn.1002e300
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10079a05
add esp, 0x224
ret
Function at 0x10018cc0
Capabilities:
Check if file exists
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x10093ec9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov ecx, 0x100ddff8
mov dword [esp + 0x20], ebx
call fcn.10013050
mov ebp, 1
mov dword [esp + 0x40], ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.0.0.0.0
call fcn.10013050
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
jle 0x10018e0e
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10018e0e
lea edx, [esp + 0x30]
push edx
push 0x100ddff8
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jne 0x10018d62
mov esi, dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
push esi
call fcn.10013410
jmp 0x10018e1d
lea ecx, [edi + 1]
push ecx
call fcn.100799bf
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebx
jne 0x10018d82
lea edx, [esp + 0x14]
push edx
jmp 0x10018e13
push esi
push edi
push ebx
push 0x100ddff8
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10018d9e
push esi
call fcn.10079d09
add esp, 4
jmp 0x10018e0e
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x1009f590
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10018d93
mov eax, dword [esp + 0x20]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov eax, dword [esp + 0x24]
movzx ecx, si
movzx edx, di
mov ebp, esi
mov ebx, edi
push eax
shr ebp, 0x10
mov dword [esp + 0x30], ecx
shr ebx, 0x10
mov dword [esp + 0x2c], edx
call fcn.10079d09
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x50]
push ecx
push ebx
push edx
mov dword [eax + 4], edi
push ebp
push str._d._d._d._d
lea edi, [esp + 0x2c]
mov dword [eax], esi
call fcn.1001b8b0
add esp, 0x18
mov ebp, 1
lea eax, [esp + 0x14]
push eax
mov esi, dword [esp + 0x4c]
push esi
call fcn.10013410
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x14]
call fcn.10013100
mov byte [esp + 0x40], 0
lea ecx, [esp + 0x18]
call fcn.10013100
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x1001c190
Capabilities:
Check if file exists

Disassembly:
test byte [esp + 8], 4
je 0x1001c19d
mov eax, 1
ret
push 0x100db7cc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [esp + 4]
push eax
lea ecx, [esp + 0xc]
push str.safeinstall.info
push ecx
mov edx, str.safeinstall
mov ecx, str.si:1
mov dword [esp + 0x14], 0
call fcn.1001bd70
add esp, 0xc
push 0x100db7cc
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push str.C:_need360safe00000000000000000000000000000000000000000000.exe
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, 1
jne 0x1001c1f4
mov eax, dword [esp + 8]
ret

Function at 0x1001d910
Capabilities:
Check for peb beingdebugged flag
Encode data using base64 via winapi

Disassembly:
push 0xffffffffffffffff
push 0x10093dc9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov dword [esp + 0x1c], 0
mov esi, 1
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
mov ebx, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea edx, [esp + 0x18]
push edx
push 0
push ebp
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call ebx
test eax, eax
je 0x1001da1c
cmp dword [esp + 0x18], 0
je 0x1001da1c
lea edx, [esp + 0x14]
push edx
call fcn.1001a210
mov byte [esp + 0x28], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 8]
mov ecx, dword [esp + 0x18]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x1001d9b5
lea eax, [esp + 0x14]
call fcn.1006d450
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push ebp
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call ebx
lea esi, [esp + 0x14]
test eax, eax
jne 0x1001d9f4
call fcn.1001e2b0
push edi
call fcn.1001a210
mov dword [esp + 0x1c], 1
mov byte [esp + 0x28], 1
mov ecx, esi
call fcn.10013100
jmp 0x1001da26
call fcn.1001e2b0
lea edx, [esp + 0x14]
push edx
push edi
call fcn.10013410
mov dword [esp + 0x1c], 1
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x14]
call fcn.10013100
jmp 0x1001da26
push edi
call fcn.1001a210
mov dword [esp + 0x1c], esi
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x34]
call fcn.10013100
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1001fb20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100954da
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push str.C:_need360safe00000000000000000000000000000000000000000000.exe
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001fb70
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
call fcn.1001fa90
add esp, 4
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], 0
je 0x1001fcaa
lea edx, [esp + 0x1c]
push edx
call fcn.1001d080
mov byte [esp + 0x40], 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x1009f430
call fcn.10013050
mov byte [esp + 0x40], 2
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x1009f434
call fcn.10013050
mov byte [esp + 0x40], 3
lea edx, [esp + 0xc]
push edx
mov ecx, 0x1009ed34
call fcn.10013050
mov byte [esp + 0x40], 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.1001d320
mov byte [esp + 0x40], 3
lea ecx, [esp + 0xc]
call fcn.10013100
mov byte [esp + 0x40], 2
lea ecx, [esp + 0x14]
call fcn.10013100
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x18]
call fcn.10013100
lea edx, [esp + 0x18]
push edx
call fcn.1001a210
mov byte [esp + 0x40], 5
lea eax, [esp + 0xc]
push eax
call fcn.1001a210
mov byte [esp + 0x40], 6
cmp dword [esp + 0x24], 0
jbe 0x1001fc66
mov eax, dword [esp + 0x20]
lea edi, [esp + 0x18]
mov esi, eax
call fcn.1006cca0
lea eax, [esi + 4]
lea edi, [esp + 0xc]
call fcn.1006cca0
mov ecx, dword [esp + 0xc]
push 0xa
push 0
push ecx
call fcn.1007a629
xor edx, edx
add esp, 0xc
cmp edx, eax
sbb esi, esi
neg esi
mov byte [esp + 0x40], 5
lea ecx, [esp + 0xc]
call fcn.10013100
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x18]
call fcn.10013100
mov byte [esp + 0x40], 0
lea eax, [esp + 0x1c]
push eax
call fcn.100185d0
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10013100
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10022690
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub eax, 0
je 0x10022735
sub eax, 1
jne 0x1002274a
push esi
call fcn.10003250
call fcn.100031d0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x104
push 0x100db920
push 0
call esi
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
push 0x104
push 0x100db818
push 0
call esi
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov eax, dword [esp + 8]
push eax
call fcn.10021d20
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x1001ff50
push 0
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
test eax, eax
je 0x10022718
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1004ffc0
push 0x100500d0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [0x100dee40], eax
mov eax, 1
ret 0xc
push 0xbb8
mov dword [0x100db798], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
ret 0xc
Function at 0x10023540
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.1007dcf0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 8]
push eax
push str.Common_Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push connect
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10023616
test esi, esi
je 0x100235fc
push edi
lea edi, [esp + 0xc]
mov edx, 0x104
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x100235ef
movzx ecx, word [edi + eax]
test cx, cx
je 0x100235ef
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100235b2
sub eax, 2
mov word [eax], dx
pop edi
lea eax, [edx + 1]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10079a05
add esp, 0x214
ret
test edx, edx
jne 0x100235f6
sub eax, 2
xor edx, edx
mov word [eax], dx
pop edi
mov eax, 1
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10079a05
add esp, 0x214
ret
mov ecx, dword [esp + 0x210]
xor ecx, esp
xor eax, eax
call fcn.10079a05
add esp, 0x214
ret

Function at 0x10023630
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x1009973c
push 1
push 0
push 0x1009974c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10023695
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x1009976c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jge 0x1002369d
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
test esi, esi
je 0x100236ae
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test ebx, ebx
je 0x100236bf
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push ebx
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 4
push eax
call edx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
test esi, esi
pop esi
setge al
pop ebx
add esp, 8
ret
Function at 0x10023710
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x61c
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
mov ebx, dword [esp + 0x624]
push esi
push 0x208
lea eax, [esp + 0x41c]
push 0
push eax
call fcn.1007dcf0
push 0x208
lea ecx, [esp + 0x220]
push 0
push ecx
call fcn.1007dcf0
add esp, 0x18
lea esi, [esp + 0x418]
call fcn.10023540
test eax, eax
je 0x100237e0
push str.360safeEmFixer.lnk
mov edx, esi
push edx
lea eax, [esp + 0x218]
push str._s_s
push eax
mov ecx, 0x104
call fcn.10018220
add esp, 0x10
test eax, eax
jne 0x100237e0
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100237e0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x12]
push eax
mov word [esp + 0x14], dx
call fcn.1007dcf0
add esp, 0xc
cmp dword [esp + 0x62c], 0
push ebx
jne 0x100237f9
lea ecx, [esp + 0xc]
push str._fix__fixid_d
push ecx
mov ecx, 0x104
call fcn.10018220
add esp, 0xc
test eax, eax
jge 0x10023814
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x618]
xor ecx, esp
call fcn.10079a05
add esp, 0x61c
ret
lea edx, [esp + 0xc]
push str._fix__hidetray__fixid_d
push edx
mov ecx, 0x104
call fcn.10018220
add esp, 0xc
test eax, eax
jl 0x100237e0
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0xc]
push ecx
mov eax, edi
call fcn.10023630
mov ecx, dword [esp + 0x628]
add esp, 8
pop esi
pop ebx
xor ecx, esp
call fcn.10079a05
add esp, 0x61c
ret

Function at 0x10023850
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARE360Safe_stat
push connect
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023895
xor eax, eax
add esp, 0x10
ret
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.ManExit
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1002388f
xor eax, eax
cmp dword [esp + 4], 1
sete al
add esp, 0x10
ret

Function at 0x100238e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARE360Safe_safemon
push connect
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023925
xor eax, eax
add esp, 0x10
ret
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.DisableAutorun
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1002391f
xor eax, eax
cmp dword [esp + 4], 1
sete al
add esp, 0x10
ret