joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfdcc
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x5eb649
call fcn.00592017
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x84]
call fcn.0040ba44
and dword [ebp - 4], 0
push 0x170
call fcn.00590c07
pop ecx
mov dword [ebp - 0x88], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040b6ae
sub esp, 0x18
mov ebx, eax
mov ecx, esp
xor eax, eax
mov byte [ebp - 4], al
push esi
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00430a1c
add esp, 0x18
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040b8c8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040b155
lea ecx, [ebp - 0x2c]
call fcn.00430a1c
add esp, 0x18
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0040b9f1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00404812
push 0x12c
mov ecx, ebx
call fcn.0040b8d1
cmp byte [ebp + 8], 0
je 0x4cfe90
push ecx
call fcn.0040ba10
push ebx
call fcn.0040bde0
cmp dword [edi + 0x14], 8
mov esi, eax
mov ecx, edi
jb 0x4cfea2
mov ecx, dword [edi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test esi, esi
jne 0x4cff46
test al, al
je 0x4cff46
and dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x2c]
and dword [ebp - 0x18], esi
push edi
call fcn.0040b155
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], 4
je 0x4cff22
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.0042530f
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
mov edx, eax
mov ecx, str.0aa4efce
call fcn.004167ee
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
pop ecx
cmovae edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push dword [ebp - 0x34]
cmovae ecx, dword [ebp - 0x2c]
call fcn.0041e2e8
pop ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00404812
push 0x1a62
push 0x66a80c
push str.__s__d___download_inspire_video_success
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
xor ebx, ebx
inc ebx
jmp 0x4cff48
xor bl, bl
lea ecx, [ebp - 0x84]
call fcn.0040ba5f
mov al, bl
call fcn.00591fc1
ret

Function at 0x4d05a9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x4d05d0
push ecx
push ecx
mov dword [ebp - 4], ecx
call fcn.005b953f
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x4d0ca2
Capabilities:
Check if file exists

Disassembly:
push 0xa0
mov eax, 0x5eb7c4
call fcn.00592017
mov esi, edx
mov dword [ebp - 0xa8], esi
mov edi, ecx
mov dword [ebp - 0xa4], edi
push ecx
push 0x63b554
mov ecx, esi
mov dword [ebp - 0xa4], edi
call fcn.0040aff3
xor ebx, ebx
cmp eax, 0xffffffff
je 0x4d0cee
push esi
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.0040b155
jmp 0x4d0e53
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004cd264
push str.bkinfomouse_set_config
mov byte [ebp - 4], 1
call fcn.005b93d0
pop ecx
push eax
push str.bkinfomouse_set_config
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], ebx
push eax
push str.beautify_need_engine
mov edx, str.Software360360huabaohuabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425cda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d0e1d
push 0x61ce3e
lea ecx, [ebp - 0x58]
call fcn.004045aa
push 0xfde9
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00426886
pop ecx
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.004166a1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00404812
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404267
lea ecx, [ebp - 0xa0]
call fcn.00430aaf
mov esi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x88]
mov edx, dword [ebp - 0xa8]
push str.___engine
call fcn.0041154b
push esi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.00420b19
add esp, 0x20
lea ecx, [ebp - 0x40]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x70]
call fcn.0040b67b
lea ecx, [ebp - 0x88]
call fcn.0040b67b
lea ecx, [ebp - 0xa0]
call fcn.0040b67b
lea ecx, [ebp - 0x58]
call fcn.00404812
jmp 0x4d0e26
push esi
lea ecx, [ebp - 0x40]
call fcn.0041321d
mov byte [ebp - 0xa8], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0xa8]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.0040b62f
lea ecx, [ebp - 0x28]
call fcn.0040b67b
lea ecx, [ebp - 0x40]
call fcn.0040b67b
mov eax, edi
call fcn.00591fc1
ret
Function at 0x4d4848
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5ec01d
call fcn.00592017
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x5c], edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.004cd264
push 0x6308a0
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0041151c
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.0040b67b
cmp esi, 1
jne 0x4d48a4
mov esi, str.mouse_preview_config
jmp 0x4d48f6
cmp esi, 2
jne 0x4d48b0
mov esi, str.mouse_set_config
jmp 0x4d48f6
cmp esi, 3
jne 0x4d48bc
mov esi, str.taskbar_preview_config
jmp 0x4d48f6
cmp esi, 4
jne 0x4d48c8
mov esi, 0x63125c
jmp 0x4d48f6
cmp esi, 5
jne 0x4d48d4
mov esi, str.taskbar_setting_config
jmp 0x4d48f6
cmp esi, 6
jne 0x4d48e0
mov esi, str.startmenu_set_config
jmp 0x4d48f6
cmp esi, 7
jne 0x4d48ec
mov esi, str.startmenu_preview_config
jmp 0x4d48f6
cmp esi, 8
jne 0x4d4907
mov esi, str.video_config
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d4939
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.004046c1
jmp 0x4d49bc
mov dword [ebp - 0x68], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x64]
mov dword [ebp - 0x5c], ebx
call fcn.0041e235
pop ecx
test eax, eax
jne 0x4d496e
cmp dword [ebp - 0x5c], eax
jne 0x4d499d
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
call fcn.0040464f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x58]
call fcn.00404812
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, edi
mov dword [edi + 0x10], ebx
push eax
mov dword [edi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0x68]
call fcn.0041e3ba
lea ecx, [ebp - 0x28]
call fcn.0040b67b
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, edi
call fcn.00591fc1
ret
Function at 0x4d4b09
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x5ec0bd
call fcn.00592017
mov edi, edx
mov esi, ecx
mov ebx, 0x61ce3e
push ebx
call fcn.005acdf0
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040464f
lea ecx, [ebp - 0x74]
call fcn.004cd264
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x64], ebx
je 0x4d4c40
push 0x628a24
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x44]
call fcn.0041154b
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004114f6
mov byte [ebp - 0x78], bl
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x78]
mov dword [ebp - 0x1c], ebx
push eax
mov dword [ebp - 0x18], ebx
call fcn.0040b62f
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0040b67b
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d4c38
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004302c4
pop ecx
test eax, eax
je 0x4d4c38
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0040b0d5
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00426e07
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.0040b67b
test esi, esi
je 0x4d4c30
sub esp, 0x18
lea eax, [ebp - 0x5c]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x44]
call fcn.00430a1c
add esp, 0x18
mov ecx, edi
push eax
call fcn.00409145
lea ecx, [ebp - 0x44]
call fcn.00404812
mov bl, 1
lea ecx, [ebp - 0x5c]
call fcn.0040b67b
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
lea ecx, [ebp - 0x74]
call fcn.0040b67b
mov al, bl
call fcn.00591fc1
ret
Function at 0x4d5dde
Capabilities:
Check if file exists

Disassembly:
push 0x84
mov eax, 0x5ec421
call fcn.00592017
mov esi, ecx
push str.143359e8_f4b9_4010_a5e5_789147203fa5
xor ebx, ebx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4d5e12
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4d5f63
cmp dword [0x6cfc0c], 1
jne 0x4d5f5c
lea ecx, [ebp - 0x2c]
call fcn.004c0e61
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0
je 0x4d5e46
mov edi, 0x629104
push edi
call fcn.005b93d0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
lea eax, [ebp - 0x2c]
mov edi, 0x62af60
push eax
lea eax, [ebp - 0x8c]
push edi
push eax
call fcn.00440e2c
add esp, 0xc
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.0041151c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
mov edx, eax
mov dword [esp], 0x629244
call fcn.0041151c
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004114f6
mov byte [ebp - 0x90], bl
lea ecx, [ebp - 0x44]
push dword [ebp - 0x90]
mov dword [ebp - 0x34], ebx
push eax
mov dword [ebp - 0x30], ebx
call fcn.0040b62f
lea ecx, [ebp - 0x5c]
call fcn.0040b67b
lea ecx, [ebp - 0x74]
call fcn.0040b67b
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
call fcn.0040b67b
push 8
pop esi
cmp dword [ebp - 0x30], esi
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
mov edi, str.LaunchHbProcess
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x18], esi
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x20ac
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d5f4a
cmp dword [ebp - 0x18], esi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004302c4
pop ecx
test eax, eax
je 0x4d5f4a
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x44]
call fcn.004383a1
test al, al
jne 0x4d5f4a
push 0x20b0
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0040b67b
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
jmp 0x4d5f63
mov ecx, esi
call fcn.0047b911
call fcn.00591fc1
ret

Function at 0x4d62d4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
call fcn.004d61c6
cmp dword [eax + 0x14], 8
jb 0x4d62f4
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.0040b67b
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00590be8
leave
ret
Function at 0x4d700c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0xa08]
mov dword [ebp - 0xa08], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
mov dword [ebp - 0xa08], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edi, eax
lea eax, [ebp - 0xa08]
push eax
push ebx
push ebx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push dword [ebp - 0xa08]
call fcn.005b7832
pop ecx
mov ebx, eax
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0xa08]
push ebx
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push str.Default
push ebx
call fcn.005ba70b
push ebx
lea eax, [ebp - 0x204]
push eax
push str.360ThemeMenu.Mutex._s._s
lea eax, [ebp - 0xa04]
push 0x400
push eax
call fcn.0042935a
push ebx
call fcn.005b77f1
add esp, 0x20
lea eax, [ebp - 0xa04]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
pop edi
pop ebx
test eax, eax
je 0x4d70e4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4d70e6
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590be8
leave
ret
Function at 0x4d7cf1
Capabilities:
Check if file exists

Disassembly:
push 0xb4
mov eax, 0x5ec98d
call fcn.00592017
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x80], esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004cd264
mov edi, str._bkinfocustommyCustomizeList
mov byte [ebp - 4], 1
push edi
call fcn.005b93d0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d7d6e
mov byte [ebp - 0x7c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x7c]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
jmp 0x4d7f10
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
push eax
push str.loop_wallpaper_id
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425cda
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00404ba6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0xa0]
cmovae ecx, dword [ebp - 0x28]
call fcn.00436769
test eax, eax
je 0x4d7eee
lea ecx, [ebp - 0xa0]
call fcn.004056d7
test al, al
jne 0x4d7de4
push 0x2252
push str.GetCurCustomLoopData
push str.__s__d___jValue_is_not_object
call fcn.0040a649
add esp, 0xc
jmp 0x4d7eee
push str.list
lea ecx, [ebp - 0xa0]
call fcn.00405401
push eax
lea ecx, [ebp - 0xb0]
call fcn.00404cc0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 3
call fcn.004056c6
test al, al
je 0x4d7ee3
lea eax, [ebp - 0x90]
push eax
call fcn.004057e8
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004057b0
jmp 0x4d7ec9
lea ecx, [ebp - 0x88]
call fcn.004049ac
push eax
lea ecx, [ebp - 0xc0]
call fcn.00404cc0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc0]
push 0x631e68
mov dword [ebp - 0x7c], ebx
call fcn.00405401
lea edx, [ebp - 0x7c]
mov ecx, eax
call fcn.00436e83
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x80]
jne 0x4d7eaf
lea ecx, [ebp - 0x60]
call fcn.00406b04
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00406b1f
push eax
lea ecx, [ebp - 0x40]
call fcn.00409145
lea ecx, [ebp - 0x78]
call fcn.00404812
lea ecx, [ebp - 0x60]
call fcn.004065e4
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 3
call fcn.00404dbc
lea ecx, [ebp - 0x88]
call fcn.004049b2
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x88]
call fcn.004049b7
test al, al
je 0x4d7e3a
lea ecx, [ebp - 0xb0]
call fcn.00404dbc
mov byte [ebp - 0x7c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x7c]
mov dword [esi + 0x10], ebx
mov ecx, esi
push eax
mov dword [esi + 0x14], ebx
call fcn.004046c1
lea ecx, [ebp - 0xa0]
call fcn.00404dbc
lea ecx, [ebp - 0x28]
call fcn.0040b67b
lea ecx, [ebp - 0x40]
call fcn.00404812
mov eax, esi
call fcn.00591fc1
ret
Function at 0x4db3e2
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4db539
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4db539
cmp eax, 0x29
jne 0x4db41f
cmp dword [esi + 0x10], 0
jne 0x4db539
cmp eax, eax
jne 0x4db41f
test dword [esi + 0x50], edx
je 0x4db53f
cmp eax, 0x2e
jne 0x4db43a
push 5
lea ecx, [esi + 0x24]
call fcn.004db619
mov ecx, esi
call fcn.004db3b9
jmp 0x4db523
cmp eax, 0x5c
jne 0x4db48f
mov ecx, esi
call fcn.004db3b9
test byte [esi + 0x50], 0x80
je 0x4db483
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x4db46b
push 4
lea ecx, [esi + 0x24]
call fcn.004db619
mov ecx, esi
call fcn.004db3b9
jmp 0x4db52a
cmp eax, 0x42
jne 0x4db483
push 4
lea ecx, [esi + 0x24]
call fcn.004db619
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4db45f
mov ecx, esi
call fcn.004dc684
jmp 0x4db523
cmp eax, 0x5b
jne 0x4db4af
mov ecx, esi
call fcn.004db3b9
mov ecx, esi
call fcn.004dc638
cmp dword [esi + 0x4c], 0x5d
je 0x4db42e
push 4
jmp 0x4db541
cmp eax, 0x28
jne 0x4db4cc
mov ecx, esi
call fcn.004db3b9
mov ecx, esi
call fcn.004dc765
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4db53f
jmp 0x4db518
cmp eax, 0x5e
jne 0x4db4d5
push 2
jmp 0x4db457
cmp eax, 0x24
jne 0x4db4e1
push 3
jmp 0x4db457
cmp eax, 0x2a
je 0x4db535
cmp eax, 0x2b
je 0x4db535
cmp eax, 0x3f
je 0x4db535
cmp eax, 0x7b
je 0x4db535
cmp eax, 0x7d
jne 0x4db4ff
test dword [esi + 0x50], edx
je 0x4db531
cmp eax, 0x5d
jne 0x4db509
test dword [esi + 0x50], edx
je 0x4db4a8
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004dc944
mov bl, 1
mov ecx, esi
call fcn.004db3b9
test bl, bl
je 0x4db52a
mov ecx, esi
call fcn.004dc86a
mov cl, 1
jmp 0x4db3e9
push 6
jmp 0x4db541
push 0xa
jmp 0x4db541
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.004d9d83
int3

Function at 0x4dfad7
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x5d83c0
call fcn.00592017
mov esi, ecx
call fcn.00414f51
test eax, eax
je 0x4652ff
mov ecx, esi
call fcn.0046553c
jmp 0x465316
push 0xce
push str.C360SafeHbMgr::RunTask
push str.__s__d___not_run_OnTimerEver5Second
call fcn.0040a649
add esp, 0xc
call fcn.004663f8
test eax, eax
je 0x46538c
lea ecx, [ebp - 0x40]
call fcn.004251b0
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
push str.360browser_bkinfolocalbk_
lea ecx, [ebp - 0x28]
call fcn.0041154b
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465368
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
call fcn.00427dad
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea ecx, [ebp - 0x28]
call fcn.0040b67b
lea ecx, [ebp - 0x40]
call fcn.0040b67b
mov al, 1
call fcn.00591fc1
ret
call fcn.00465394
mov ecx, eax
jmp 0x4652df

Function at 0x4dfbc2
Capabilities:
Check if file exists

Disassembly:
call fcn.004511b9
jmp fcn.00450f4b
Function at 0x4e0dff
Capabilities:
Check if file exists

Disassembly:
push 0x74
mov eax, 0x5ed479
call fcn.00592017
xor ebx, ebx
lea ecx, [ebp - 0x58]
mov edi, ebx
mov dword [ebp - 0x74], edi
call fcn.004c27c2
push 0x629104
lea edx, [ebp - 0x58]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
call fcn.0041154b
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e0f36
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00426e07
test eax, eax
je 0x4e0f2e
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
lea edx, [ebp - 0x80]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.00427bdc
mov esi, dword [ebp - 0x80]
jmp 0x4e0f1d
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x70]
call fcn.00430a1c
add esp, 0x18
mov byte [ebp - 4], 4
or edi, 1
mov ecx, eax
mov dword [ebp - 0x74], edi
call fcn.00426fd5
test al, al
je 0x4e0ee4
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov ecx, esi
cmovae edx, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x4e0ed9
mov ecx, dword [esi]
call fcn.004270e1
test eax, eax
jns 0x4e0ee4
mov bl, 1
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 3
and edi, 0xfffffffe
call fcn.00404812
test bl, bl
je 0x4e0f17
sub esp, 0x18
lea ecx, [ebp - 0x58]
mov eax, esp
push esi
push ecx
push eax
call fcn.004296fd
add esp, 0xc
mov cl, 1
call fcn.00425b47
add esp, 0x18
push 0
add esi, 0x18
pop ebx
cmp esi, dword [ebp - 0x7c]
jne 0x4e0e93
lea ecx, [ebp - 0x80]
call fcn.004132ed
lea ecx, [ebp - 0x28]
call fcn.0040b67b
lea ecx, [ebp - 0x40]
call fcn.0040b67b
lea ecx, [ebp - 0x58]
call fcn.0040b67b
call fcn.00591fc1
ret
Function at 0x4e0f54
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x5db741
call fcn.00592017
mov esi, ecx
push 0x216
mov ebx, str.TaskRunner::RelaunchProcess
push ebx
push str.__s__d___Update:_RelaunchProcess
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0x629104
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.004c2a71
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040b67b
add esi, 0x30
push 8
pop edi
mov ecx, esi
cmp dword [esi + 0x14], edi
jb 0x4e0fb1
mov ecx, dword [esi]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x219
push ebx
push str.__s__d___szExePath___s_m_strCmd__s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c4
pop ecx
test eax, eax
je 0x4e1021
push 0x21c
push ebx
push str.__s__d___ShellExecute_start___
call fcn.0040a649
add esp, 0xc
cmp dword [esi + 0x14], edi
jb 0x4e0fff
mov esi, dword [esi]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push esi
push eax
push 0x62f200
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x28]
call fcn.0040b67b
call fcn.00591fc1
ret
Function at 0x4e9f70
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x4ea00f
push edi
call fcn.004fc2a0
add esp, 4
test al, al
jne 0x4ea00f
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4e9f98
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.00507490
add esp, 0xc
test eax, eax
je 0x4e9fcc
sub eax, edi
push eax
push 0x2e
push edi
call fcn.00507490
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4e9fce
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4ea007
mov al, byte [edi]
push eax
call fcn.004f8250
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x4e9fe6
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
ret
xor eax, eax
pop edi
ret