joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ccec1
Capabilities:
Check if file exists
Create process on windows
Create process suspended

Disassembly:
push 0xbc
mov eax, 0x5f46c9
call fcn.0059bbd7
mov esi, edx
xor ebx, ebx
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040b155
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ccfdd
push 0x44
pop edi
push edi
lea eax, [ebp - 0xc8]
push ebx
push eax
call fcn.005b24a0
xor eax, eax
mov dword [ebp - 0xc8], edi
inc eax
mov dword [ebp - 0xc0], str.Default
mov dword [ebp - 0x9c], eax
mov word [ebp - 0x98], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push 0x6360f8
push eax
call fcn.00445efc
push 0x65cad8
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0041152a
add esp, 0x1c
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00411504
mov byte [ebp - 0x74], bl
lea ecx, [ebp - 0x40]
push dword [ebp - 0x74]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0040b632
lea ecx, [ebp - 0x58]
call fcn.0040b67e
lea ecx, [ebp - 0x70]
call fcn.0040b67e
xor eax, eax
lea edi, [ebp - 0x84]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x84]
push ecx
stosd dword es:[edi], eax
lea ecx, [ebp - 0xc8]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4ccfd5
push dword [ebp - 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x84]
call esi
inc ebx
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov eax, ebx
call fcn.0059bb81
ret
Function at 0x4ce693
Capabilities:
Create process on windows

Disassembly:
push 0x98
mov eax, 0x5f4a83
call fcn.0059bbd7
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4ce6ae
mov eax, dword [esi]
push eax
push 0xb3c
push str.Launch360HuabaoSetupProcess
push str.__s__d___Launch360HuabaoSetupProcess_szCmd:_s
call fcn.0040a649
push 7
xor ebx, ebx
xor eax, eax
pop edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], edi
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
push eax
push str.InstallPath
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.004261ea
add esp, 0x18
test eax, eax
je 0x4ce828
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.Version
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.004261ea
pop ecx
pop ecx
test eax, eax
je 0x4ce820
mov edi, 0x633b6c
lea edx, [ebp - 0x58]
push edi
lea ecx, [ebp - 0xa0]
call fcn.00411559
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.0040b220
mov byte [ebp - 0xa4], bl
lea ecx, [ebp - 0x70]
push dword [ebp - 0xa4]
mov dword [ebp - 0x60], ebx
push eax
mov dword [ebp - 0x5c], ebx
call fcn.0040b632
push edi
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
call fcn.0041152a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
mov edx, eax
mov dword [esp], 0x640f58
call fcn.0041152a
pop ecx
lea ecx, [ebp - 0x88]
call fcn.0040b67e
lea ecx, [ebp - 0x70]
call fcn.0040b67e
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 8
call fcn.0040b67e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x4ce818
push 0xb43
push str.Launch360HuabaoSetupProcess
push str.__s__d___ShellExecute
call fcn.0040a649
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4ce7f6
mov esi, dword [esi]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 1
cmovae eax, dword [ebp - 0x40]
push ebx
push esi
push eax
push 0x63afc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x58]
call fcn.0040b67e
call fcn.0059bb81
ret

Function at 0x4ceb02
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x4ceb79
cmp dword [esi + 0x14], 8
jb 0x4ceb5b
mov esi, dword [esi]
push 1
push 0
push esi
lea eax, [ebp - 0x210]
push eax
push 0x63afc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059a7a2
leave
ret
Function at 0x4ceb86
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x5f4b50
call fcn.0059bbd7
mov esi, edx
mov edi, ecx
xor dl, dl
call fcn.004d2c38
test eax, eax
je 0x4cec1b
push 0xb8d
push str.LaunchHealthMgrProcess
push str.__s__d___HealthMgr::GetRulerStateForHealthMgr
call fcn.0040a649
add esp, 0xc
cmp dword [ebp + 8], 1
jne 0x4cecf2
push str.https:__dd.browser.360.cn_static_a_1286.7248.gif__refererend_from_
lea ecx, [ebp - 0x44]
call fcn.0040b0d5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x5c]
mov edx, edi
call fcn.00420ed4
mov byte [ebp - 4], 1
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4cebeb
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x44]
call fcn.0040b220
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.0040b67e
push 1
push 0
mov dl, 1
lea ecx, [ebp - 0x44]
call fcn.004ce396
pop ecx
pop ecx
lea ecx, [ebp - 0x44]
jmp 0x4ceced
push 0x63424c
lea ecx, [ebp - 0x44]
call fcn.0040b0d5
lea edx, [ebp - 0x44]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004cb96f
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.0040b67e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004352fd
pop ecx
test eax, eax
je 0x4cecea
cmp dword [ebp + 8], 1
jne 0x4cecbf
push str.https:__dd.browser.360.cn_static_a_1286.9331.gif__referershow_from_
lea ecx, [ebp - 0x5c]
call fcn.0040b0d5
mov edx, edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x74]
call fcn.00420ed4
mov byte [ebp - 4], 6
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4cec8f
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0040b220
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.0040b67e
push 1
push 0
mov dl, 1
lea ecx, [ebp - 0x5c]
call fcn.004ce396
pop ecx
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.0040b67e
cmp dword [esi + 0x14], 8
jb 0x4cecc7
mov esi, dword [esi]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 1
cmovae eax, dword [ebp - 0x2c]
push 0
push esi
push eax
push 0x63afc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
call fcn.0059bb81
ret
Function at 0x4cecf8
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x5f4b8d
call fcn.0059bbd7
mov esi, edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [esi + 0x14], 8
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, esi
jb 0x4ced1e
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ced2d
mov bh, 1
jmp 0x4ced67
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x4ced37
mov edx, dword [esi]
sub esp, 0x18
mov ecx, esp
call fcn.004236f2
lea ecx, [ebp - 0x28]
call fcn.00435b82
push dword [ebp - 0x44]
lea eax, [ebp - 0x28]
push eax
call fcn.004235f6
add esp, 0x20
lea ecx, [ebp - 0x28]
mov bl, al
xor bl, 1
call fcn.0040b67e
mov bh, bl
movzx ecx, bl
push ecx
movzx eax, bh
push eax
push 0xc0c
push str.CheckNeedDownLoad
push str.__s__d___CheckNeedDownLoad_bNeedDownLoad___d_bHas_d
call fcn.0040a649
add esp, 0x14
test bh, bh
je 0x4cee18
call fcn.004c1eeb
push 0
push esi
push edi
call fcn.004c1f49
test al, al
je 0x4cedc4
test bl, bl
je 0x4cee18
push str.https:__dd.browser.360.cn_static_a_1289.9719.gif__referer
lea ecx, [ebp - 0x28]
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
xor ecx, ecx
call fcn.004d479e
lea ecx, [ebp - 0x28]
jmp 0x4cee13
push str.https:__dd.browser.360.cn_static_a_1289.1848.gif__referer
lea ecx, [ebp - 0x28]
call fcn.0040b0d5
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.004d479e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b67e
test bl, bl
je 0x4cee18
push str.https:__dd.browser.360.cn_static_a_1289.9719.gif__referer
lea ecx, [ebp - 0x40]
call fcn.0040b0d5
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.004d479e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
call fcn.0059bb81
ret

Function at 0x4cef80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x4cf06d
mov ebx, 0x200
lea eax, [ebp - 0x208]
push ebx
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x208]
push eax
push 0xcda
push str.ForegroundWndIsPPt
push str.__s__d__classname_is__s_
call fcn.0040a649
add esp, 0x10
xor esi, esi
push dword [esi + 0x66e730]
lea eax, [ebp - 0x208]
push eax
call fcn.005c4d0e
pop ecx
pop ecx
test eax, eax
je 0x4cf068
add esi, 4
cmp esi, 0x10
jb 0x4ceff0
push ebx
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x408]
push 0xff
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x408]
push eax
push 0xce4
push str.ForegroundWndIsPPt
push str.__s__d__WindowText_is__s_
call fcn.0040a649
lea eax, [ebp - 0x408]
push str.Microsoft_PowerPoint
push eax
call fcn.005b32db
add esp, 0x18
test eax, eax
je 0x4cf06d
xor eax, eax
inc eax
jmp 0x4cf06f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret
Function at 0x4cf0d5
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x2a4
mov eax, 0x5f4bf4
call fcn.0059bbd7
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x2b0], 1
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], esi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2b0]
push eax
push str.Path
push 0x632b08
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4cf2f7
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x4cf2f7
push str.360EntClient.exe
lea ecx, [ebp - 0x260]
call fcn.0040b0d5
and dword [ebp - 4], 0
lea edx, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
call fcn.0040b67e
push str.deepscanQhEntInfo.dll
lea ecx, [ebp - 0x290]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x218]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x230]
call fcn.0040c622
pop ecx
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 5
call fcn.0040b67e
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call esi
test eax, eax
je 0x4cf1fa
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call esi
test eax, eax
jne 0x4cf2c6
push str.360EntClient64.exe
lea ecx, [ebp - 0x278]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x218]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x260]
call fcn.0040c622
pop ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.0040b0ac
lea ecx, [ebp - 0x260]
call fcn.0040b67e
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 5
call fcn.0040b67e
push str.deepscanQhEntInfo64.dll
lea ecx, [ebp - 0x2a8]
call fcn.0040b0d5
push eax
lea edx, [ebp - 0x218]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x278]
call fcn.0040c622
pop ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b0ac
lea ecx, [ebp - 0x278]
call fcn.0040b67e
lea ecx, [ebp - 0x2a8]
call fcn.0040b67e
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call esi
test eax, eax
je 0x4cf2e1
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call esi
test eax, eax
je 0x4cf2e1
lea ecx, [ebp - 0x230]
call fcn.0040b67e
lea ecx, [ebp - 0x248]
call fcn.0040b67e
xor eax, eax
inc eax
jmp 0x4cf2f9
lea ecx, [ebp - 0x230]
call fcn.0040b67e
lea ecx, [ebp - 0x248]
call fcn.0040b67e
xor eax, eax
call fcn.0059bb81
ret
Function at 0x4cf8b4
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x5f4cb4
call fcn.0059bba3
mov edi, ecx
push 0xd97
push str.Launch360PicAsnc
push str.__s__d__Launch360PicAsnc
call fcn.0040a649
add esp, 0xc
push 0x18
call fcn.0059a7c1
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
push edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040b155
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push esi
push 0x4cf88a
push ebx
push ebx
call fcn.005c30ff
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0059bb6c
ret

Function at 0x4cfe22
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x5f4d91
call fcn.0059bbd7
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x238], 1
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], esi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push str.Path
push 0x632b08
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4cff52
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cff52
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b0d5
and dword [ebp - 4], 0
mov esi, str._netmon360WebIdentify.dll
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040b220
mov eax, dword [0x6f16f0]
test eax, eax
jne 0x4cff0c
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6f16f0], eax
test eax, eax
jne 0x4cff0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040b67e
jmp 0x4cff52
push str.GetWebIdentifyState
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4cfefb
call eax
push 0xe29
mov esi, eax
push str.IsOBSRunning
push esi
push str.__d__s__d__
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x230]
xor ebx, ebx
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
call fcn.0040b67e
test esi, esi
jne 0x4cff64
call fcn.004d03df
mov ebx, eax
test ebx, ebx
jne 0x4cff64
call fcn.004d086e
mov ebx, eax
mov eax, ebx
call fcn.0059bb81
ret
Function at 0x4cff6c
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x5f4d91
call fcn.0059bbd7
mov edi, ecx
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x238], 1
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], esi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
push str.Path
push 0x632b08
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4d009e
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d009e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b0d5
and dword [ebp - 4], 0
mov esi, str._netmon360WebIdentify.dll
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040b220
mov eax, dword [0x6f16e0]
test eax, eax
jne 0x4d0058
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6f16e0], eax
test eax, eax
jne 0x4d0058
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040b67e
jmp 0x4d009e
push str.GetWebIdentifyState
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4d0047
call eax
push 0xe5c
mov esi, eax
push str.IsHuabaoSkipRunningEx
push esi
push str.__d__s__d__
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x230]
xor ebx, ebx
test esi, esi
setne bl
or dword [ebp - 4], 0xffffffff
call fcn.0040b67e
test esi, esi
jne 0x4d00c2
mov ecx, edi
call fcn.004d0599
mov ebx, eax
test ebx, ebx
jne 0x4d00c2
mov ecx, edi
call fcn.004d0a0c
mov ebx, eax
test ebx, ebx
jne 0x4d00c2
mov ecx, edi
call fcn.004d69e7
movzx ebx, al
mov eax, ebx
call fcn.0059bb81
ret

Function at 0x4d00ca
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d00fb
xor eax, eax
jmp 0x4d01a3
push 0x228
lea eax, [ebp - 0x234]
push esi
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4d0173
push 0xe81
push str.IsProcessRunning
lea eax, [ebp - 0x214]
push eax
push str._process_name:__s__s__d__
call fcn.0040a649
add esp, 0x10
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x4d0152
mov eax, dword [ebx]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.005c42cb
pop ecx
pop ecx
test eax, eax
je 0x4d0179
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4d012a
jmp 0x4d019a
push 0xe85
push str.IsProcessRunning
lea eax, [ebp - 0x214]
push eax
push str._process_name:__s__s__d__
call fcn.0040a649
xor esi, esi
add esp, 0x10
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret
Function at 0x4d03df
Capabilities:
Enumerate processes

Disassembly:
push 0x264
mov eax, 0x5f4dfe
call fcn.0059bbd7
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d0406
xor eax, eax
jmp 0x4d0593
push 0x228
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [ebp - 0x270], 0x22c
lea eax, [ebp - 0x270]
xor esi, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4d0537
call fcn.004c9a03
test eax, eax
je 0x4d0502
mov eax, dword [0x6f0e44]
mov eax, dword [eax]
mov esi, dword [eax]
jmp 0x4d04f8
lea eax, [esi + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x4d0461
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x40]
call fcn.004045aa
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
push 0xfde9
lea ecx, [ebp - 0x28]
call fcn.00426ce7
pop ecx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00404812
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.005c42cb
pop ecx
pop ecx
test eax, eax
je 0x4d0541
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4d04db
mov eax, dword [esi + 4]
jmp 0x4d04d1
cmp esi, dword [eax + 8]
jne 0x4d04d7
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4d04c7
mov esi, eax
jmp 0x4d04f1
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4d04f1
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4d04e5
mov eax, dword [0x6f0e44]
mov eax, dword [eax]
cmp esi, eax
jne 0x4d0456
jmp 0x4d0527
xor esi, esi
push dword [esi + 0x6328d0]
lea eax, [ebp - 0x24c]
push eax
call fcn.005c42cb
pop ecx
pop ecx
test eax, eax
je 0x4d0569
add esi, 4
cmp esi, 0x22c
jb 0x4d0504
lea eax, [ebp - 0x270]
xor esi, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4d043b
jmp 0x4d058a
push 0xedc
push str.IsObsProcessRunning
lea eax, [ebp - 0x24c]
push eax
push str._process_name:__s__s__d__
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040b67e
jmp 0x4d0587
push 0xee6
push str.IsObsProcessRunning
lea eax, [ebp - 0x24c]
push eax
push str._process_name:__s__s__d__
call fcn.0040a649
add esp, 0x10
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0059bb81
ret
Function at 0x4d086e
Capabilities:
Get graphical window text

Disassembly:
push 0x234
mov eax, 0x5f4e7f
call fcn.0059bbd7
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4d0a06
push 0x200
xor edi, edi
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0xff
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.004c9a2d
test eax, eax
je 0x4d09bc
mov eax, dword [0x6f0e4c]
mov eax, dword [eax]
mov esi, dword [eax]
jmp 0x4d0987
lea eax, [esi + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x4d08dd
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x240]
call fcn.004045aa
push 0xfde9
lea edx, [ebp - 0x240]
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x228]
call fcn.00426ce7
pop ecx
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 2
call fcn.00404812
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.005c42cb
pop ecx
pop ecx
test eax, eax
je 0x4d0991
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.0040b67e
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x4d096a
mov eax, dword [esi + 4]
jmp 0x4d0960
cmp esi, dword [eax + 8]
jne 0x4d0966
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4d0956
mov esi, eax
jmp 0x4d0980
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4d0980
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4d0974
mov eax, dword [0x6f0e4c]
mov eax, dword [eax]
cmp esi, eax
jne 0x4d08d2
jmp 0x4d0a04
push 0xf44
push str.IsObsTitleRunning
lea eax, [ebp - 0x210]
push eax
push str._title:__s__s__d__
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x228]
call fcn.0040b67e
jmp 0x4d0a01
mov esi, edi
push dword [esi + 0x6323f0]
lea eax, [ebp - 0x210]
push eax
call fcn.005c4d0e
pop ecx
pop ecx
test eax, eax
je 0x4d09e3
add esi, 4
cmp esi, 0x4c8
jb 0x4d09be
jmp 0x4d0a04
push 0xf4d
push str.IsObsTitleRunning
lea eax, [ebp - 0x210]
push eax
push str._title:__s__s__d__
call fcn.0040a649
add esp, 0x10
xor edi, edi
inc edi
mov eax, edi
call fcn.0059bb81
ret