joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462c40
Capabilities:
Resume thread

Disassembly:
cmp dword [ebx], 0
je 0x462c8f
push edi
xor edi, edi
cmp dword [ebx + 8], edi
jbe 0x462c7d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
push esi
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call ebp
mov esi, eax
test esi, esi
je 0x462c75
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebx + 8]
jb 0x462c55
pop esi
pop ebp
mov edx, dword [ebx]
mov eax, dword [0x4e8818]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret

Function at 0x462c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
mov ecx, dword [0x4eb670]
push ebx
push ebp
push esi
lea eax, [eax + eax*4]
test byte [ecx + eax*8 + 0x14], 1
lea esi, [ecx + eax*8]
push edi
mov edi, dword [esi]
mov ebp, 5
je 0x462cb6
sub edi, ebp
mov ebp, 7
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x10]
push edx
push 0x40
push ebp
push edi
call ebx
test eax, eax
jne 0x462cd6
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret
cmp dword [esp + 0x18], 0
je 0x462cfc
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x462d1d
mov eax, dword [esi]
mov byte [eax], 0xeb
mov byte [eax + 1], 0xf9
jmp 0x462d1d
mov ecx, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], ecx
je 0x462d17
mov dx, word [esi + 0x10]
mov word [edi + 4], dx
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x462d1d
mov dl, byte [esi + 0x10]
mov byte [edi + 4], dl
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push ecx
push ebp
push edi
call ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x14]
and eax, 1
mov edx, eax
and edx, 0xfffffffd
add eax, eax
or edx, eax
add edx, edx
and ecx, 0xfffffff9
or edx, ecx
pop edi
mov dword [esi + 0x14], edx
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x462f50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x30
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
call fcn.00462e20
cmp dword [0x4e8818], 0
je 0x4630ef
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
mov ebx, 0x1000
cmp dword [esp + 0x28], ebx
jne 0x4630e5
test byte [esp + 0x2c], 0xf0
je 0x4630e5
push 0x1c
lea edx, [esp + 0x1c]
push edx
push ebp
call edi
cmp dword [esp + 0x28], ebx
jne 0x4630e5
test byte [esp + 0x2c], 0xf0
je 0x4630e5
call fcn.004628b0
cmp eax, 0xffffffff
jne 0x4630db
call fcn.004627a0
test eax, eax
je 0x4630d1
mov edi, dword [eax + 4]
mov ecx, dword [edi]
inc dword [eax + 8]
lea edx, [esp + 0x18]
push edx
mov dword [eax + 4], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edi
call fcn.00463210
add esp, 4
test eax, eax
je 0x4630c0
call fcn.004628e0
test eax, eax
je 0x4630af
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
and edi, 0xf
add edi, edi
add edi, edi
add edi, edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov ebx, ecx
and ebx, 1
or edi, ebx
mov ebx, dword [eax + 0x14]
and ebx, 0xffffff80
or edi, ebx
mov dword [eax + 0x14], edi
mov edi, dword [esp + 0x2c]
mov dword [eax + 0x18], edi
mov edi, dword [esp + 0x30]
mov dword [eax + 0x1c], edi
mov edi, dword [esp + 0x34]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x20], edi
mov edi, dword [esp + 0x38]
mov dword [eax + 8], edx
mov dword [eax + 0x24], edi
test ecx, ecx
je 0x463098
lea ecx, [esi - 5]
mov esi, dword [ecx]
add eax, 0xc
mov dword [eax], esi
mov si, word [ecx + 4]
mov word [eax + 4], si
mov cl, byte [ecx + 6]
mov byte [eax + 6], cl
jmp 0x4630a3
mov ecx, dword [esi]
mov dword [eax + 0xc], ecx
mov cl, byte [esi + 4]
mov byte [eax + 0x10], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4630f7
mov dword [eax], edx
jmp 0x4630f7
mov esi, edi
mov dword [esp + 0x10], 9
call fcn.00462810
jmp 0x4630f7
mov esi, edi
mov dword [esp + 0x10], 8
call fcn.00462810
jmp 0x4630f7
mov dword [esp + 0x10], 9
jmp 0x4630f7
mov dword [esp + 0x10], 3
jmp 0x4630f7
mov dword [esp + 0x10], 7
jmp 0x4630f7
mov dword [esp + 0x10], 2
push 0
push 0x4e8814
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049021b
add esp, 0x30
ret 8
Function at 0x463dc0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4b4398
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
lea eax, [esp + 4]
push str.datapurify_ignore.dat
push eax
call fcn.0047b34a
add esp, 8
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463e13
mov ecx, dword [esp + 0x18]
call fcn.00463f40
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x463e3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret 4
Function at 0x467300
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b148a
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, esi
call fcn.00407400
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esp + 0x14], edi
lea eax, [esi + 0x50]
mov dword [esi], vtable.CTrustDlg.0
mov dword [esi + 0x2c], vtable.CTrustDlg.1.0
push eax
mov dword [esi + 0x4c], vtable.CAtlAdviser.0
call fcn.00443a00
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
lea ecx, [esi + 0x84]
push ecx
mov byte [esp + 0x18], 7
call fcn.00443a00
call fcn.004675d0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x4685c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b140d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, esi
call fcn.00407400
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esp + 0x14], edi
lea eax, [esi + 0x50]
mov dword [esi], vtable.CRecoveryDlg.0
mov dword [esi + 0x2c], vtable.CRecoveryDlg.1.0
push eax
mov dword [esi + 0x4c], vtable.CAtlAdviser.0
call fcn.00443a00
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov byte [esp + 0x14], 6
lea ecx, [esi + 0x98]
push ecx
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
call fcn.00443a00
call fcn.004688a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x46a7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b2aa8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x10]
xor edi, edi
push eax
mov ecx, 0x4c4788
mov dword [esp + 0x1c], edi
call fcn.00405a20
xor ecx, ecx
mov dword [esp + 0x24], edi
mov eax, 0x800
mov dword [esp + 0x14], eax
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x18], 1
neg ecx
or ecx, eax
push ecx
call fcn.0048f6ad
mov esi, eax
add esp, 4
cmp esi, edi
je 0x46a899
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
push ecx
push edi
push esi
call fcn.00494b20
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x20]
push eax
push 0x4c7398
push str.SOFTWARE360Safe_stat
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, esi
lea edi, [esp + 0x10]
call fcn.004059e0
push esi
call fcn.00490de7
add esp, 4
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.0040bbd0
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46a8d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret
Function at 0x46aa00
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4b70d0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x74], eax
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
test byte [0x4ea4d0], 1
jne 0x46aa66
mov eax, dword [0x4e7464]
mov edx, dword [eax + 0xc]
or dword [0x4ea4d0], 1
mov ecx, 0x4e7464
call edx
add eax, 0x10
push 0x4bf3b0
mov dword [0x4ea4cc], eax
call fcn.00490884
add esp, 4
mov eax, dword [0x4ea4cc]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x46ab82
xor ecx, ecx
push 0x62
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.00494b20
add esp, 0xc
lea eax, [esp + 0x10]
push 0x4cbb34
push eax
call fcn.0047b079
add esp, 8
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x10]
mov edi, eax
test eax, eax
je 0x46ab5b
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46ab57
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0047ea6b
add esp, 4
test eax, eax
jne 0x46aae3
call fcn.0040cff0
test eax, eax
je 0x46ab57
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x46ab57
mov dword [esp + 0xc], 0
push str.CreateObject
push eax
mov byte [esp + 0x90], 1
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xc]
push ecx
push 0x4cbb78
call eax
test eax, eax
mov eax, dword [esp + 0xc]
jl 0x46ab43
test eax, eax
je 0x46ab43
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x32
lea ecx, [esp + 0x18]
push ecx
push eax
call edx
lea edx, [esp + 0x14]
mov edi, 0x4ea4cc
call fcn.004059e0
mov eax, dword [esp + 0xc]
mov byte [esp + 0x88], 0
test eax, eax
je 0x46ab57
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x88], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ab82
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x4ea4cc
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0049021b
add esp, 0x84
ret
Function at 0x46abc0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4b70d0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x74], eax
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
test byte [0x4ea4c8], 1
jne 0x46ac26
mov eax, dword [0x4e7464]
mov edx, dword [eax + 0xc]
or dword [0x4ea4c8], 1
mov ecx, 0x4e7464
call edx
add eax, 0x10
push 0x4bf3e0
mov dword [0x4ea4c4], eax
call fcn.00490884
add esp, 4
mov eax, dword [0x4ea4c4]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x46ad42
xor ecx, ecx
push 0x62
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.00494b20
add esp, 0xc
lea eax, [esp + 0x10]
push 0x4cbb34
push eax
call fcn.0047b079
add esp, 8
mov dword [esp + 0x88], 0
mov eax, dword [esp + 0x10]
mov edi, eax
test eax, eax
je 0x46ad1b
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46ad17
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0047ea6b
add esp, 4
test eax, eax
jne 0x46aca3
call fcn.0040cff0
test eax, eax
je 0x46ad17
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x46ad17
mov dword [esp + 0xc], 0
push str.CreateObject
push eax
mov byte [esp + 0x90], 1
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xc]
push ecx
push 0x4cbb88
call eax
test eax, eax
mov eax, dword [esp + 0xc]
jl 0x46ad03
test eax, eax
je 0x46ad03
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x32
lea ecx, [esp + 0x18]
push ecx
push eax
call edx
lea edx, [esp + 0x14]
mov edi, 0x4ea4c4
call fcn.004059e0
mov eax, dword [esp + 0xc]
mov byte [esp + 0x88], 0
test eax, eax
je 0x46ad17
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x88], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ad42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x4ea4c4
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0049021b
add esp, 0x84
ret
Function at 0x46c410
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.0046c3b0
xor ebx, ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], ebx
cmp edi, ebx
jne 0x46c432
mov dword [esi + 0x10], ebx
jmp 0x46c435
mov dword [esi + 0x10], edi
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x46c44b
cmp dword [esi], ebx
je 0x46c44b
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], ebx
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
xor ecx, ecx
cmp dword [esi], ebx
push edx
mov edx, dword [esi + 0x14]
setne cl
push eax
lea ecx, [ecx + ecx + 2]
mov edi, ecx
mov cl, 0x20
call fcn.004ab7d0
push eax
push edi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x46c49a
mov ecx, dword [esi]
neg ecx
push ebx
sbb ecx, ecx
push ebx
and ecx, 0xf001b
push ebx
add ecx, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
cmp dword [esi + 0xc], ebx
jne 0x46c4a4
call fcn.0046c3b0
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4725d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x838
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x834], eax
mov eax, dword [esi + 0x28]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
test eax, eax
jne 0x4726c6
push 0x2c
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00494b20
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x4e]
push eax
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x34], 0x400000
mov word [esp + 0x50], dx
call fcn.00494b20
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Q360SoftMgrMsgDelegateWnd_d
mov ecx, 0x400
lea ebx, [esp + 0x40]
call fcn.0044c640
add esp, 8
lea edx, [esp + 8]
mov ecx, ebx
push edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x14], 0x44c5f0
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
push 0
push eax
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x28], eax
call edi
test eax, eax
je 0x4726df
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x28]
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x4726ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi + 0x28]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop edi
pop ebx
mov ecx, dword [esp + 0x834]
xor ecx, esp
call fcn.0049021b
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x83c]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0049021b
mov esp, ebp
pop ebp
ret
Function at 0x47b754
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4e1370]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00494b20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x47b7ad
push str.rundll32.exe
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea ecx, [ebp - 0x7c]
call fcn.00405a20
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.0049021b
add ebp, 0x190
leave
ret

Function at 0x47b7cd
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4e1370]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00494b20
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.360SafeSoftMgrEDRPlugin_freesaas_black.list
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea ecx, [ebp - 0x7c]
call fcn.00405a20
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.0049021b
add ebp, 0x190
leave
ret

Function at 0x47b86c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
mov dword [ebx], edi
mov dword [esi], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x47b91a
mov dword [ebp - 0x14], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x47b915
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
add eax, 8
push 0x4e74e0
push eax
call fcn.00490c93
xor edi, edi
pop ecx
pop ecx
mov dword [ebx], eax
cmp eax, edi
jne 0x47b8e3
mov dword [esi], edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x47b91c
mov ecx, dword [esi]
add ecx, 8
push ecx
push edi
push eax
call fcn.00494b20
add esp, 0xc
push edi
lea eax, [ebp - 8]
push eax
push dword [esi]
mov dword [ebp - 8], edi
push dword [ebx]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 8]
xor eax, eax
cmp ecx, dword [esi]
sete al
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
jmp 0x47b8d6
xor eax, eax
pop edi
leave
ret
Function at 0x47b91f
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
push 0xc
mov eax, 0x4afb89
call fcn.0049524d
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x47b9f1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x47b9f1
cmp dword [ebp + 0xc], ebx
je 0x47b9f1
lea ecx, [ebp - 0x10]
call fcn.004054e0
push dword [ebp + 8]
lea edi, [ebp - 0x10]
push str._s.write_cache
mov dword [ebp - 4], ebx
call fcn.00404aa0
pop ecx
pop ecx
push ebx
mov esi, 0x80
push esi
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47b9e4
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x18], ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ebp - 0x18], ecx
push edi
sete al
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x47b9e4
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call fcn.00406090
mov eax, dword [ebp - 0x14]
jmp 0x47b9f3
xor eax, eax
call fcn.00495325
ret

Function at 0x47cf05
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x4b5a4e
call fcn.0049524d
test edi, edi
jne 0x47cf19
xor eax, eax
jmp 0x47cf68
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47cf15
lea eax, [ebp - 0x10]
push str.360Base.dll
push eax
call fcn.0047b079
and dword [ebp - 4], 0
push dword [eax]
call fcn.0040d1a0
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00406090
test esi, esi
je 0x47cf61
push edi
push 0x4e4548
xor esi, esi
call fcn.0047ebaa
jmp 0x47cf68
mov eax, edi
call fcn.00487ec0
call fcn.00495325
ret
Function at 0x47d1f2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax]
push ebx
mov ebx, dword [ecx]
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax]
lea esi, [ebp - 0x14]
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
call fcn.00470600
test al, al
jne 0x47d2b5
mov edi, dword [ebp - 0xc]
test edi, edi
jne 0x47d27d
call fcn.00490387
xor eax, eax
cmp ebx, dword [eax + 0x18]
jne 0x47d244
call fcn.00490387
push dword [ebx + 0xc]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x47d267
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x47d270
call fcn.00490387
cmp byte [ebx + 0x11], 0
je 0x47d281
call fcn.00490387
jmp 0x47d20b
mov eax, dword [edi]
jmp 0x47d23a
mov eax, dword [ebx + 8]
cmp byte [eax + 0x11], 0
jne 0x47d299
mov ebx, eax
mov eax, dword [ebx]
cmp byte [eax + 0x11], 0
je 0x47d28a
jmp 0x47d208
mov eax, dword [ebx + 4]
jmp 0x47d2a8
cmp ebx, dword [eax + 8]
jne 0x47d2ae
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x11], 0
je 0x47d29e
mov ebx, eax
jmp 0x47d208
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47d2ba
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4e1370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax - 0xc], ebx
jne 0x47d2de
xor eax, eax
jmp 0x47d37d
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
je 0x47d2d7
push 0x228
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.00494b20
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47d368
mov eax, edi
call fcn.00431db0
push esi
lea ecx, [ebp - 0x214]
call fcn.0042c350
test eax, eax
jne 0x47d352
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
mov ebx, edi
call fcn.00431410
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47d32d
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, dword [edi + 0x1c]
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0049021b
leave
ret