joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052ae0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acda8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x10052b0f
xor eax, eax
jmp 0x10052b89
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052b21
xor eax, eax
jmp 0x10052b89
cmp dword [ebp + 0xc], 0
je 0x10052b81
push 0x101d5ab0
lea ecx, [ebp - 0x14]
push ecx
call fcn.100ea5b0
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.1004f530
push eax
call fcn.100500a0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100056e0
cmp dword [ebp - 0x10], 0
je 0x10052b81
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.100500d0
add esp, 8
jmp 0x10052b89
mov eax, dword [ebp + 8]
call fcn.101763a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10052ba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x10052bad
xor eax, eax
jmp 0x10052beb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052bbf
xor eax, eax
jmp 0x10052beb
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.100ea33b
add esp, 8
test eax, eax
je 0x10052bdb
mov eax, 1
jmp 0x10052beb
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10052ae0
add esp, 8
pop ebp
ret
Function at 0x10059fb0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
push edi
movzx eax, byte [0x1020c40a]
test eax, eax
je 0x1005a146
mov dword [0x10210c18], 0x114
push 0x10210c18
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1005a0ba
mov byte [ebp - 0x50], 0
push 0x3f
push 0
lea ecx, [ebp - 0x4f]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x40
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 4]
push ecx
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1005a062
mov dword [0x10210c28], 2
movsx edx, byte [ebp - 0x50]
sub edx, 0x30
mov dword [0x10210c1c], edx
lea eax, [ebp - 0x4e]
push eax
call fcn.101803d8
add esp, 4
mov dword [0x10210c20], eax
jmp 0x1005a0ba
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
movzx eax, dl
mov dword [0x10210c1c], eax
mov ecx, dword [ebp - 0x54]
and ecx, 0xffff
movzx edx, cx
shr edx, 8
and edx, 0xff
movzx eax, dl
mov dword [0x10210c20], eax
mov ecx, 4
cmp ecx, dword [0x10210c1c]
sbb edx, edx
neg edx
add edx, 1
mov dword [0x10210c28], edx
cmp dword [0x10210c1c], 6
ja 0x1005a0d5
cmp dword [0x10210c1c], 6
jne 0x1005a13f
cmp dword [0x10210c20], 2
jb 0x1005a13f
mov dword [ebp - 0x170], 0
push 0x110
push 0
lea eax, [ebp - 0x16c]
push eax
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x170], 0x114
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1005a13f
lea ecx, [ebp - 0x170]
push ecx
call dword [ebp - 0x58]
test eax, eax
jne 0x1005a13f
mov ecx, 0x45
lea esi, [ebp - 0x170]
mov edi, 0x10210c18
rep movsd dword es:[edi], dword [esi]
mov byte [0x1020c40a], 0
mov ecx, 0x45
mov esi, 0x10210c18
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret
Function at 0x100617e0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a5d30
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
lea ecx, [ebp - 0x14]
call fcn.1000b6a0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x100618b0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.100640f0
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x30]
call fcn.10064190
push eax
push 1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push 0
lea ecx, [ebp - 0x30]
call fcn.10064190
push eax
lea ecx, [ebp - 0x14]
call fcn.10011660
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.10064170
jmp 0x100618a9
mov dword [ebp - 4], 0
push 0x101db5c4
push 0x101dbe8c
lea ecx, [ebp - 0x14]
call fcn.10063b60
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10049f40
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100639c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a7e20
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x34], 0x66
mov byte [ebp - 0x33], 0x63
mov byte [ebp - 0x32], 0x34
mov byte [ebp - 0x31], 0x33
mov byte [ebp - 0x30], 0x38
mov byte [ebp - 0x2f], 0x30
mov byte [ebp - 0x2e], 0x37
mov byte [ebp - 0x2d], 0x33
mov byte [ebp - 0x2c], 0x66
mov byte [ebp - 0x2b], 0x39
mov byte [ebp - 0x2a], 0x32
mov byte [ebp - 0x29], 0x34
mov byte [ebp - 0x28], 0x30
mov byte [ebp - 0x27], 0x62
mov byte [ebp - 0x26], 0x35
mov byte [ebp - 0x25], 0x31
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x37
mov byte [ebp - 0x22], 0x38
mov byte [ebp - 0x21], 0x66
mov byte [ebp - 0x20], 0x31
mov byte [ebp - 0x1f], 0x37
mov byte [ebp - 0x1e], 0x36
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x37
mov byte [ebp - 0x1b], 0x33
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x35
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0
xor eax, eax
mov byte [ebp - 0x13], al
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.100115e0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x3c]
call fcn.10063b40
lea ecx, [ebp - 0x3c]
call fcn.100117c0
push eax
lea ecx, [ebp - 0x3c]
call fcn.10063ec0
push eax
lea esi, [ebp - 0x38]
call fcn.100f904d
add esp, 8
mov byte [ebp - 4], 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call fcn.10063f20
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000ac00
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.100056e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100056e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret
Function at 0x10068900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acddb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov ecx, dword [ebp - 0x230]
add ecx, 0x84
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1006895d
xor eax, eax
jmp 0x10068a92
lea ecx, [ebp - 0x224]
call fcn.1000b6a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.101845c0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x230]
add ecx, 0x84
call fcn.1004f530
push eax
call fcn.1016a520
add esp, 0xc
test eax, eax
je 0x100689d8
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x224]
call fcn.1000b540
jmp 0x10068a12
mov ecx, dword [ebp - 0x230]
add ecx, 0x84
call fcn.10063f00
movzx eax, al
test eax, eax
jne 0x10068a12
mov ecx, dword [ebp - 0x230]
add ecx, 0x84
push ecx
lea ecx, [ebp - 0x224]
call fcn.1000f500
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x224]
call fcn.10063f00
movzx edx, al
test edx, edx
jne 0x10068a65
cmp dword [ebp - 0x228], 0
jne 0x10068a65
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x220]
push edx
lea ecx, [ebp - 0x224]
call fcn.1004f530
push eax
call fcn.1016aa60
push eax
call fcn.1016aad0
mov dword [ebp - 0x228], eax
jmp 0x10068a6e
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100056e0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10071300
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push 0
push 0x2000000
push 3
push 0
push 7
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
call fcn.1004f530
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10071358
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1008b0b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 0x1000
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop ebp
ret 4
Function at 0x10098920
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
push str.flashapp_2012_09_17_softmsg_lite_notify_exit
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009896a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009896a
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.360loopwallpaper.exe_20120910_1607
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100989a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100989a5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x21c]
call fcn.100997a0
test eax, eax
jne 0x10098a5b
mov ecx, dword [ebp - 0x21c]
call fcn.10099aa0
test eax, eax
jne 0x10098a5b
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.101845c0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.360wallpaper
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x218]
push edx
call fcn.100e2f16
add esp, 4
push str...360wp
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
push ecx
call fcn.100e2f16
add esp, 4
push str.Software360WallPaper
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret

Function at 0x10098a70
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10098ab1
lea eax, [ebp - 0xc]
push eax
push 0x3e8
push 0
push 0
push 0
push 0xc98
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0
push str.SoftManagerLiteWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10098ae7
lea edx, [ebp - 0x10]
push edx
push 0x3e8
push 0
push 0
push 0
push 0x7e8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x10098af4
push 0x101ca718
mov ecx, dword [ebp - 0x14]
call fcn.10098b60
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10098f00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ad0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp + 8], 0
je 0x10098f3d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10098f44
xor eax, eax
jmp 0x1009904e
push 0
lea esi, [ebp - 0x2c]
call fcn.100df270
mov dword [ebp - 4], 0
push 0x101ca118
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.100e558a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x40]
call fcn.100e571e
test eax, eax
je 0x10098f8a
lea eax, [ebp - 0x2c]
call fcn.100e0830
movzx ecx, al
test ecx, ecx
jne 0x10098fb4
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10014bd0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
call fcn.100df5f0
mov eax, dword [ebp - 0x44]
jmp 0x1009904e
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.100e0220
push eax
lea ecx, [ebp - 0x1c]
call fcn.100df470
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
call fcn.100e0830
movzx edx, al
test edx, edx
jne 0x1009900e
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
call fcn.100df5f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10014bd0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
call fcn.100df5f0
mov eax, dword [ebp - 0x48]
jmp 0x1009904e
mov eax, dword [ebp - 0x50]
add eax, 8
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.1009c5d0
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
call fcn.100df5f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10014bd0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
call fcn.100df5f0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10099210
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aea18
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push str.89CCBABF_F37D_4705_84C4_430F62094247
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1009926e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009926e
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100993c2
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Q360TaskBtn
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100992a3
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100992a3
xor eax, eax
jmp 0x100993c2
push 0x101ca930
lea ecx, [ebp - 0x24]
call fcn.1000b560
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.1016f250
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.100056e0
push str.SMLSMLCore.exe
lea ecx, [ebp - 0x28]
call fcn.1000b560
mov byte [ebp - 4], 3
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.1016f250
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.100056e0
push str.SMLSkinSML_DefaultSkin.uiz
lea ecx, [ebp - 0x2c]
call fcn.1000b560
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.1016f250
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.100056e0
lea ecx, [ebp - 0x20]
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10099366
lea ecx, [ebp - 0x14]
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10099366
lea ecx, [ebp - 0x1c]
call fcn.1004f530
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10099395
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x14]
call fcn.100056e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.100056e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100056e0
mov eax, dword [ebp - 0x30]
jmp 0x100993c2
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x14]
call fcn.100056e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.100056e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.100056e0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100993e0
Capabilities:
Check mutex on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
mov dword [ebp - 0x150], ecx
push str.KNSMLStarter
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x1009943d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009943d
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10099555
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10099467
xor eax, eax
jmp 0x10099555
mov dword [ebp - 0x11c], 2
mov ecx, 0xb
mov esi, 0x101ca9f4
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 4
lea edx, [ebp - 0x11c]
push edx
push 4
push 0x101caa24
push 0x101caa38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x2e
lea eax, [ebp - 0x14c]
push eax
push 1
push 0x101caa80
push 0x101caaa8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x110], 0
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x110], 0xf4
push str.360softmgrlite
push 0x78
lea edx, [ebp - 0x10c]
push edx
call fcn.10180add
add esp, 0xc
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x4c4f504c
mov dword [ebp - 0xc], 0xf4
lea ecx, [ebp - 0x110]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x118], 0
lea edx, [ebp - 0x118]
push edx
push 0x3e8
push 1
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret

Function at 0x100996e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
push 0x101cad00
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009970a
jmp 0x1009972d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x7d0
jbe 0x1009971c
jmp 0x1009972d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
test eax, eax
jne 0x100996f2
mov esp, ebp
pop ebp
ret
Function at 0x10099740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0
push str.XTaskBarBtn
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1009976a
jmp 0x1009978d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x7d0
jbe 0x1009977c
jmp 0x1009978d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
test eax, eax
jne 0x10099752
mov esp, ebp
pop ebp
ret
Function at 0x10099aa0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
mov ax, word [0x101cadd8]
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.101845c0
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10099b2a
mov eax, 1
jmp 0x10099b2c
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret

Function at 0x1009cc90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acda8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x1009ccbf
xor eax, eax
jmp 0x1009cd39
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009ccd1
xor eax, eax
jmp 0x1009cd39
cmp dword [ebp + 0xc], 0
je 0x1009cd31
push 0x101caec8
lea ecx, [ebp - 0x14]
push ecx
call fcn.100ea5b0
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.1004f530
push eax
call fcn.100500a0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100056e0
cmp dword [ebp - 0x10], 0
je 0x1009cd31
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.100500d0
add esp, 8
jmp 0x1009cd39
mov eax, dword [ebp + 8]
call fcn.101763a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1009cd50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x1009cd5d
xor eax, eax
jmp 0x1009cd9b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009cd6f
xor eax, eax
jmp 0x1009cd9b
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.100ea33b
add esp, 8
test eax, eax
je 0x1009cd8b
mov eax, 1
jmp 0x1009cd9b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1009cc90
add esp, 8
pop ebp
ret