joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486e95
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x6c45ac]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [esp + 8], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
push edi
cmp eax, 0x67
jne 0x486f2a
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 2
movzx edi, ax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xf
or ax, di
pop ecx
bt ax, cx
jb 0x486edf
push 0x67
jmp 0x486f3f
call dword [sym.imp.USER32.dll_GetMessagePos]
mov ecx, dword [ebx + 0x28]
movsx edx, ax
sub edx, dword [ebx + 0xf4]
shr eax, 0x10
cwde
sub eax, dword [ebx + 0xf8]
mov dword [ebx + 0x16c], edx
mov dword [ebx + 0x170], eax
test ecx, ecx
je 0x487015
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov eax, dword [ecx]
push edx
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x487015
cmp eax, 0x68
je 0x487015
cmp eax, 0x69
jne 0x486f4d
mov eax, dword [ebx]
call dword [eax + 0x44]
push 0x69
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x487015
cmp eax, 0x6a
jne 0x486f62
call fcn.00431d52
mov dword [ebx + 0x168], eax
jmp 0x487015
cmp eax, 0x6b
jne 0x486f98
push 0x5f8
push str.BaseWallPaperFrame::OnTimer
push str.__s__d___OnTimer_TIMER_RESTART_WORKER_n
call fcn.0040a649
add esp, 0xc
push 0x6b
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
push ecx
xor edx, edx
push 2
inc edx
pop ecx
call fcn.004d34f4
pop ecx
jmp 0x487015
cmp eax, 0x6c
jne 0x487015
push 0x5fe
push str.BaseWallPaperFrame::OnTimer
push str.__s__d___OnTimer_TIMER_START_EMPTY_WORKER_n
call fcn.0040a649
add esp, 0xc
push 0x6c
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebx + 0x110], 0
je 0x486ffd
sub esp, 0x18
lea eax, [ebx + 0x100]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [esp + 0x2c]
call fcn.00430aaf
add esp, 0x18
mov ecx, eax
call fcn.004c51cf
lea ecx, [esp + 0x14]
call fcn.0040b67b
and dword [ebx + 0x110], 0
add ebx, 0x100
cmp dword [ebx + 0x14], 0x10
jb 0x487012
mov ebx, dword [ebx]
mov byte [ebx], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
pop edi
pop ebx
and dword [eax], 0
xor ecx, esp
xor eax, eax
call fcn.00590be8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48772f
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x48776d
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x73e
push str.BaseWallPaperFrame::OnClickClose
push str.__s__d___OnClick_Close
call fcn.0040a649
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x488fd9
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x34
mov eax, 0x5d8b42
call fcn.00592017
push 0x208
xor ebx, ebx
push ebx
push 0x6d5dd0
call fcn.005a88e0
mov eax, dword [ebp + 8]
mov dword [0x6d61e0], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
push str.InstallPath
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425d05
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push 8
pop edi
cmp dword [ebp - 0x18], ebx
je 0x489091
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x489091
push 0x64cf18
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0041154b
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67b
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0x489091
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x4890cc
push dword [0x6d61e0]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str._schromeshell_d
push 0x103
push 0x6d5dd0
call fcn.00412a05
add esp, 0x14
jmp 0x489101
lea ecx, [ebp - 0x40]
call fcn.004250d3
cmp dword [eax + 0x14], edi
jb 0x4890db
mov eax, dword [eax]
push dword [0x6d61e0]
push eax
push str._schromeshell_d
push 0x103
push 0x6d5dd0
call fcn.00412a05
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.0040b67b
lea ecx, [ebp - 0x28]
call fcn.0040b67b
call fcn.00591fc1
ret 4
Function at 0x489117
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x34
mov eax, 0x5d8b42
call fcn.00592017
mov esi, dword [ebp + 8]
xor eax, eax
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
mov edx, str.Software360360huabao
lea eax, [ebp - 0x28]
mov ecx, reloc.WS2_32.dll_accept
push eax
push str.InstallPath
call fcn.00425d05
cmp dword [ebp - 0x18], 0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
push 8
pop ebx
je 0x4891ba
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x4891ba
push 0x64cf18
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0041154b
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67b
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x4891ba
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
push 0
push 0x6d5dd0
call fcn.005a88e0
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x48920b
cmp dword [esi + 0x14], ebx
jb 0x4891e6
mov esi, dword [esi]
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
push str._schromeshell_s
push 0x103
push 0x6d5dd0
call fcn.00412a05
add esp, 0x14
jmp 0x489242
lea ecx, [ebp - 0x40]
call fcn.004250d3
cmp dword [esi + 0x14], ebx
jb 0x48921a
mov esi, dword [esi]
cmp dword [eax + 0x14], ebx
jb 0x489221
mov eax, dword [eax]
push esi
push eax
push str._schromeshell_s
push 0x103
push 0x6d5dd0
call fcn.00412a05
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.0040b67b
lea ecx, [ebp - 0x28]
call fcn.0040b67b
call fcn.00591fc1
ret 4

Function at 0x489368
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x81c]
test eax, eax
je 0x48937d
mov ecx, eax
pop ebp
jmp fcn.004954ab
mov eax, dword [ecx + 0x820]
test eax, eax
je 0x48938f
mov ecx, eax
pop ebp
jmp fcn.0049cf4d
mov eax, dword [ecx + 0x828]
test eax, eax
je 0x4893a1
mov ecx, eax
pop ebp
jmp fcn.00482f39
mov eax, dword [ecx + 0x824]
test eax, eax
jne 0x489399
mov eax, dword [ecx + 0x830]
test eax, eax
je 0x4893bd
mov ecx, eax
pop ebp
jmp fcn.004634a1
mov eax, dword [ecx + 0x82c]
test eax, eax
je 0x4893cf
mov ecx, eax
pop ebp
jmp fcn.0048ba6b
mov ecx, dword [ecx + 0x838]
test ecx, ecx
jne 0x48939b
pop ebp
ret 0x10
Function at 0x4899db
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x28], 0
mov dword [esi], vtable.HuabaoActivateMainWnd.1.0
mov dword [esi + 4], vtable.HuabaoActivateMainWnd.0
je 0x4899f6
and dword [esi + 0x28], 0
lea edi, [esi + 0x1a8]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x489a06
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x489a22
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x489a1b
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x1dc]
call fcn.00404812
lea ecx, [esi + 0x1c4]
call fcn.0040b67b
mov ecx, edi
call fcn.0040b67b
lea ecx, [esi + 0x190]
call fcn.0040b67b
pop edi
mov ecx, esi
pop esi
jmp fcn.00482da3
Function at 0x48bf01
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x48bf28
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x48ca18
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
call fcn.005b9a0a
pop ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x6284e4
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ca6c
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push 0
push str.rd_popup_time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x48ca6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
xor ebx, ebx
push ebx
call fcn.005b9a0a
pop ecx
push 4
mov edi, eax
mov dword [ebp - 0x1c], edx
pop eax
mov dword [ebp - 0x14], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x6284e4
push reloc.WS2_32.dll_accept
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 0xb
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48cac8
mov al, 1
jmp 0x48cb22
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.rd_popup_time
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.total_duration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
imul ecx, dword [ebp - 8], 0x3c
xor eax, eax
add ecx, dword [ebp - 0x24]
adc eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jl 0x48cb20
jg 0x48cb1e
cmp edi, ecx
jbe 0x48cb20
mov bl, 1
mov al, bl
pop edi
pop ebx
leave
ret

Function at 0x48cb26
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 8], 0
mov esi, eax
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x6284e4
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48cb65
mov al, 1
jmp 0x48cb96
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.boot_duration
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
imul eax, dword [ebp - 8], 0xea60
cmp esi, eax
seta al
pop esi
leave
ret
Function at 0x48cb99
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, str.Q360_SE_SAFE_PopupWindowMutex
xor edi, edi
push ebx
push edi
push 0x1f0001
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi + 0x64], eax
test eax, eax
je 0x48cbc7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x64], edi
xor al, al
jmp 0x48cbeb
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x64], eax
test eax, eax
je 0x48cbc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x48cbe9
push dword [esi + 0x64]
jmp 0x48cbba
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x49696f
Capabilities:
Get common file path
Get disk size

Disassembly:
push 0x260
mov eax, 0x5e4ce1
call fcn.00592017
mov edi, ecx
call fcn.00427402
test eax, eax
jne 0x496b8b
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x218], bx
je 0x496b8b
cmp word [ebp - 0x216], bx
je 0x496b8b
xor eax, eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x26c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x496b8b
mov esi, dword [ebp - 0x26c]
lea ecx, [ebp - 0x230]
mov eax, dword [ebp - 0x268]
shrd esi, eax, 0x14
push 0x6284b4
call fcn.0040b0d5
mov dword [ebp - 4], ebx
test esi, esi
jle 0x496a2d
cmp esi, 0x1f4
jg 0x496a35
mov esi, 0x628d2c
jmp 0x496a68
cmp esi, 0x1f4
jle 0x496a44
cmp esi, 0x400
jg 0x496a4c
mov esi, 0x63a8c4
jmp 0x496a68
cmp esi, 0x400
jle 0x496a5b
cmp esi, 0x2000
jg 0x496a63
mov esi, 0x641b60
jmp 0x496a68
cmp esi, 0x2000
jle 0x496a7c
mov esi, 0x641b64
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040b566
mov eax, dword [0x6c4fd4]
mov dword [ebp - 0x264], eax
push ebx
mov byte [ebp - 4], 1
call fcn.005b9a0a
push edx
push eax
lea eax, [ebp - 0x264]
push 0x62f1d0
push eax
call fcn.00414045
add esp, 0x14
lea ecx, [ebp - 0x264]
push ebx
call fcn.00413c3f
push eax
lea ecx, [ebp - 0x260]
call fcn.0040b0d5
push eax
push str.ReqDate
mov edx, str.Software360360huabaohuabao
call fcn.00425fbf
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
call fcn.0040b67b
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push str.https:__dd.browser.360.cn_static_a_1287.6321.gif__referer
push eax
call fcn.00440e2c
add esp, 0xc
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x154]
cmp eax, 2
jne 0x496b3a
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x260]
push str.https:__dd.browser.360.cn_static_a_1317.1463.gif__referer
push eax
call fcn.00440e2c
add esp, 0xc
lea ecx, [ebp - 0x248]
push eax
call fcn.0040b0ac
lea ecx, [ebp - 0x260]
call fcn.0040b67b
jmp 0x496b58
cmp eax, 5
jne 0x496b58
mov esi, str.pid360hb_core_safe
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.0040b220
push 1
push ebx
mov dl, 1
lea ecx, [ebp - 0x248]
call fcn.004c4bab
pop ecx
pop ecx
lea ecx, [ebp - 0x248]
call fcn.0040b67b
lea ecx, [ebp - 0x264]
call fcn.0040a4ed
lea ecx, [ebp - 0x230]
call fcn.0040b67b
call fcn.00591fc1
ret
Function at 0x49945b
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5e518b
call fcn.00592017
mov esi, ecx
and dword [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
call fcn.004ca953
cmp dword [eax + 0x14], 8
jb 0x49947d
mov eax, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
xor ebx, ebx
inc ebx
test eax, eax
jne 0x499499
call fcn.004ca472
mov byte [ebp - 0x5d], bl
test eax, eax
je 0x49949d
mov byte [ebp - 0x5d], 0
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
cmp byte [ebp - 0x5d], 0
je 0x4994cd
push 0xd0f
push str.ScreenSaverFrame::Init360inidll
push str.__s__d___Init360inidll_retry
mov byte [esi + 0x148], bl
call fcn.0040a649
add esp, 0xc
jmp 0x4995be
push 0x3f1
push dword [esi + 0xc]
mov byte [esi + 0x148], 0
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 0x44]
call fcn.004ca953
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
push 2
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
jb 0x4994ff
mov eax, dword [eax]
push eax
call edi
test eax, eax
je 0x499528
lea ecx, [ebp - 0x2c]
call fcn.004ca953
mov dword [ebp - 0x64], 6
cmp dword [eax + 0x14], 8
jb 0x49951d
mov eax, dword [eax]
push eax
call fcn.004302c4
pop ecx
test eax, eax
jne 0x49952a
xor bl, bl
test byte [ebp - 0x64], 4
je 0x499538
lea ecx, [ebp - 0x2c]
call fcn.0040b67b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0040b67b
test bl, bl
je 0x4995be
push 0xd17
mov edi, str.ScreenSaverFrame::Init360inidll
push edi
push str.__s__d___start_LoadLibraryExW_ini
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.004ca953
cmp dword [eax + 0x14], 8
jb 0x499570
mov eax, dword [eax]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x108], eax
call fcn.0040b67b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xd1a
push edi
push str.__s__d___LoadLibraryExW_status_d
call fcn.0040a649
mov eax, dword [esi + 0x108]
add esp, 0x10
test eax, eax
je 0x4995be
push str.IsSafeExist
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e1d6c], eax
call fcn.00591fc1
ret

Function at 0x4996f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
mov esi, ecx
call fcn.004ca993
xor edi, edi
lea eax, [esp + 0xc]
push eax
push edi
push edi
push 0x499634
push edi
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xd49
push str.ScreenSaverFrame::DownLoadAndInstall
push str.__s__d___DownLoadAndInstall_onclose
mov dword [esi + 0x14c], eax
call fcn.0040a649
add esp, 0xc
mov ecx, esi
push edi
call fcn.0049b14b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x499d3f
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ecx + 0x4c]
push esi
test ecx, ecx
je 0x499de0
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
test esi, esi
je 0x499d8d
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x499d8d
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x499d8d
push 0xe43
mov esi, str.ScreenSaverFrame::ReCheckProcess
push esi
push str.__s__d___ReCheckProcess_wnd_ok
call fcn.0040a649
add esp, 0xc
xor eax, eax
mov dword [0x6e25c8], eax
jmp 0x499db6
mov eax, dword [0x6e25c8]
mov esi, str.ScreenSaverFrame::ReCheckProcess
inc eax
push eax
push 0xe3f
push esi
push str.__s__d___ReCheckProcess_wnd_error_count_d
mov dword [0x6e25c8], eax
call fcn.0040a649
mov eax, dword [0x6e25c8]
add esp, 0x10
cmp eax, 5
jne 0x499de0
push 0xe48
push esi
push str.__s__d___exit_process
call fcn.0040a649
add esp, 0xc
push 0x29a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x49b356
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
push 3
push ebx
push ebx
push ebx
push ebx
cmp dword [0x6cfc04], ebx
je 0x49b377
push 1
jmp 0x49b379
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esi + 0x5c], 0
je 0x49b39a
cmp dword [esi + 0x5c], 1
je 0x49b39a
call fcn.00426bb9
cmp eax, 7
je 0x49b428
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x49b413
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x49b413
cmp ecx, edi
je 0x49b413
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x49b413
push esi
push eax
push edi
push ecx
push 0x10c0
push str.ScreenSaverFrame::SetForegroundWindowInternal
push str._wndtop:_s__d__SetForegroundWindowInternal_hCurWnd__0x_x_hWnd_0x_x_dwMyID_d_dwCurID_d_
call fcn.0040a649
add esp, 0x1c
push 1
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
call esi
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call esi
jmp 0x49b428
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x49b52c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x110f
push str.MayBeShowExitPopupAsnc
push str.__s__d__ExitPreviewAsnc
mov esi, ecx
call fcn.0040a649
push 4
call fcn.00590c07
xor edx, edx
lea ecx, [ebp - 4]
push ecx
push edx
push eax
push 0x49b4db
push edx
mov dword [eax], esi
push edx
mov dword [ebp - 4], edx
call fcn.005b953f
add esp, 0x28
pop esi
leave
ret

Function at 0x49d340
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x49d367
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x49f09e
Capabilities:
Delete file

Disassembly:
push 0x54
mov eax, 0x5e5ac3
call fcn.00592017
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x50], 0x226
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x4c], 0x136
jb 0x49f0cc
mov eax, dword [esi]
push eax
push 0x1ac
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_strSrc___s
call fcn.0040a649
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x49f0ec
mov esi, dword [esi]
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.0049efea
mov ebx, eax
mov dword [ebp - 0x4c], ebx
test ebx, ebx
je 0x49f24a
push 0x1af
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_ok
call fcn.0040a649
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
add esp, 0xc
mov dword [ebp - 0x60], vtable.Gdiplus::Bitmap.0
push eax
push 0
push ebx
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x40], ecx
xor edx, edx
lea eax, [ebp - 0x40]
inc edx
push eax
push edx
push ecx
mov byte [ebp - 4], dl
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea edx, [ebp - 0x38]
call fcn.004cbdb3
test al, al
je 0x49f229
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
push esi
call dword [sym.imp.gdiplus.dll_GdipSaveImageToStream]
test eax, eax
je 0x49f17e
mov dword [ebp - 0x58], eax
jmp 0x49f180
xor eax, eax
test eax, eax
jne 0x49f229
and dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x65781c
mov edx, edi
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.0041154b
pop ecx
mov byte [ebp - 4], 2
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x3c]
cmovae esi, dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalSize]
call edi
push eax
push esi
push 0x1be
push str.HuabaoMainFrame::GenVideoImg
push str.__s__d___GenVideoImg_getEncoderClsid__s_GlobalSize_d
call fcn.0040a649
add esp, 0x14
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae esi, dword [ebp - 0x28]
push dword [ebp - 0x3c]
call edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.0041e2e8
pop ecx
mov ecx, dword [ebp - 0x48]
test eax, eax
push 1
pop eax
push dword [ebp - 0x3c]
movzx ecx, cl
cmovne ecx, eax
mov dword [ebp - 0x48], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x28]
call fcn.0040b67b
mov ebx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x44]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x49f241
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
jmp 0x49f259
cmp dword [edi + 0x14], 8
jb 0x49f252
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x48]
call fcn.00591fc1
ret 8