joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x9c9d9e9f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor ecx, ecx
nop
nop
mov dword [esp + 4], ecx
mov eax, ecx
and eax, 0xb
mov ecx, dword [esp + 4]
and ecx, 4
xor ecx, 0x74e17644
sub eax, ecx
mov esi, eax
not esi
lea ecx, [eax + eax*2]
lea edx, [ecx + esi*4]
mov edi, 0xfc
sub edi, edx
mov edx, dword [esp + 4]
movzx ebx, byte [esp + edx + 8]
lea edx, [ecx + esi*4]
add edx, 3
xor edx, ebx
add edx, ebx
and edi, ebx
sub edx, edi
lea edi, [eax + eax]
lea ecx, [eax - 1]
neg eax
and eax, edi
not edi
and edi, ecx
sub edi, eax
mov eax, edi
and eax, esi
add edi, esi
sub edi, eax
sub edi, eax
or edi, eax
mov eax, edi
and eax, ebx
mov esi, eax
or esi, 2
mov ecx, eax
and ecx, 2
imul ecx, esi
mov esi, edi
or esi, ebx
add edi, ebx
not edi
add edi, esi
and edi, 2
mov esi, eax
and esi, 0xfffffffd
imul esi, edi
add esi, ecx
mov edi, esi
not edi
add edi, eax
sub esi, eax
mov eax, edi
and eax, 0x9116083b
and esi, 0x6ee9f7c4
or esi, eax
xor esi, edx
or edi, edx
xor esi, 0x6ee9f7c4
not edi
or edi, esi
mov dword [esp + 0x24], edi
mov ecx, dword [esp + 0x24]
add ecx, 0x322a3bdb
mov eax, ecx
xor eax, 0xfe
or ecx, 1
and eax, ecx
add eax, ecx
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x10
jne 0x4420a0
mov eax, dword [esp + 8]
mov ecx, dword [0x44ed90]
test ecx, ecx
je 0x4421ca
xor edx, edx
mov esi, dword [0x44ed94]
nop
nop
nop
cmp dword [esi + edx*8], 0xd75bc899
je 0x4421a0
inc edx
cmp ecx, edx
jne 0x442190
jmp 0x4421ca
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4421ca
lea eax, [esp + 8]
lea edx, [esp + 0x24]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x44ed98]
push ecx
call fcn.0043e300
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4421d7
mov ecx, dword [esp + 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4421e6
cmp byte [esp + 0x1d], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4427a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x4427c0
add edx, 0xfffffffe
and edx, 0xfffe
mov word [esp + 4], dx
add edx, 2
mov word [esp + 6], dx
mov dword [esp + 8], ecx
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], 0x9c9d9e9f
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], ecx
mov eax, ecx
and eax, 0xb
mov ecx, dword [esp]
and ecx, 4
xor ecx, 0x74e17644
sub eax, ecx
mov edx, eax
not edx
lea ecx, [eax + eax*2]
lea edi, [ecx + edx*4]
mov esi, 0xfc
sub esi, edi
mov edi, dword [esp]
movzx ebx, byte [esp + edi + 0x10]
lea edi, [ecx + edx*4]
add edi, 3
xor edi, ebx
add edi, ebx
and esi, ebx
sub edi, esi
lea esi, [eax + eax]
lea ecx, [eax - 1]
neg eax
and eax, esi
not esi
and esi, ecx
sub esi, eax
mov eax, esi
and eax, edx
add esi, edx
sub esi, eax
sub esi, eax
or esi, eax
mov eax, esi
and eax, ebx
mov edx, eax
or edx, 2
mov ecx, eax
and ecx, 2
imul ecx, edx
mov edx, esi
or edx, ebx
add esi, ebx
not esi
add esi, edx
and esi, 2
mov edx, eax
and edx, 0xfffffffd
imul edx, esi
add edx, ecx
mov esi, edx
not esi
add esi, eax
sub edx, eax
mov eax, esi
and eax, 0x9116083b
and edx, 0x6ee9f7c4
or edx, eax
xor edx, edi
or esi, edi
xor edx, 0x6ee9f7c4
not esi
or esi, edx
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0xc]
add ecx, 0x322a3bdb
mov eax, ecx
xor eax, 0xfe
or ecx, 1
and eax, ecx
add eax, ecx
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc ecx
cmp ecx, 0x10
jne 0x442840
mov eax, dword [esp + 0x10]
mov ecx, dword [0x44ed90]
test ecx, ecx
je 0x442967
xor edx, edx
mov esi, dword [0x44ed94]
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x55708665
je 0x442940
inc edx
cmp ecx, edx
jne 0x442930
jmp 0x442967
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x442967
lea eax, [esp + 0x24]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x44ed98]
push ecx
call fcn.0043e300
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7c9e97
Capabilities:
Encode data using xor

Disassembly:
cmp esi, edx
andnps xmm6, xmmword [eax + ebp*8]
fst qword [ebx]
xlatb
push esi
ror dword ss:[eax - 0x53ea01b3], 0x81
xor eax, 0x55c80e47
dec ecx
call 0x55b5f85
ror dword [esi], 0xba
inc ebp
dec edx
call 0x8059ac80
jg 0x7c9ece
jne 0x7c9e86
sub al, 0x4c
dec esp
invalid
mov eax, 0x1048af44
jne 0x7c9e92
mov eax, 0x375a0620
cmc
call [eax - 0x51]
push ebx
push esi
mov esi, ecx
push 0x54
xor ebx, ebx
lea eax, [esi + 0x50]
fucompi st(6)
test al, 0x3f
mov ebx, 0xeaed7f
push 0x8e8d6a04
bound edx, qword [ebx + 0x51]
call 0xef55b093
and edi, esi
out dx, al
invalid
jle 0x7c9e58
push dword [edi - 0x4b]
pop esi
xor byte [edx], dh
mov byte [esi + 0x4b], bl
mov byte [esi + 0x4a], bl
mov byte [esi + 0x49], bl
mov byte [esi + 0x48], bl
jbe 0x7c9ee3
inc dword [eax*8 - 0x60fe3c5b]
invalid
add al, 0xc5
movsd dword es:[edi], dword [esi]
ret
Function at 0x40ed7b
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x23
invalid
push ebx
lodsd eax, dword cs:[esi]
test byte [edx], bl
out dx, eax
mov bl, 0x6a
mov bl, 0x47
sub al, 0xfd
adc eax, edx
fsub st(6), st(0)
mov al, 0xac
idiv byte [ecx - 0x60]
test dword [ecx + 0x53d0c1a5], esi
stosd dword es:[edi], eax
pushfd
stc
inc ebx
inc eax
je 0x40eda1
popfd
out 0x7f, eax
mov eax, dword [0x87c82099]
jmp 0x40ece0
mov dh, byte [eax + 0x39]
leave
mov cs, word [ebx + 0x1a]
insb byte es:[edi], dx
insd dword es:[edi], dx
loop 0x40ed2a
cmp dh, byte [ebp - 0x34143282]
mov esi, 0x9679b1cf
xchg esi, eax
imul edi, dword [eax + 0xc], 0xdd034ac8
enter 0x34a, 0xffffffffffffffdd
cmp byte [0x50cc92ca], ch
jg 0x40ed73
sub cl, byte [edi + 0x1f]
frstor dword [ecx + edi]
sysenter
pop es
or al, 0xf6
mov dl, 0x9d
adc al, 0xc
rcr dword [ecx], 1
jl 0x40ed88
mov esi, 0x3a7db8ef
xchg edx, eax
mov esi, 0x9bb404a3
mov al, 0x43
pop esi
xor byte [ebx + edi*2], 0x6f
dec edi
sub byte [ebx], 0xba
loop 0x40edf2
jp 0x40edc6
cmp byte [ebx - 0x69148b13], bh
mov ebx, 0x96eb74ed
jmp 0x40ed8c
pop esp
imul edx, dword [ecx + 0x5e], 0x31
add al, 0xbd
in eax, dx
ljmp 0x5feb

Function at 0x417e10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0x4c4064
mov dword [0x4c7aec], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [0x4c7aec]
add ecx, eax
test esi, esi
mov dword [0x4c7aec], ecx
je 0x417e56
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x417e60
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c7aec], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add dword [0x4c7aec], eax
call fcn.00417e10
mov ecx, dword [0x4c7aec]
push str.shell32.lib
add ecx, eax
mov dword [0x4c7aec], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x417eb6
or dword [esi], 0x2000000
push str.SetCurrentProcessExplicitAppUserModelID
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, esi
pop edi
pop esi
ret

Function at 0x456caf
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ebp - 0x50198df7], dh
cmp byte [eax + 0x29c800cf], ch
js 0x456d25
sub bh, byte [esi]
invalid
rcl byte [ecx + 0x57], 0xe6
jo 0x456cbb
mov eax, dword [0xc6314a84]
ja 0x456d92
cli
xchg edi, eax
fxch st(5)
cld
salc
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
xchg edx, eax
adc al, 0x7a
mov esi, 0xee4b7a96
daa
sar dword [edx], 0xa
invalid
Function at 0x466627
Capabilities:
Packed with generic packer

Disassembly:
popal
ficom word [edi]
shl byte [esi - 0x4c], 1
or al, 0xa5
daa
out dx, al
mov bh, 0xb2
and ebx, dword [ebx + 0x30bde6e5]
std
pop ebp
or al, 0x5b
stosb byte es:[edi], al
mov edx, 0x6685aa58
sar byte [ebx + ebx*8], cl
push ebx
aam 0xbb
xor edx, dword [esi]
add ebp, ebx
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
cmp al, 0x7c
and al, 0xe4
pop ecx
ret 0xaf26
mov cl, byte [ecx + ebx]
pop ds
xor ah, bl
inc esp
and dl, byte [eax]
idiv dword [ebp - 0x1707bebd]
neg esi
mov ah, 0x1a
lahf
loope 0x466662
xor edi, dword [ecx]
shl dword [ebx], 1
xor cl, byte [edx]
salc
sub al, 0xfc
insd dword es:[edi], dx
jnp 0x46658d
fdivr st(3), st(0)
in al, dx
sub dword [eax + 0x79], eax
fnop
lds esi, [edi - 0x2d]
fisub dword ss:[edx - 0x71]
mov ecx, 0xabccfbb5
push esi
wait
add byte [0xf3323a8e], 0x87
and al, 0x98
lcall 0x56f2, 0x2f6e53b8
mov bh, dh
and al, al
adc esi, dword [ecx + 0x49]
cmp edx, ebp
jo 0x4665d1
aad 0xc0
mov ch, 0xb7
mov bh, 0xbc
sub byte [0x6f757112], ah
mov bh, 0xbc
sub byte [0x6f757112], ah
and eax, 0x6f757112
clc
and byte [esi + 0xfb7be11], ah
fist word [ecx - 0x5f]
in al, dx
cli
xor edx, edi
adc dword [esi + 0x51df0fb7], edi
mov eax, dword [0xfa31faec]
pop ebx
jae 0x4666b8
jae 0x4665e0
jae 0x466632
fadd st(3)
jne 0x46662a
salc
sub ebx, ecx
imul ecx, dword [eax + 0x996a4fd], 0x2e
adc dword [edx], esp
or al, 0x2c
sbb al, 0x8d
mov al, byte [0x7f3b7023]
adc edx, edi
and esi, edx
pushal
inc eax
cmp byte [esi + 0x11], bh
and eax, 0x731e1294
cwde
in eax, 0xb3
dec ebx
out dx, al
sbb al, 0xda
or byte [esi - 0x25], ah
push 0xcc416e99
daa
shr esp, 1
jecxz 0x4666b6
cmp edi, dword [eax]
xchg ecx, eax
sub al, 0x15
invalid
xor dword [edx], edx
pop eax
invalid
xor eax, 0x5eaab0c6
mov al, 0xaa
pop esi
in al, dx
jmp 0x46faed
wait
insb byte es:[edi], dx
sbb ebp, dword [ebp + 0x1b05c38f]
psubb mm3, qword [esi - 0x3f]
xlatb
inc ecx
dec ebp
and ah, byte [eax - 0x75]
cld
pushal
in al, 0xdb
inc esi
ret 0xfa6a
Function at 0x469051
Capabilities:
Encode data using xor

Disassembly:
mov word [0xaaf83400], cs
aam 0x53
cmpsb byte [esi], byte es:[edi]
add dh, byte [0xbe42f903]
dec ebx
imul eax, dword [esp + eax + 0x647bbc94], 0xffffffd3
mov ecx, 0xa56f65ff
add byte [eax], bh
pop edi
sbb eax, 0x90180809
push edi
js 0x468f95
scasb al, byte es:[edi]
inc ecx
nop
pop esp
push eax
push ds
push ebx
pop ds
jbe 0x469029
and al, 0x8b
insb byte es:[edi], dx
adc eax, 0xd7440966
xlatb
xor byte [ebx], bh
in al, 0xc
pop eax
ljmp 0xded2
inc edi
je 0x468f8d
mov byte [esi + 0x43], ah
inc bx
mov ah, 0xc4
xor byte [eax - 0x32], al
jecxz 0x468fc6
inc ebx
jb 0x469004
mov ebp, 0x3863747f
inc ebx
mov ah, 0xc9
cmp ah, byte [ebp + 0x18]
std
mov eax, 0xc2271d89
adc dword [0x4c46bf82], 0x6b
adc esi, edi
bound esi, qword [ecx + eax*4 + 0x16c34bb4]
pop ecx
xchg ebx, eax
mov eax, 0x3602a86a
cmp al, 0x84
push ebx
pop esp
inc ebx
pushfd
enter 0xffffffffffff938a, 0xffffffffffffffb8
mov bl, 0xb8
shl ah, 0x1d
mov dh, 0x12
in eax, dx
movsd dword es:[edi], dword [esi]
je 0x469002
inc ebp
imul dword [ecx + 0x6b]
imul ebp, dword [ebx + 0x49], 0xa441a552
imul ebp, dword [ebx + 0x49], 0xa441a552
leave
in al, 0xc7
std
je 0x469017
pop edi
mov ebp, 0xe59fba9f
pop edi
test byte [edx - 0x47], 0x47
push 0xb9c05502
mov word [eax - 0x4f16df7c], ds
das
or bl, byte [esi]
push esp
push cs
mov dl, 0xd3
call 0xa8e0c238
invalid

Function at 0x49e926
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x206f1c9
push 0x3713ae35
xchg dword [edi - 0x597b39d6], eax
or edx, ecx
rcr dword [esi + ebp + 0x5e6c7d57], 1
scasd eax, dword es:[edi]
mov cl, 0xf8
xchg ecx, eax
xchg cl, dl
mov al, byte [0x1643d0ef]
mov gs, word [eax + 0x63]
test bl, 0xc
outsb dx, byte [esi]
jo 0x49e977
xor bl, byte cs:[eax - 7]
sal ecx, 1
xor dword [ebx - 0x4cc5a58], 0xfe8ab0bb
inc esi
js 0x49e953
pop ebx
sbb bl, byte [edx + 0x7694202e]
push esi
movsd dword es:[edi], dword [esi]
fmul qword [esi]
invalid
adc ebx, dword [edx + ebx*2 + 0x2149af08]
imul edx, dword [esi + 0x53c2eca6], 0xa9198741
sti
invalid

Function at 0x4b8186
Capabilities:
Encode data using xor

Disassembly:
or byte [edi + 0x76], 0xb1
xor eax, 0xde584ed1
and ebx, esp
add eax, 0x82ab6701
outsd dx, dword [esi]
invalid
Function at 0x4bb9f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43a8
cmp edx, dword [eax]
je 0x4bba1b
add eax, 8
inc ecx
cmp eax, 0x4c4438
jl 0x4bba0c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43a8]
jne 0x4bbb49
mov eax, dword [0x4c8d3c]
cmp eax, 1
je 0x4bbb23
test eax, eax
jne 0x4bba4c
cmp dword [0x4c42d0], 1
je 0x4bbb23
cmp edx, 0xfc
je 0x4bbb49
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bba83
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc3e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc870
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbac6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc870
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b7c
push edi
call fcn.004be740
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc3e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc3f0
lea eax, [ebp - 0xa0]
push 0x4c0b5c
push eax
call fcn.004bc3f0
push dword [esi + 0x4c43ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc3f0
push 0x12010
lea eax, [ebp - 0xa0]
test dword [eax - 1], esp
invalid
jmp [eax + 0x34]
or ecx, dword [eax + eax + 0x50]
call fcn.004be6b4
add esp, 0x2c
pop edi
jmp 0x4bbb49
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43ac]
push 0
push eax
push dword [esi]
call fcn.004bc870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x456130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x68], 0x276
mov dword [ebp - 8], 0x137
mov dword [ebp - 0x18], 0x30a
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x4c], 0x46
mov dword [ebp - 0x50], 0x3ac
mov dword [ebp - 0xc], 0x1b7
mov dword [ebp - 0x44], 0x1e6
mov dword [ebp - 0x5c], 0x157
mov dword [ebp - 0x24], 0x3e
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x54], 0x68
mov dword [ebp - 0x10], 0x234
mov dword [ebp - 0x40], 0x2a0
mov dword [ebp - 0x14], 0xbb
mov dword [ebp - 4], 0x23f
mov dword [ebp - 0x6c], 0xd7
mov dword [ebp - 0x58], 0x339
mov dword [ebp - 0x34], 0x2be
mov dword [ebp - 0x64], 0x2d6
mov dword [ebp - 0x48], 0x343
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x60], 0x3bb
mov dword [ebp - 0x70], 0xab
mov dword [ebp - 0x74], 0x26b
mov eax, dword [ebp - 8]
add eax, 0x15b
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040d9b0
add esp, 4
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x48]
jge 0x45624b
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x50]
jge 0x456215
mov dword [ebp - 0x2c], 1
jmp 0x45621c
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x54]
jge 0x45622d
mov dword [ebp - 0x30], 1
jmp 0x456234
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x2c]
and edx, dword [ebp - 0x58]
xor edx, dword [ebp - 0x5c]
or edx, dword [ebp - 0x30]
je 0x45624b
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4010a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x458ec9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x804
push ebp
mov ebp, ecx
mov dword [esp + 4], ebp
mov dword [ebp], 0x460830
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x810], 1
test eax, eax
jne 0x4011db
mov eax, dword [0x4730e0]
test eax, eax
je 0x4010f6
mov ecx, dword [0x4730e4]
test ecx, ecx
jne 0x4011cb
push esi
push edi
lea eax, [esp + 0x10]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x10]
push ecx
call edi
mov eax, dword [0x4730e8]
xor esi, esi
test eax, eax
jle 0x401133
lea edx, [esp + 0x10]
push edx
call edi
mov eax, dword [0x4730e8]
inc esi
cmp esi, eax
jl 0x401122
lea eax, [esp + 0x10]
push str.MiniUI.dll
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x10]
pop edi
test edx, edx
pop esi
je 0x401185
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401189
lea ecx, [esp + 8]
push ecx
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x401189
call fcn.00456be0
lea edx, [esp + 8]
push eax
push edx
call fcn.00456bf0
add esp, 8
xor eax, eax
jmp 0x401194
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x4730e4], eax
je 0x4011db
push str.GetMiniUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4730e0], eax
jne 0x4011cb
mov ecx, dword [0x4730e4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4730e4], 0
jmp 0x4011db
call eax
test eax, eax
je 0x4011db
mov edx, dword [eax]
lea ecx, [ebp + 0x44]
push ecx
push eax
call dword [edx + 0x58]
lea ecx, [ebp + 0x40]
mov byte [esp + 0x810], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, ebp
mov dword [esp + 0x810], 0xffffffff
call sub.MFC42u.DLL_CStatic::CStatic
mov ecx, dword [esp + 0x808]
pop ebp
mov dword fs:[0], ecx
add esp, 0x810
ret

Function at 0x401560
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40156d
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401598
push esi
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x401598
call fcn.00456be0
push eax
push esi
call fcn.00456bf0
add esp, 8
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x4029c0
Capabilities:
Accept command line arguments
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x459148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_4
xor ebx, ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041cfa0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0041d0d0
test eax, eax
je 0x402a13
mov esi, dword [esp + 0x38]
cmp esi, ebx
jne 0x402a46
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.0041d030
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea eax, [esp + 0x38]
push eax
call fcn.004217c0
add esp, 4
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 8]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x640d
mov dword [esp + 0x14], ecx
mov ecx, dword [eax - 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push ebx
lea edx, [ecx + ecx + 2]
push 0x4a
push esi
mov dword [esp + 0x20], edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.0041d030
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x403660
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x45918b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe30
push ebp
push esi
push edi
mov ebp, ecx
push 0
push str.MakeUserId
lea ecx, [esp + 0x424]
call fcn.00455e90
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x473100]
mov dword [esp + 0xe44], 0
test eax, eax
jne 0x403812
mov eax, dword [0x473104]
test eax, eax
jne 0x4037ab
lea eax, [esp + 0x63c]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x63c]
push ecx
call edi
mov eax, dword [0x473108]
xor esi, esi
test eax, eax
jle 0x40372e
lea edx, [esp + 0x63c]
push edx
call edi
mov eax, dword [0x473108]
inc esi
cmp esi, eax
jl 0x40371a
lea eax, [esp + 0x63c]
push str.360Common.dll
lea ecx, [esp + 0x640]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x63c]
test edx, edx
je 0x403790
lea eax, [esp + 0x63c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403794
lea ecx, [esp + 0x63c]
push ecx
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x403794
call fcn.00456be0
lea edx, [esp + 0x63c]
push eax
push edx
call fcn.00456bf0
add esp, 8
xor eax, eax
jmp 0x4037a2
lea eax, [esp + 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x473104], eax
je 0x403809
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Get360CommonInstance
push eax
call esi
mov ecx, dword [0x473104]
push str.Get360ProductHistoryManager
push ecx
mov dword [0x473100], eax
call esi
mov edx, dword [0x473104]
push str.Create360FireWareStateFunction
push edx
mov dword [0x4730fc], eax
call esi
mov dword [0x4730f8], eax
mov eax, dword [0x473104]
push str.GetFireWallState
push eax
call esi
mov ecx, dword [0x473104]
push str.Create360FireWareStateFunction2
push ecx
mov dword [0x4730f4], eax
call esi
mov dword [0x4730f0], eax
mov eax, dword [0x473100]
test eax, eax
je 0x40386d
call eax
test eax, eax
je 0x40386d
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
test esi, esi
je 0x40386d
mov eax, dword [esi]
lea ecx, [esp + 0x214]
push 0x104
push ecx
push esi
call dword [eax + 8]
mov edx, dword [esi]
lea eax, [esp + 0xc]
push 0x104
push eax
push esi
call dword [edx]
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
lea edx, [esp + 0x214]
lea ecx, [esp + 0xc]
push edx
push ecx
push eax
add ebp, 0xc4
push str.uid_dpid_sm_s
push ebp
call sub.MFC42u.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x41c]
mov dword [esp + 0xe44], 0xffffffff
call fcn.00455fc0
mov ecx, dword [esp + 0xe3c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xe3c
ret
Function at 0x4049f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4594d8
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x404a63
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x404a63
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [esp + 4]
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404a63
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x1c]
push 5
push str._repairmain
push edx
mov dword [esp + 0x20], 0
call fcn.004204a0
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4