joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459b51
Capabilities:
Accept command line arguments

Disassembly:
push 4
mov eax, 0x5dfdb6
call fcn.00593ad3
mov edi, 0x6e50f8
mov dword [ebp - 0x10], edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [0x6e50f8], 0x63a55c
mov dword [0x6e50fc], ebx
mov dword [0x6e5110], ebx
mov dword [0x6e5114], 7
mov word [0x6e5100], ax
push 0xf
pop esi
mov dword [0x6e5128], ebx
mov dword [0x6e512c], esi
mov byte [0x6e5118], bl
mov dword [0x6e5140], ebx
mov dword [0x6e5144], esi
mov byte [0x6e5130], bl
mov dword [0x6e5158], ebx
mov dword [0x6e515c], esi
mov byte [0x6e5148], bl
push 0x400
push ebx
push 0x6e5164
mov dword [0x6e5160], ebx
call fcn.005aa3d0
add esp, 0xc
mov byte [0x6e5564], bl
mov dword [0x6e5578], ebx
mov dword [0x6e557c], esi
mov byte [0x6e5568], bl
mov dword [0x6e5590], ebx
mov dword [0x6e5594], esi
mov byte [0x6e5580], bl
mov dword [0x6e55a8], ebx
mov dword [0x6e55ac], esi
mov byte [0x6e5598], bl
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00459af3
mov ecx, eax
call fcn.00412ba9
mov esi, str._script__nwindow.wallpaperRegisterAudioListener__function_listener__nwindow._updateAudioData__function_data___ndata__data.split____ndata__data.map_function_item_return_item1__nif__data_0____0___console.log_audioData:1___else__console.log_audioData2_listener_data__n__script__n_script__nfunction_dispatchMouseEvent_event__x__y___nlet_ele__document.elementFromPoint_x__y__nif__ele___nlet_evt__document.createEvent_MouseEvent__nevt.initMouseEvent_event__true__false__window__0__x__y__x__y__nele.dispatchEvent_evt__n__script__n
push esi
call fcn.005ae8e0
pop ecx
push eax
push esi
mov ecx, 0x6e5580
call fcn.0040464f
mov esi, str._script__nexternal.AppCmd_external.GetSID_window__wallpaper_getuserproperties____nfunction__len__msg___nvar_obj__JSON.parse_msg__nwallpaperPropertyListener.applyUserProperties_obj_____n__script__n
push esi
call fcn.005ae8e0
pop ecx
push eax
push esi
mov ecx, 0x6e5598
call fcn.0040464f
mov eax, edi
call fcn.00593a9c
ret
Function at 0x45a2f2
Capabilities:
Check if file exists

Disassembly:
push 0x26c
mov eax, 0x5dfed4
call fcn.00593b07
push 0x62e5e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x45a32d
push 0x54
push str.RenderEngineHelper::LoadRenderEngine
push str.__s__d___Load_360hbengine.dll_is_exist
call fcn.0040a649
add esp, 0xc
mov eax, esi
jmp 0x45a4d2
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x278]
mov dword [ebp - 4], ebx
call fcn.0045a27a
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.0045a0db
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 3
call fcn.0040b67e
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a3ac
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.00413220
jmp 0x45a479
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push 0x62a720
push eax
call esi
lea ecx, [ebp - 0x260]
call fcn.004ccf79
mov byte [ebp - 4], 4
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
cmovae eax, dword [ebp - 0x260]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
push 0x62e5e8
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a46e
lea eax, [ebp - 0x218]
push eax
push 0x6b
push str.RenderEngineHelper::LoadRenderEngine
push str.__s__d___Load_360hbengine.dll_file_is_not_exist__path_:__s
call fcn.0040a649
lea eax, [ebp - 0x218]
push eax
call fcn.005baec0
add esp, 0x14
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040b566
lea ecx, [ebp - 0x260]
call fcn.0040b67e
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.0040b67e
cmp dword [ebp - 0x220], 0
je 0x45a4c5
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x45a4c5
push 0x77
push str.RenderEngineHelper::LoadRenderEngine
push str.__s__d___Load_360hbengine.dll_fail
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.0040b67e
mov eax, ebx
call fcn.00593ab1
ret
Function at 0x45ae4d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp ecx, ebx
ja 0x45ae83
jb 0x45ae79
cmp eax, esi
jae 0x45ae83
mov eax, esi
mov ecx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
push ebx
push eax
push ecx
push 2
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 8], eax
test eax, eax
jne 0x45aea0
call fcn.0045e621
jmp 0x45aee4
push 4
pop eax
push ebx
test esi, esi
cmove esi, dword [ebp - 8]
mov dword [edi + 4], esi
push dword [edi + 4]
mov dword [edi + 0x18], eax
push ebx
push ebx
push eax
push dword [edi + 8]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi], eax
test eax, eax
jne 0x45aee2
call fcn.0045e621
push dword [edi + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, esi
jmp 0x45aee4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x45b700
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45b785
cmp dword [ebp + 0xc], 0x104
jne 0x45b75b
cmp dword [ebp + 0x10], 0x73
jne 0x45b75b
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x45b75b
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, dword [ebp + 8]
jne 0x45b74a
push 0xdb
push str.WorkerRenderFrame::DidProcessEvent
push str.__s__d___DidProcessEvent_close
call fcn.0040a649
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x45b785
cmp dword [0x6d2c58], 0
je 0x45b785
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x45b785
cmp dword [ebp + 0x10], 0x7b
jne 0x45b785
mov ecx, dword [esi + 0x14]
push 0
push 4
mov eax, dword [ecx]
call dword [eax + 0x5c]
pop esi
pop ebp
ret 0x10
Function at 0x45e857
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x14], 0x10
push ebx
mov bl, dl
jb 0x45e865
mov ecx, dword [ecx]
mov edx, ecx
mov ecx, 0xfbc
call fcn.0045e7dc
push 0x85
push str.WallpaperHelper::StopWorkerWnd
push str.__s__d___SendWorkerMsg:MSG_COPYDATA_CLOSE
call fcn.0040a649
add esp, 0xc
test bl, bl
je 0x45e896
mov cl, byte [ebp + 8]
pop ebx
pop ebp
jmp fcn.0045ea04
pop ebx
pop ebp
ret
Function at 0x45ef6e
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push edx
mov esi, ecx
push 0
mov dword [ebp - 0x210], esi
push 0x1fffff
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x45effb
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x103
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x45efeb
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x45effb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
jmp 0x45f000
push 0x62a4ac
mov ecx, esi
call fcn.0040b0d5
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.005926d8
leave
ret

Function at 0x45f0f4
Capabilities:
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x20]
push ebx
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0
lea ebx, [esi - 1]
mov dword [ebp - 0x34], eax
push ebx
call dword [sym.imp.USER32.dll_WindowFromPoint]
lea esi, [edi - 1]
mov dword [ebp - 0x38], eax
mov edi, dword [sym.imp.USER32.dll_WindowFromPoint]
push esi
push 0
call edi
push esi
push ebx
mov dword [ebp - 0x3c], eax
call edi
mov edi, dword [ebp - 0x34]
mov esi, eax
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push eax
push edi
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x38]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call ebx
lea eax, [ebp - 0x30]
push eax
push esi
call ebx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x24]
jne 0x45f1ec
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], eax
jne 0x45f1ec
cmp eax, dword [ebp - 0x30]
jne 0x45f1ec
mov ecx, edi
call fcn.0045f01c
test eax, eax
jne 0x45f1ec
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.USER32.dll_GetShellWindow]
mov ebx, eax
lea edi, [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [ebp - 0x34]
call edi
lea eax, [ebp - 0xc]
push eax
push esi
call edi
lea eax, [ebp - 8]
push eax
push ebx
call edi
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x45f1ec
cmp eax, dword [ebp - 8]
je 0x45f1ec
xor eax, eax
inc eax
jmp 0x45f1ee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005926d8
leave
ret
Function at 0x460bff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d8d30
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6c75ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x7ed], 0
mov dword [esi], vtable.WorkerWnd.6.0
mov dword [esi + 0x10], vtable.WorkerWnd.5.0
mov dword [esi + 0x20], vtable.WorkerWnd.4.0
mov dword [esi + 0x24], vtable.WorkerWnd.3.0
mov dword [esi + 0x28], vtable.WorkerWnd.2.0
mov dword [esi + 0x2c], vtable.WorkerWnd.1.0
mov dword [esi + 0x6d8], 0x63f13c
jne 0x460cb7
call fcn.00458847
test al, al
jne 0x460cb7
mov eax, dword [esi + 0x844]
test eax, eax
je 0x460c91
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 0x844]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [esi + 0x840]
test edi, edi
je 0x460cb7
cmp dword [esi + 4], 0
je 0x460cae
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, edi
jne 0x460cb7
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1ab
push str.WorkerWnd::WorkerWnd
push str.__s__d__destroy_worker
call fcn.0040a649
add esp, 0xc
cmp byte [esi + 0x7c5], 0
je 0x460cef
mov ecx, dword [esi + 0x7c8]
test ecx, ecx
je 0x460cef
mov eax, dword [ecx]
push 1
call dword [eax + 0x14]
and dword [esi + 0x7c8], 0
mov ecx, dword [esi + 0x6dc]
test ecx, ecx
je 0x460cfe
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [esi + 0x6e0]
test ecx, ecx
je 0x460d0d
mov eax, dword [ecx]
call dword [eax + 0x34]
lea ecx, [esi + 0x824]
call fcn.0040b67e
lea ecx, [esi + 0x80c]
call fcn.0040b67e
lea ecx, [esi + 0x7f0]
call fcn.0040b67e
lea ecx, [esi + 0x7cc]
call fcn.0040b67e
lea ecx, [esi + 0x7b8]
call fcn.0044449d
lea ecx, [esi + 0x79c]
call fcn.0040b67e
lea ecx, [esi + 0x71c]
call fcn.0045a894
lea ecx, [esi + 0x6ec]
call fcn.0040b67e
mov ecx, esi
call sym.360huabao.exe_public_virtual:_void___thiscall_DuiLib::WindowImplBase::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x463f91
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x6c75ac]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
and dword [esp + 0xc], 0
lea edx, [esp + 0xc]
mov ebx, eax
mov ecx, ebx
call fcn.0043128e
mov esi, dword [esp + 0xc]
push esi
push ebx
push 0x61f
push str.WorkerWnd::GetCpuUseage
push str.__s__d___GetCpuUseage_dwProcessId_d_dwCpu_d
call fcn.0040a649
add esp, 0x14
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x463ffb
xor eax, eax
jmp 0x464092
push 0x228
lea eax, [esp + 0x18]
push 0
push eax
call fcn.005aa3d0
add esp, 0xc
mov dword [esp + 0x10], 0x22c
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x46406c
cmp dword [esp + 0x28], ebx
jne 0x464060
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
and dword [esp + 0xc], 0
call fcn.0043128e
push dword [esp + 0xc]
push dword [esp + 0x1c]
push 0x62e
push str.WorkerWnd::GetCpuUseage
push str.__s__d___GetCpuUseage_dwProcessId_d_dwCpu_d
call fcn.0040a649
add esp, 0x14
add esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x464025
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push 0x634
push str.WorkerWnd::GetCpuUseage
push str.__s__d___total_GetCpuUseage_dwProcessId_d_dwCpu_d
call fcn.0040a649
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005926d8
mov esp, ebp
pop ebp
ret
Function at 0x465a6e
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0x3c
mov eax, 0x5e122a
call fcn.00593b07
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x48], 0x6e60b0
mov dword [0x6e60b4], ebx
mov dword [0x6e60c4], ebx
mov dword [0x6e60c8], ebx
mov dword [0x6e60cc], ebx
mov dword [0x6e60d0], eax
mov dword [ebp - 4], ebx
mov eax, dword [0x6c7fd4]
mov dword [0x6e60b0], 0x640608
mov dword [0x6e60d4], ebx
mov dword [0x6e60e8], eax
mov dword [0x6e60ec], ebx
mov dword [0x6e60f0], eax
push ebx
mov byte [ebp - 4], 2
push ebx
mov dword [0x6e60f4], ebx
mov dword [0x6e60f8], ebx
call fcn.00467443
mov dword [0x6e60f4], eax
mov eax, dword [0x6c7fd4]
mov byte [0x6e6108], bl
mov dword [0x6e610c], eax
push ebx
mov byte [ebp - 4], 4
push ebx
mov dword [0x6e6110], ebx
mov dword [0x6e6114], ebx
call fcn.00467443
mov dword [0x6e6110], eax
push 0x94
mov esi, str.C360SafeHbMgr::C360SafeHbMgr
mov byte [ebp - 4], 5
push esi
push str.__s__d___C360SafeHbMgr::ready_go___________
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x44]
mov edi, 0x63f29c
mov edx, edi
call fcn.0043746a
push ebx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00413c42
push eax
lea ecx, [ebp - 0x40]
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.004c2598
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], ebx
je 0x465c08
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
push 8
pop edi
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], edi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
push 0x9c
push esi
push str.__s__d____strSrc___s_strPath___s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x465c08
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
push ebx
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], edi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x465bf5
push 0xa1
push esi
push str.__s__d___CopyFile_success
jmp 0x465c00
push 0xa5
push esi
push str.__s__d___CopyFile_failed
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x44]
call fcn.0040a4ed
mov eax, 0x6e60b0
call fcn.00593ab1
ret
Function at 0x465cc6
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x5e1265
call fcn.00593b07
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x21c], esi
push 0x208
xor ebx, ebx
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test edi, edi
je 0x465d64
push edi
lea ecx, [ebp - 0x21c]
call fcn.004233d2
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x220]
call fcn.004233d2
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x220]
mov ecx, esi
call fcn.004360db
pop ecx
lea ecx, [ebp - 0x220]
call fcn.0040a4ed
lea ecx, [ebp - 0x21c]
call fcn.0040a4ed
jmp 0x465d72
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004233d2
mov eax, esi
call fcn.00593ab1
ret

Function at 0x466a6c
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x5e1379
call fcn.00593b07
mov esi, dword [ebp + 8]
call fcn.004c827a
test al, al
jne 0x466aa0
push 0x231
push str.C360SafeHbMgr::RunDesktopRest
push str.__s__d__CanShowSafeHuabao_return
call fcn.0040a649
add esp, 0xc
jmp 0x466b66
push esi
lea ecx, [ebp - 0x4c]
call fcn.004233d2
xor edi, edi
lea ecx, [ebp - 0x48]
mov edx, str.UtilsDesktopRestDesktopRest.exe
mov dword [ebp - 4], edi
call fcn.0043746a
mov byte [ebp - 4], 1
mov ebx, edi
mov esi, dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466b39
push esi
call fcn.004302c7
pop ecx
test eax, eax
je 0x466b39
push edi
lea ecx, [ebp - 0x48]
inc ebx
call fcn.00413c42
push eax
lea ecx, [ebp - 0x44]
call fcn.0040b0d5
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00413c42
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d5
push edi
push edi
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.004c54b5
pop ecx
pop ecx
test eax, eax
jne 0x466b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040b67e
mov esi, dword [ebp - 0x48]
push esi
push edi
push ebx
push dword [ebp - 0x4c]
push 0x245
push str.C360SafeHbMgr::RunDesktopRest
push str.__s__d___param__s__hasfile__d__err__d__exe__s_
call fcn.0040a649
add esp, 0x1c
lea ecx, [ebp - 0x48]
call fcn.0040a4ed
lea ecx, [ebp - 0x4c]
call fcn.0040a4ed
call fcn.00593ab1
ret 4
Function at 0x466b8a
Capabilities:
Read .ini file

Disassembly:
push 0x218
mov eax, 0x5e13a9
call fcn.00593b07
mov edi, ecx
mov esi, dword [0x6c7fd4]
mov dword [ebp - 0x21c], esi
xor ebx, ebx
lea eax, [ebp - 0x218]
push 0x208
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [edi + 0x38]
push 0x104
push eax
push 0x63feb0
push str.EyeLastGamma
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2a
pop eax
cmp ax, word [ebp - 0x218]
je 0x466c17
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040a358
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 8], ebx
je 0x466c50
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], ebx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], ebx
push eax
push str._d__d
push esi
call fcn.0040a1c3
xor ebx, ebx
add esp, 0x10
cmp dword [ebp - 0x220], 1
sete bl
lea ecx, [ebp - 0x21c]
call fcn.0040a4ed
mov eax, ebx
call fcn.00593ab1
ret

Function at 0x466ef4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
mov esi, ecx
lea eax, [ebp - 0x20c]
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
mov dword [ebp - 0x210], esi
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360desktoplite.exe
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x466f92
lea eax, [ebp - 0x218]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0x206
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push 0x62a4ac
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004233d2
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.005926d8
leave
ret

Function at 0x467a11
Capabilities:
Change user account password

Disassembly:
mov eax, 0x62a4ac
push eax
push eax
push 0
push 0
call dword [sym.imp.NETAPI32.dll_NetUserChangePassword]
mov ecx, eax
test ecx, ecx
je 0x467a3a
cmp ecx, 0x8c5
je 0x467a3a
xor eax, eax
cmp ecx, 0x56
sete al
dec eax
ret
xor eax, eax
inc eax
ret
Function at 0x467a79
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push str.CheckPwdTime
mov edx, str.Software360360huabao
movlpd qword [esp + 0x20], xmm0
call fcn.004260c4
xor ebx, ebx
mov esi, str._anonymous_namespace::InitHaveSystem
pop ecx
pop ecx
cmp dword [esp + 0x1c], ebx
jl 0x467af1
jg 0x467ab9
cmp dword [esp + 0x18], ebx
jbe 0x467af1
push ebx
call fcn.005bb4fa
sub eax, dword [esp + 0x1c]
pop ecx
sbb edx, dword [esp + 0x1c]
cmp edx, ebx
jg 0x467b04
jl 0x467ad5
cmp eax, 0x13c680
jae 0x467b04
push 0xa9
push str._anonymous_namespace::InitHaveSystem
push str.__s__d___HealthMgr::check_pwd_in_interval
call fcn.0040a649
add esp, 0xc
jmp 0x467bae
push 0xaf
push esi
push str.__s__d___HealthMgr::check_pwd_not_in_interval
call fcn.0040a649
add esp, 0xc
push 0xb2
push esi
push str.__s__d___HealthMgr::has_system_screen_saver
call fcn.0040a649
add esp, 0xc
cmp dword [0x6c8640], 0xffffffff
jne 0x467bae
push ebx
push ebx
push 1
push ebx
mov dword [0x6c8640], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov dword [esp + 0xc], ebx
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push 0x467a3e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.005bb4fa
pop ecx
mov dword [esp + 0x10], eax
mov ebx, str.Software360360huabao
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
push str.CheckPwdTime
mov edx, ebx
call fcn.004260a4
mov eax, dword [0x6c8640]
mov edx, ebx
mov dword [esp + 0x18], eax
mov ecx, reloc.WS2_32.dll_accept
lea eax, [esp + 0x18]
push eax
push str.SystemHasPwd
call fcn.00426057
add esp, 0x10
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret