joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402610
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402bc0
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x402640
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jae 0x402766
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402cd0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4026a3
cmp dword [ebp - 0xc], 0
jne 0x4026a3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
call fcn.0041bf7a
test eax, eax
je 0x402685
mov dword [ebp - 0x1c], 0x4bbbe8
jmp 0x40268c
mov dword [ebp - 0x1c], 0x4bbbf8
mov ecx, dword [ebp - 0x1c]
push ecx
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x402637
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402c10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402761
cmp dword [ebp - 0x10], 0
je 0x402761
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax + 0xc]
test eax, eax
je 0x40274b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 8]
cmp eax, 2
jne 0x40270b
push 0x4bbc08
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x402749
call fcn.0041baf8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402733
push 0x4bbc18
push 2
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x402749
push 0x4bbc40
push 2
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x402761
push 0x4bbc68
push 2
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
call fcn.00402be0
jmp 0x402637
cmp dword [ebp - 8], 0
jne 0x402783
push 0
push 0x5425d4
push 0x4bbc78
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00402b70
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403133
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [ebp - 0x418], ecx
push 0
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.004014a0
push 0x42d
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x1c
call fcn.00404540
push 0x42c
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x74
call fcn.00404540
push 0x433
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0xcc
call fcn.00404540
push 0
push 4
mov ecx, dword [ebp - 0x418]
add ecx, 0x1c
call fcn.00404380
push 0
push 4
mov ecx, dword [ebp - 0x418]
add ecx, 0xcc
call fcn.00404380
push 0x4bc590
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4bc5a4
push str.view_immunity
push 0x4bc5ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x403223
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x418]
add ecx, 0x74
call fcn.004043d0
jmp 0x403236
push str.http:__baike.360.cn_3229787_2649304.html_recommend1
mov ecx, dword [ebp - 0x418]
add ecx, 0x74
call fcn.004043d0
push 0x42b
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x124
call fcn.004063f0
push 0x429
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x128
call fcn.004063f0
push 0x42a
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x12c
call fcn.004063f0
push 0
push 1
push 0
push 0x4bc630
push 0x64
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.00403ff0
push 1
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.00441560
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x124
call fcn.00404190
push 1
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.00441560
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x128
call fcn.00404190
push 1
mov ecx, dword [ebp - 0x418]
add ecx, 0x130
call fcn.00441560
push eax
mov ecx, dword [ebp - 0x418]
add ecx, 0x12c
call fcn.00404190
call fcn.004033db
test eax, eax
je 0x40335a
call fcn.004377b0
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
call fcn.00437c96
test eax, eax
jne 0x40335a
call fcn.00403459
mov ecx, dword [ebp - 0x418]
call fcn.00403752
test eax, eax
je 0x403383
push 0
push 1
push 0xf1
mov ecx, dword [ebp - 0x418]
add ecx, 0x12c
call fcn.00404160
call fcn.0041c1e0
test eax, eax
je 0x4033ab
call fcn.0041c248
push 0
push 1
push 0xf1
mov ecx, dword [ebp - 0x418]
add ecx, 0x124
call fcn.00404160
call fcn.0041ba90
test eax, eax
je 0x4033d3
call fcn.0041c081
push 0
push 1
push 0xf1
mov ecx, dword [ebp - 0x418]
add ecx, 0x128
call fcn.00404160
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4034f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00432cb0
add esp, 8
test eax, eax
je 0x403539
push 5
push 0
lea ecx, [ebp - 0x104]
push ecx
push str.notepad.exe
push 0x4bc68c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4035e1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
xor eax, eax
mov al, byte [0x5425dc]
and eax, 1
test eax, eax
jne 0x40361d
mov cl, byte [0x5425dc]
or cl, 1
mov byte [0x5425dc], cl
mov ecx, dword [ebp - 0x210]
call fcn.00403752
mov dword [0x5425d8], eax
cmp dword [0x5425d8], 0
jne 0x403704
push 4
push 0x4bc694
push 0x4bc69c
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 6
je 0x403673
push 0
push 0
push 0xf1
mov ecx, dword [ebp - 0x210]
add ecx, 0x12c
call fcn.00404160
xor eax, eax
jmp 0x40374c
push 0x104
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push eax
push 0x4bc72c
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call fcn.00403f50
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0x4bc738
push 0x4bc740
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b26e
push 1
call fcn.004377b0
mov ecx, eax
call fcn.00437c00
push 0
push 0x4bc770
push 0x4bc778
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403738
push 0x4bc78c
push 0x4bc794
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b3de
push 0
push 0x4bc7c4
push 0x4bc7cc
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
cmp dword [0x5425d8], 0
sete cl
mov dword [0x5425d8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403752
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x318], 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
push str.__s___anti
push 0x104
lea edx, [ebp - 0x314]
push edx
call fcn.00403f50
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4bc7ec
push 0x4bc7f4
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b06b
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x40386b
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4bc824
push 0x4bc830
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b06b
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x40386b
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0x4bc860
push 0x4bc86c
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b06b
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x40391d
cmp dword [ebp - 0x210], 1
jne 0x40391d
cmp dword [ebp - 0x318], 0
jbe 0x40391d
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402b10
add esp, 8
test eax, eax
jne 0x40391d
push str.killrodog4
push 0x4bc8a8
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b3de
push str.killrodog
push 0x4bc8e4
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b3de
lea edx, [ebp - 0x314]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
push 1
push str.akCheck
push 0x4bc91c
push SysStringLen
call fcn.0043ae50
mov ecx, eax
call fcn.0043b26e
mov eax, 1
jmp 0x40391f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4064e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
call fcn.00406fd0
and eax, 0xff
test eax, eax
je 0x406545
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.004065f0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.004065f0
push eax
push 0x4e
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405d90
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4065e0
mov ecx, dword [ebp - 0x18]
call fcn.00406e30
and eax, 0xff
test eax, eax
je 0x40658c
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.004065f0
and eax, 0xffff
and eax, 0xffff
push eax
push 0x111
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405d90
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4065e0
push 1
push 0
push 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x24]
push eax
push 0x4bcb60
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
mov ecx, 0x20
cmp ecx, dword [ebp - 0x14]
sbb edx, edx
neg edx
mov byte [ebp - 4], dl
mov eax, dword [ebp - 4]
and eax, 0xff
test eax, eax
je 0x4065e0
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + 0x54]
or dl, 2
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x54], dl
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00405200
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4085f0
Capabilities:
Get common file path
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5c29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov dword [ebp - 0x128], ecx
lea ecx, [ebp - 0x10]
call fcn.004094b0
mov dword [ebp - 4], 0
push 0x401
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x40866c
mov dword [ebp - 0x120], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x120]
jmp 0x40876a
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00409530
push eax
push 0x401
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00409630
push 0
push 0x10
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40874b
push 0x4bd024
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x4bd038
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x40874b
mov edx, dword [ebp - 0x11c]
push edx
push 1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00441560
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
test eax, eax
jbe 0x40873b
push 0
push 0x4bd03c
push 0x4bd044
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00409680
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4088e1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x40f
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00402b30
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x40891d
push 5
push 0
push 0
push str.http:__baike.360.cn_help.html
push 0x4bd120
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x408934
mov eax, dword [ebp - 4]
push eax
push 0
push 0x4088c6
call fcn.004410f0
mov ecx, eax
call fcn.00441345
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4091d0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5d3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004094b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004094b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004094b0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004094b0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004094b0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004094b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004094b0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004094b0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004094b0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004094b0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.004094b0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004094b0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004094b0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004094b0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.004094b0
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.004094b0
mov byte [ebp - 4], 0xf
push 0x5425e8
mov ecx, dword [ebp - 0x10]
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.004094d0
push 0x5425e8
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004094d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x409390
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5e01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00409680
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00409680
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00409680
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00409680
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00409680
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00409680
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00409680
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00409680
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00409680
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00409680
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00409680
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00409680
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00409680
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00409680
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00409680
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.00409680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40a3d4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov dword [ebp - 0x414], ecx
push 0
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.004014a0
push 0x40d
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.00404540
push 0x42e
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x74
call fcn.00404540
push 0x42f
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0xcc
call fcn.00404540
push 0x430
mov ecx, dword [ebp - 0x414]
add ecx, 4
call fcn.00402b30
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x124
call fcn.00404540
push 0x4bd41c
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4bd430
push str.what_system_package
push 0x4bd47c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a4c2
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.004043d0
jmp 0x40a4d5
push str.http:__baike.360.cn_3229787_1835040.html_recommend1
mov ecx, dword [ebp - 0x414]
add ecx, 0x1c
call fcn.004043d0
push 0x4bd4c0
push 0x410
lea edx, [ebp - 0x410]
push edx
push 0x4bd4d4
push str.third_package
push 0x4bd50c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a516
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x414]
add ecx, 0x74
call fcn.004043d0
jmp 0x40a529
push str.http:__www.360.cn_custom_softleak.html
mov ecx, dword [ebp - 0x414]
add ecx, 0x74
call fcn.004043d0
push 0x4bd540
push 0x410
lea ecx, [ebp - 0x410]
push ecx
push 0x4bd554
push str.how_use_360protect
push 0x4bd5a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a56d
lea edx, [ebp - 0x410]
push edx
mov ecx, dword [ebp - 0x414]
add ecx, 0xcc
call fcn.004043d0
jmp 0x40a583
push 0x4bd5ac
mov ecx, dword [ebp - 0x414]
add ecx, 0xcc
call fcn.004043d0
push 0x4bd5e4
push 0x410
lea eax, [ebp - 0x410]
push eax
push 0x4bd5f8
push str.why_use_360protect
push 0x4bd644
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x40a5c7
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x414]
add ecx, 0x124
call fcn.004043d0
jmp 0x40a5dd
push str.http:__baike.360.cn_3229787_1809923.html_recommend1
mov ecx, dword [ebp - 0x414]
add ecx, 0x124
call fcn.004043d0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a5fc
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0041a460
add esp, 8
test eax, eax
je 0x40a6e3
push str.360hotfix.exe
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
and eax, 0x10
test eax, eax
je 0x40a683
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x10c], 0x4bd698
jmp 0x40a6e1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
push edx
push str.__s___page_d
push 0x208
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x14
push 5
lea ecx, [ebp - 0x318]
push ecx
call fcn.0041ad54
add esp, 8
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x40a6d4
mov dword [ebp - 0x10c], 0x4bd704
jmp 0x40a6e1
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a6f7
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x10c], 0x4bd770
cmp dword [ebp - 0x10c], 0
je 0x40a73d
push 0x30
push 0x4bd7cc
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x320]
add ecx, 4
call fcn.00402b70
cmp dword [ebp - 0x108], 0
je 0x40a73d
push 5
push 0
push 0
push 0x4bd7d4
push 0x4bd7e8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret 4