joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481310
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Shcore.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4813e0
lea eax, [ebp - 0x210]
push eax
call fcn.0040b283
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4813e0
push str.SetProcessDpiAwareness
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
push str.GetProcessDpiAwareness
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x18], eax
push str.GetDpiForMonitor
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], eax
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x48145a
push str.SetProcessDPIAware
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x20], eax
push str.IsProcessDPIAware
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
push str.LogicalToPhysicalPoint
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
push str.PhysicalToLogicalPoint
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x2c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret
Function at 0x483280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4f9af0
push 0x4af5a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x18ac
call fcn.004afec0
mov eax, dword [0x50ab8c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x400
push 0x800
push 0
lea eax, [ebp - 0x824]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x824]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004834a0
add esp, 0x10
mov dword [ebp - 0x868], 0
push 0x40
push 0
lea eax, [ebp - 0x864]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x878], 0
xor eax, eax
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x86c], eax
mov dword [ebp - 0x868], 0x44
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x83c], 1
mov ax, word [ebp + 0x14]
mov word [ebp - 0x838], ax
mov dword [ebp - 0x87c], 0x800
xor eax, eax
mov word [ebp - 0x187c], ax
push 0xffe
push 0
lea eax, [ebp - 0x187a]
push eax
call fcn.004ae3b0
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x4833aa
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ab78e
add esp, 4
mov dword [ebp - 0x18c4], eax
jmp 0x4833b4
mov dword [ebp - 0x18c4], 0
mov ecx, dword [ebp - 0x18c4]
mov dword [ebp - 0x1880], ecx
lea eax, [ebp - 0x824]
push eax
push 0x4e69e0
lea ecx, [ebp - 0x187c]
push ecx
call fcn.00484db0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x187c]
push ecx
call fcn.00484de0
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0x868]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x187c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x483458
cmp dword [ebp + 0x18], 0
je 0x48343e
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x878]
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x878]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
jmp 0x483478
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret
Function at 0x485cb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00487c70
lea ecx, [ebp - 8]
call fcn.00402c1b
movzx eax, al
test eax, eax
je 0x485ce7
lea ecx, [ebp - 8]
call fcn.004027ef
jmp 0x485d76
mov ecx, 0x50f1c0
call fcn.0047ceb0
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x485d6e
lea ecx, [ebp - 8]
call fcn.00402c12
lea eax, [eax + eax + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x485d6e
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.00485fc0
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.004af7a7
add esp, 0x10
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 8]
call fcn.00486020
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 8]
call fcn.004027ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x488b20
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db5d0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x50ab8c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x488b64
xor eax, eax
jmp 0x488c2b
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00486ef0
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x488bf5
mov ecx, dword [ebp - 0x1c]
call fcn.0048f1b0
test eax, eax
jbe 0x488bf5
mov ecx, dword [ebp - 0x1c]
call fcn.0048f220
test eax, eax
jbe 0x488bf5
mov ecx, dword [ebp - 0x1c]
call fcn.0048f1b0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x1c]
call fcn.0048f220
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 0
je 0x488be0
push 1
mov edx, dword [ebp - 0x64]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x64]
mov edx, dword [eax]
call edx
mov dword [ebp - 0x68], eax
jmp 0x488be7
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 1
jmp 0x488c0b
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
jne 0x488c28
cmp dword [ebp + 0x14], 0
je 0x488c28
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x499370
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4993a4
mov eax, 1
jmp 0x4994ca
mov dword [ebp - 0x38], 0
push 0x2c
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x38], 0x30
mov dword [ebp - 0x24], 0x400000
xor eax, eax
mov word [ebp - 0x838], ax
push 0x7fe
push 0
lea eax, [ebp - 0x836]
push eax
call fcn.004ae3b0
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x499405
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x838]
push ecx
call fcn.00403d21
jmp 0x499425
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Q360SoftMgrMsgDelegateWnd_d
push 0x400
lea eax, [ebp - 0x838]
push eax
call fcn.0040fadc
add esp, 0x10
lea eax, [ebp - 0x838]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0x499730
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4994c8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffeb
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x28]
push edx
call fcn.004093b5
add esp, 0xc
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 0
jne 0x4994b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x840], eax
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x4994ca
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret 8

Function at 0x499a90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x499aa3
xor eax, eax
jmp 0x499b09
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x499ab5
xor eax, eax
jmp 0x499b09
cmp dword [ebp + 0xc], 0
je 0x499afd
push str.360Base.dll
lea eax, [ebp - 0x44]
push eax
call fcn.0040f5a9
add esp, 8
mov ecx, eax
call fcn.00402c0f
push eax
call fcn.0040acda
add esp, 4
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
call fcn.004027ef
cmp dword [ebp - 0x48], 0
je 0x499afd
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040abf9
add esp, 8
jmp 0x499b09
mov eax, dword [ebp + 8]
push eax
call fcn.0045d150
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499cd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x499dae
push str.safemon360tray.exe
lea eax, [ebp - 0xc]
push eax
call fcn.0040f5a9
add esp, 8
push 1
lea ecx, [ebp - 0xc]
call fcn.00402c0f
push eax
call fcn.0049aaa0
add esp, 8
test eax, eax
je 0x499da6
mov dword [ebp - 0x50], 0
push 0x40
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0x44
mov eax, 5
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
call fcn.00402c0f
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x499da6
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
call fcn.004027ef
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x499dea
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
test eax, eax
je 0x499dea
mov dword [ebp - 0xa4], 1
jmp 0x499df4
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x49aaa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x49aab3
xor eax, eax
jmp 0x49aaf1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49aac5
xor eax, eax
jmp 0x49aaf1
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004102a9
add esp, 8
test eax, eax
je 0x49aae1
mov eax, 1
jmp 0x49aaf1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049ab00
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ab00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x49ab13
xor eax, eax
jmp 0x49ab79
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49ab25
xor eax, eax
jmp 0x49ab79
cmp dword [ebp + 0xc], 0
je 0x49ab6d
push str.360Base.dll
lea eax, [ebp - 0x44]
push eax
call fcn.0040f5a9
add esp, 8
mov ecx, eax
call fcn.00402c0f
push eax
call fcn.0040acda
add esp, 4
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
call fcn.004027ef
cmp dword [ebp - 0x48], 0
je 0x49ab6d
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040abf9
add esp, 8
jmp 0x49ab79
mov eax, dword [ebp + 8]
push eax
call fcn.0045d150
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49c2f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 8]
call fcn.0040276e
push 0
push 0
push 0x104
lea ecx, [ebp - 8]
call fcn.00403ca0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00403b35
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0x4e8028
mov eax, dword [ebp - 8]
push eax
push 0x4f03d4
lea ecx, [ebp - 0x210]
push ecx
call fcn.0049c600
add esp, 0x10
push 0x208
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push str._newsreader__srcdesktoplnk
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.004175ed
add esp, 0x14
mov dword [ebp - 0x45c], eax
lea ecx, [ebp - 8]
call fcn.004027ef
mov eax, dword [ebp - 0x45c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret

Function at 0x49c3e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 8]
call fcn.0040276e
push 0
push 0
push 0x104
lea ecx, [ebp - 8]
call fcn.00403ca0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00403b35
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0x4e8028
mov eax, dword [ebp - 8]
push eax
push 0x4f03d4
lea ecx, [ebp - 0x210]
push ecx
call fcn.0049c600
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x254], eax
lea ecx, [ebp - 8]
call fcn.004027ef
mov eax, dword [ebp - 0x254]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret
Function at 0x49c490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 8]
call fcn.0040276e
push 0
push 0
push 0x104
lea ecx, [ebp - 8]
call fcn.00403ca0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00403b35
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004ae3b0
add esp, 0xc
push 0x4e8028
mov eax, dword [ebp - 8]
push eax
push 0x4f03d4
lea ecx, [ebp - 0x210]
push ecx
call fcn.0049c600
add esp, 0x10
lea ecx, [ebp - 0x214]
call fcn.0040276e
lea ecx, [ebp - 0x218]
call fcn.0040276e
lea ecx, [ebp - 0x21c]
call fcn.0040276e
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x264]
call fcn.00402791
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x264]
push ecx
call fcn.004179bb
add esp, 0x10
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x264]
call fcn.004027ef
cmp dword [ebp - 0x268], 0
je 0x49c5ac
push 0x4eee14
lea ecx, [ebp - 0x214]
call fcn.0040e3d2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x214]
call fcn.0040281d
lea ecx, [ebp - 0x214]
call fcn.00402c0f
push eax
call fcn.00417c28
add esp, 4
mov dword [ebp - 0x260], 1
lea ecx, [ebp - 0x21c]
call fcn.004027ef
lea ecx, [ebp - 0x218]
call fcn.004027ef
lea ecx, [ebp - 0x214]
call fcn.004027ef
lea ecx, [ebp - 8]
call fcn.004027ef
mov eax, dword [ebp - 0x260]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret

Function at 0x49c6b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0x400
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x810], 0x800
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x808]
push ecx
lea edx, [ebp - 0x80c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49c740
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402791
mov eax, dword [ebp + 8]
jmp 0x49c750
push 0x4eee28
mov ecx, dword [ebp + 8]
call fcn.00402791
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret

Function at 0x49ccb0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
call fcn.0049d3b0
test eax, eax
je 0x49cccb
call fcn.0049c7c0
test eax, eax
jne 0x49cccf
xor eax, eax
jmp 0x49cced
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
jne 0x49cce8
xor eax, eax
jmp 0x49cced
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d410
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x50ab8c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
movzx eax, byte [0x509df4]
test eax, eax
je 0x49d5ba
mov dword [0x5123e8], 0x114
push 0x5123e8
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x49d51a
mov byte [ebp - 0x44], 0
push 0x3f
push 0
lea eax, [ebp - 0x43]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x4c], 0x40
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x48]
push edx
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49d4c2
mov dword [0x5123f8], 2
movsx eax, byte [ebp - 0x44]
sub eax, 0x30
mov dword [0x5123ec], eax
lea eax, [ebp - 0x42]
push eax
call fcn.004b11b4
add esp, 4
mov dword [0x5123f0], eax
jmp 0x49d51a
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [0x5123ec], edx
mov eax, dword [ebp - 0x50]
and eax, 0xffff
movzx ecx, ax
shr ecx, 8
and ecx, 0xff
movzx edx, cl
mov dword [0x5123f0], edx
mov eax, 4
cmp eax, dword [0x5123ec]
sbb ecx, ecx
neg ecx
add ecx, 1
mov dword [0x5123f8], ecx
cmp dword [0x5123ec], 6
ja 0x49d539
cmp dword [0x5123ec], 6
jne 0x49d5b3
cmp dword [0x5123f0], 2
jb 0x49d5b3
mov dword [ebp - 0x164], 0
push 0x110
push 0
lea eax, [ebp - 0x160]
push eax
call fcn.004ae3b0
add esp, 0xc
mov dword [ebp - 0x164], 0x114
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x49d5b3
lea eax, [ebp - 0x164]
push eax
call dword [ebp - 0x168]
test eax, eax
jne 0x49d5b3
push 0x114
lea eax, [ebp - 0x164]
push eax
push 0x5123e8
call fcn.004b0e20
add esp, 0xc
mov byte [0x509df4], 0
mov ecx, 0x45
mov esi, 0x5123e8
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab7a8
mov esp, ebp
pop ebp
ret

Function at 0x49fab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x49fac3
xor eax, eax
jmp 0x49fb29
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49fad5
xor eax, eax
jmp 0x49fb29
cmp dword [ebp + 0xc], 0
je 0x49fb1d
push str.360Base.dll
lea eax, [ebp - 0x44]
push eax
call fcn.0040f5a9
add esp, 8
mov ecx, eax
call fcn.00402c0f
push eax
call fcn.0040acda
add esp, 4
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
call fcn.004027ef
cmp dword [ebp - 0x48], 0
je 0x49fb1d
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040abf9
add esp, 8
jmp 0x49fb29
mov eax, dword [ebp + 8]
push eax
call fcn.0045d150
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret