joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100041a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push edi
or edi, 0x12578
xor edi, 0x14f4b
xor edi, 0xb111
adc dword [ecx + 0x565f0000], esi
push ebx
add esp, 4
sub esi, 0x50d8
pop esi
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x310], ecx
push eax
or eax, 0x15e76
xor eax, 0x9d63
xor eax, 0x124d5
pop eax
push edx
xor edx, 0x55cc
add edx, 0xc5bb
call 0x100041fe
add byte [ebx + 0x36], al
dec edx
dec eax
dec edi
cmp byte [edx - 0x7d], al
les eax, [edx + ebx*2]
mov dword [ebp - 0x76c], 0
invalid
xchg ebp, eax
invalid
cld

Function at 0x100041b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push edi
or edi, 0x12578
xor edi, 0x14f4b
xor edi, 0xb111
adc dword [ecx + 0x565f0000], esi
push ebx
add esp, 4
sub esi, 0x50d8
pop esi
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x310], ecx
push eax
or eax, 0x15e76
xor eax, 0x9d63
xor eax, 0x124d5
pop eax
push edx
xor edx, 0x55cc
add edx, 0xc5bb
call 0x100041fe
add byte [ebx + 0x36], al
dec edx
dec eax
dec edi
cmp byte [edx - 0x7d], al
les eax, [edx + ebx*2]
mov dword [ebp - 0x76c], 0
invalid
xchg ebp, eax
invalid
cld

Function at 0x100041fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push edi
or edi, 0x12578
xor edi, 0x14f4b
xor edi, 0xb111
adc dword [ecx + 0x565f0000], esi
push ebx
add esp, 4
sub esi, 0x50d8
pop esi
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x310], ecx
push eax
or eax, 0x15e76
xor eax, 0x9d63
xor eax, 0x124d5
pop eax
push edx
xor edx, 0x55cc
add edx, 0xc5bb
call 0x100041fe
add byte [ebx + 0x36], al
dec edx
dec eax
dec edi
cmp byte [edx - 0x7d], al
les eax, [edx + ebx*2]
mov dword [ebp - 0x76c], 0
invalid
xchg ebp, eax
invalid
cld

Function at 0x1001d770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push 0x1021b270
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001d7fd
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001d7d6
sub eax, edx
sar eax, 1
je 0x1001d7f8
cmp word [esi + eax*2 - 2], 0x5c
je 0x1001d7f8
mov ecx, 0x5c
mov word [esi + eax*2], cx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001e440
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x1001e4e5
mov edx, esi
lea ecx, [edx + 2]
jmp 0x1001e470
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001e470
sub edx, ecx
sar edx, 1
je 0x1001e4e5
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001e4b7
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001e4b0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001e490
jmp 0x1001e4b4
test edx, edx
jne 0x1001e4b7
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
push 2
push 1
push ebx
call fcn.1001f7b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1001e4bc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001e520
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x210], eax
push edi
mov edi, ecx
test esi, esi
jne 0x1001e580
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1001e5bc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001e5b7
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001e5b0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001e590
jmp 0x1001e5b4
test edx, edx
jne 0x1001e5b7
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push dword [ebp - 0x210]
lea eax, [ebp - 0x208]
mov ecx, edi
push dword [ebp + 0x10]
push eax
push 1
push ebx
call fcn.1001f580
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001ecd0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xa10], ecx
mov ecx, edi
push eax
call fcn.1001f4b0
mov ebx, eax
test ebx, ebx
je 0x1001ee07
push 0x202
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.102134e7
push 0x800
lea eax, [ebp - 0xa08]
push 0
push eax
call fcn.102134e7
mov esi, dword [ebp + 0x10]
add esp, 0x18
test esi, esi
je 0x1001ed96
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x1001ed40
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ed40
sub ecx, edx
sar ecx, 1
je 0x1001ed96
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001ed8f
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001ed88
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001ed60
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001edb8
test edx, edx
jne 0x1001ed8f
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001edb8
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa0c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1001ee07
push dword [ebp - 0xa10]
lea eax, [ebp - 0xa08]
push ebx
push 0x1021b408
push 0x400
push eax
call fcn.1000bd10
add esp, 0x14
lea eax, [ebp - 0x208]
mov ecx, edi
push dword [ebp + 0x14]
push eax
push 3
push 4
lea eax, [ebp - 0xa08]
push eax
call fcn.1001f7b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001f2c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xa10], ecx
mov ecx, edi
push eax
call fcn.1001f4b0
mov ebx, eax
test ebx, ebx
je 0x1001f3f2
push 0x202
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.102134e7
push 0x800
lea eax, [ebp - 0xa08]
push 0
push eax
call fcn.102134e7
mov esi, dword [ebp + 0x10]
add esp, 0x18
test esi, esi
je 0x1001f386
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x1001f330
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f330
sub ecx, edx
sar ecx, 1
je 0x1001f386
lea ecx, [ebp - 0x208]
mov edx, 0x101
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefd]
test eax, eax
je 0x1001f37f
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001f378
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001f350
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001f3a8
test edx, edx
jne 0x1001f37f
sub ecx, 2
xor eax, eax
mov word [ecx], ax
jmp 0x1001f3a8
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa0c], 0x101
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1001f3f2
push dword [ebp - 0xa10]
lea eax, [ebp - 0xa08]
push ebx
push 0x1021b408
push 0x400
push eax
call fcn.1000bd10
add esp, 0x14
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
push 4
lea eax, [ebp - 0xa08]
push eax
call fcn.1001f920
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001f920
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push 0x208
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call fcn.102134e7
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
xor ebx, ebx
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x1001fb44
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x210]
push esi
mov dword [ebp - 0x210], eax
call fcn.10004a70
test al, al
jne 0x1001f9cd
test esi, esi
jne 0x1001f9ac
xor ecx, ecx
jmp 0x1001f9c0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f9b1
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x210]
call fcn.10004050
mov esi, dword [ebp - 0x210]
push str.TrustedInstaller
push esi
call fcn.102134f3
add esp, 8
test eax, eax
jne 0x1001f9fd
push 0x1b
push str.NT_SERVICETrustedInstaller
lea ecx, [ebp - 0x210]
call fcn.10004050
mov esi, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001fb07
push 1
push str.SeTakeOwnershipPrivilege
push dword [ebp - 0x214]
call fcn.1001f410
add esp, 0xc
test eax, eax
je 0x1001fb07
push 1
push str.SeRestorePrivilege
push dword [ebp - 0x214]
call fcn.1001f410
add esp, 0xc
test eax, eax
je 0x1001fb07
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001fa88
call ebx
cmp eax, 0x7a
jne 0x1001fb00
push edi
push dword [ebp - 0x218]
call fcn.10213535
mov edi, eax
add esp, 4
test edi, edi
je 0x1001fb04
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1001fad6
call ebx
xor ebx, ebx
push edi
call fcn.10213517
add esp, 4
jmp 0x1001fb06
push 0
push 0
push 0
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
test eax, eax
jne 0x1001fac9
push edi
lea ebx, [eax + 1]
call fcn.10213517
add esp, 4
jmp 0x1001fb06
xor ebx, ebx
jmp 0x1001fb07
xor ebx, ebx
pop edi
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x1001fb18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001fb30
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100030c0
int3
Function at 0x10028530
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp byte [edi + 0x210], 0
jne 0x100286db
push esi
push 0
push 0x1a
lea esi, [edi + 8]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100286da
push 0x1021b87c
push 0x104
push esi
call fcn.10028ff0
test esi, esi
je 0x100285c3
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x100285ac
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x100285a1
mov eax, dword [eax + 0x3c]
jmp 0x100285a3
xor eax, eax
test eax, eax
je 0x100285ac
push esi
call eax
jmp 0x100285b3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100285c3
test al, 0x10
jne 0x100285c3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x100285de
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100286da
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.102134e7
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x10e]
push eax
movzx eax, word [ebp - 0x112]
push eax
movzx eax, word [ebp - 0x114]
push eax
push 0x1021b8a0
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.1000bd10
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
push 0x104
push esi
call fcn.10028ff0
test esi, esi
je 0x100286a7
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x1002868e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x10028683
mov eax, dword [eax + 0x3c]
jmp 0x10028685
xor eax, eax
test eax, eax
je 0x1002868e
push esi
call eax
jmp 0x10028695
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100286a7
test al, 0x10
jne 0x100286a7
mov byte [edi + 0x210], 1
jmp 0x100286d3
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100286d3
push eax
mov byte [edi + 0x210], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.100259a0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10212f74
mov esp, ebp
pop ebp
ret
Function at 0x10035520
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.10212f90
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1804]
push 0x1000
push 0
push eax
call fcn.102134e7
add esp, 0xc
lea eax, [ebp - 0x1804]
push 0x1021ce70
push 0x800
push eax
call fcn.10028ff0
push esi
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.10028ff0
push 0x1021ce78
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.10028ff0
push esi
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.10028ff0
push str.vL
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.10028ff0
push dword [ebp + 8]
lea eax, [ebp - 0x1804]
push 0x800
push eax
call fcn.10028ff0
push 0x1021cec8
push 0x800
lea eax, [ebp - 0x1804]
push eax
call fcn.10028ff0
push 0x14
push esi
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
cmp ebx, 6
jne 0x10035706
push edi
push 0xc8
push 0x1021cd80
push str.http:__down.360safe.com_setup.exe
call fcn.10213547
add esp, 0xc
test eax, eax
jne 0x100356ed
push 0x800
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.102134e7
add esp, 0xc
mov dword [ebp - 0x180c], 1
lea eax, [ebp - 0x1808]
mov dword [ebp - 0x1808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x180c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100356e0
push str.360ver.dll
lea eax, [ebp - 0x804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100356e0
lea eax, [ebp - 0x804]
push eax
call fcn.1001d810
add esp, 4
test eax, eax
je 0x100356e0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100356e0
push str.IsBetaVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x100356ed
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x100356f8
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
cmp dword [ebp + 0x10], 0
jne 0x1003571e
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret
push 0
call fcn.102135fb
int3
Function at 0x10037e90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
xor eax, eax
mov dword [ebp - 0x58], 0x44
push esi
push edi
xor edi, edi
mov word [ebp - 0x16], ax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, 5
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], edi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x50], edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], edi
push edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x26], edi
mov dword [ebp - 0x22], edi
mov dword [ebp - 0x1e], edi
mov dword [ebp - 0x1a], edi
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10037f69
mov ecx, dword [ebp + 0x18]
push dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x14]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x10037f92
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.WaitForSingleObject__d
push eax
call fcn.10004de0
mov edx, dword [ebp - 4]
add esp, 0xc
mov edi, 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10037f69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10037f80
push eax
call esi
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10037f8a
push ecx
call esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100030c0
int3
Function at 0x1003b370
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.bapi.dll
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1003b3a9
push 0x104
lea ecx, [edi + 8]
push ecx
push eax
call ebx
cmp word [edi + 8], 0
lea esi, [edi + 8]
jne 0x1003b48d
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10256b30]
call ebx
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call fcn.1020eeb0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0xc
push str...deepscan_
push esi
call ebx
push str.bapi.dll
push esi
call ebx
test esi, esi
je 0x1003b468
mov eax, dword [0x10255438]
test eax, eax
jne 0x1003b423
call fcn.1003be40
mov dword [0x10255438], eax
cmp dword [eax + 0x140], 2
jne 0x1003b458
mov eax, dword [0x10255438]
test eax, eax
jne 0x1003b43f
call fcn.1003be40
mov dword [0x10255438], eax
cmp dword [eax + 0x140], 2
jne 0x1003b44d
mov eax, dword [eax + 0x3c]
jmp 0x1003b44f
xor eax, eax
test eax, eax
je 0x1003b458
push esi
call eax
jmp 0x1003b45f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003b468
test al, 0x10
je 0x1003b48d
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call fcn.1020eeb0
add esp, 0xc
push 0x1024e7f8
push esi
call ebx
push str.bapi.dll
push esi
call ebx
push esi
call fcn.1003be40
mov ecx, eax
call fcn.10036bc0
test eax, eax
je 0x1003b4bb
push str.ExpandFilePathW
push str.bapi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0x210], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret
Function at 0x10043260
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
cmp dword [esi + 0x14], 8
jb 0x10043273
mov edi, dword [esi]
test edi, edi
je 0x100433af
mov eax, dword [0x10255438]
test eax, eax
jne 0x1004328e
call fcn.1003be40
mov dword [0x10255438], eax
cmp dword [eax + 0x140], 2
jne 0x100432c3
mov eax, dword [0x10255438]
test eax, eax
jne 0x100432aa
call fcn.1003be40
mov dword [0x10255438], eax
cmp dword [eax + 0x140], 2
jne 0x100432b8
mov eax, dword [eax + 0x3c]
jmp 0x100432ba
xor eax, eax
test eax, eax
je 0x100432c3
push edi
call eax
jmp 0x100432ca
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100433af
test al, 0x10
jne 0x100433af
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100432e5
mov eax, dword [esi]
push eax
call fcn.1016cf50
add esp, 4
test eax, eax
jne 0x100433af
push ebx
mov bh, byte [ebp + 0xc]
mov bl, byte [ebp + 0x10]
test bh, bh
jne 0x10043305
test bl, bl
je 0x10043323
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1004330f
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call fcn.10036f00
add esp, 4
test al, al
jne 0x1004332c
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1024ea10]
xor eax, eax
mov dword [ebp + 8], eax
test ecx, ecx
je 0x1004339a
lea eax, [ebp + 8]
push eax
push 0x1021c5c8
call ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x1004339a
cmp dword [esi + 0x14], 8
jb 0x10043355
mov esi, dword [esi]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10043397
test bh, bh
je 0x10043379
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jne 0x10043390
test bl, bl
je 0x10043397
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
je 0x10043397
mov eax, dword [ebp + 8]
xor bl, bl
jmp 0x1004339c
mov eax, dword [ebp + 8]
mov bl, 1
test eax, eax
je 0x100433a6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100433c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
cmp dword [esi + 0x14], 8
jb 0x100433d2
mov edi, dword [esi]
test edi, edi
je 0x10043449
mov eax, dword [0x10255438]
test eax, eax
jne 0x100433e9
call fcn.1003be40
mov dword [0x10255438], eax
cmp dword [eax + 0x140], 2
jne 0x1004341e
mov eax, dword [0x10255438]
test eax, eax
jne 0x10043405
call fcn.1003be40
mov dword [0x10255438], eax
cmp dword [eax + 0x140], 2
jne 0x10043413
mov eax, dword [eax + 0x3c]
jmp 0x10043415
xor eax, eax
test eax, eax
je 0x1004341e
push edi
call eax
jmp 0x10043425
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10043449
test al, 0x10
jne 0x10043449
cmp dword [esi + 0x14], 8
jb 0x10043436
mov esi, dword [esi]
push esi
call fcn.1016cf50
add esp, 4
test eax, eax
jne 0x10043449
pop edi
mov al, 1
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret