joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46404b
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push edx
mov esi, ecx
push 0
mov dword [ebp - 0x210], esi
push 0x1fffff
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4640d8
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x103
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x4640c8
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x4640d8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
jmp 0x4640dd
push 0x6335fc
mov ecx, esi
call fcn.0040b0d5
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0059a7a2
leave
ret

Function at 0x4641d1
Capabilities:
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x20]
push ebx
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0
lea ebx, [esi - 1]
mov dword [ebp - 0x34], eax
push ebx
call dword [sym.imp.USER32.dll_WindowFromPoint]
lea esi, [edi - 1]
mov dword [ebp - 0x38], eax
mov edi, dword [sym.imp.USER32.dll_WindowFromPoint]
push esi
push 0
call edi
push esi
push ebx
mov dword [ebp - 0x3c], eax
call edi
mov edi, dword [ebp - 0x34]
mov esi, eax
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push eax
push edi
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x38]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x3c]
call ebx
lea eax, [ebp - 0x30]
push eax
push esi
call ebx
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x24]
jne 0x4642c9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], eax
jne 0x4642c9
cmp eax, dword [ebp - 0x30]
jne 0x4642c9
mov ecx, edi
call fcn.004640f9
test eax, eax
jne 0x4642c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.USER32.dll_GetShellWindow]
mov ebx, eax
lea edi, [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [ebp - 0x34]
call edi
lea eax, [ebp - 0xc]
push eax
push esi
call edi
lea eax, [ebp - 8]
push eax
push ebx
call edi
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x4642c9
cmp eax, dword [ebp - 8]
je 0x4642c9
xor eax, eax
inc eax
jmp 0x4642cb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret
Function at 0x465cdc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0e00
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6d35ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x7ed], 0
mov dword [esi], vtable.WorkerWnd.6.0
mov dword [esi + 0x10], vtable.WorkerWnd.5.0
mov dword [esi + 0x20], vtable.WorkerWnd.4.0
mov dword [esi + 0x24], vtable.WorkerWnd.3.0
mov dword [esi + 0x28], vtable.WorkerWnd.2.0
mov dword [esi + 0x2c], vtable.WorkerWnd.1.0
mov dword [esi + 0x6d8], 0x64909c
jne 0x465d94
call fcn.0045d8ec
test al, al
jne 0x465d94
mov eax, dword [esi + 0x844]
test eax, eax
je 0x465d6e
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 0x844]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [esi + 0x840]
test edi, edi
je 0x465d94
cmp dword [esi + 4], 0
je 0x465d8b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, edi
jne 0x465d94
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1ab
push str.WorkerWnd::WorkerWnd
push str.__s__d__destroy_worker
call fcn.0040a649
add esp, 0xc
cmp byte [esi + 0x7c5], 0
je 0x465dcc
mov ecx, dword [esi + 0x7c8]
test ecx, ecx
je 0x465dcc
mov eax, dword [ecx]
push 1
call dword [eax + 0x14]
and dword [esi + 0x7c8], 0
mov ecx, dword [esi + 0x6dc]
test ecx, ecx
je 0x465ddb
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [esi + 0x6e0]
test ecx, ecx
je 0x465dea
mov eax, dword [ecx]
call dword [eax + 0x34]
lea ecx, [esi + 0x824]
call fcn.0040b67e
lea ecx, [esi + 0x80c]
call fcn.0040b67e
lea ecx, [esi + 0x7f0]
call fcn.0040b67e
lea ecx, [esi + 0x7cc]
call fcn.0040b67e
lea ecx, [esi + 0x7b8]
call fcn.0044956d
lea ecx, [esi + 0x79c]
call fcn.0040b67e
lea ecx, [esi + 0x71c]
call fcn.0045f939
lea ecx, [esi + 0x6ec]
call fcn.0040b67e
mov ecx, esi
call sym.360huabao.exe_public_virtual:_void___thiscall_DuiLib::WindowImplBase::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4693ed
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
and dword [esp + 0xc], 0
lea edx, [esp + 0xc]
mov ebx, eax
mov ecx, ebx
call fcn.0043635e
mov esi, dword [esp + 0xc]
push esi
push ebx
push 0x676
push str.WorkerWnd::GetCpuUseage
push str.__s__d___GetCpuUseage_dwProcessId_d_dwCpu_d
call fcn.0040a649
add esp, 0x14
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x469457
xor eax, eax
jmp 0x4694ee
push 0x228
lea eax, [esp + 0x18]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
mov dword [esp + 0x10], 0x22c
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4694c8
cmp dword [esp + 0x28], ebx
jne 0x4694bc
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
and dword [esp + 0xc], 0
call fcn.0043635e
push dword [esp + 0xc]
push dword [esp + 0x1c]
push 0x685
push str.WorkerWnd::GetCpuUseage
push str.__s__d___GetCpuUseage_dwProcessId_d_dwCpu_d
call fcn.0040a649
add esp, 0x14
add esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x469481
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push 0x68b
push str.WorkerWnd::GetCpuUseage
push str.__s__d___total_GetCpuUseage_dwProcessId_d_dwCpu_d
call fcn.0040a649
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret
Function at 0x46af3e
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0x3c
mov eax, 0x5e9932
call fcn.0059bbd7
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov dword [ebp - 0x48], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x48], 0x6f2140
mov dword [0x6f2144], ebx
mov dword [0x6f2154], ebx
mov dword [0x6f2158], ebx
mov dword [0x6f215c], ebx
mov dword [0x6f2160], eax
mov dword [ebp - 4], ebx
mov eax, dword [0x6d3fd4]
mov dword [0x6f2140], 0x64a568
mov dword [0x6f2164], ebx
mov dword [0x6f2178], eax
mov dword [0x6f217c], ebx
mov dword [0x6f2180], eax
push ebx
mov byte [ebp - 4], 2
push ebx
mov dword [0x6f2184], ebx
mov dword [0x6f2188], ebx
call fcn.0046c913
mov dword [0x6f2184], eax
mov eax, dword [0x6d3fd4]
mov byte [0x6f2198], bl
mov dword [0x6f219c], eax
push ebx
mov byte [ebp - 4], 4
push ebx
mov dword [0x6f21a0], ebx
mov dword [0x6f21a4], ebx
call fcn.0046c913
mov dword [0x6f21a0], eax
push 0x94
mov esi, str.C360SafeHbMgr::C360SafeHbMgr
mov byte [ebp - 4], 5
push esi
push str.__s__d___C360SafeHbMgr::ready_go___________
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x44]
mov edi, 0x6491fc
mov edx, edi
call fcn.0043c53a
push ebx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00413c4d
push eax
lea ecx, [ebp - 0x40]
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.004c9d5f
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], ebx
je 0x46b0d8
push edi
call fcn.005c2f90
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
push 8
pop edi
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], edi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
push 0x9c
push esi
push str.__s__d____strSrc___s_strPath___s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46b0d8
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
push ebx
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], edi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46b0c5
push 0xa1
push esi
push str.__s__d___CopyFile_success
jmp 0x46b0d0
push 0xa5
push esi
push str.__s__d___CopyFile_failed
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x44]
call fcn.0040a4ed
mov eax, 0x6f2140
call fcn.0059bb81
ret
Function at 0x46b196
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x5e996d
call fcn.0059bbd7
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x21c], esi
push 0x208
xor ebx, ebx
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test edi, edi
je 0x46b234
push edi
lea ecx, [ebp - 0x21c]
call fcn.00423634
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x220]
call fcn.00423634
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x220]
mov ecx, esi
call fcn.0043b1ab
pop ecx
lea ecx, [ebp - 0x220]
call fcn.0040a4ed
lea ecx, [ebp - 0x21c]
call fcn.0040a4ed
jmp 0x46b242
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00423634
mov eax, esi
call fcn.0059bb81
ret

Function at 0x46bf3c
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x5e9a81
call fcn.0059bbd7
mov esi, dword [ebp + 8]
call fcn.004d01b2
test al, al
jne 0x46bf70
push 0x231
push str.C360SafeHbMgr::RunDesktopRest
push str.__s__d__CanShowSafeHuabao_return
call fcn.0040a649
add esp, 0xc
jmp 0x46c036
push esi
lea ecx, [ebp - 0x4c]
call fcn.00423634
xor edi, edi
lea ecx, [ebp - 0x48]
mov edx, str.UtilsDesktopRestDesktopRest.exe
mov dword [ebp - 4], edi
call fcn.0043c53a
mov byte [ebp - 4], 1
mov ebx, edi
mov esi, dword [ebp - 0x48]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46c009
push esi
call fcn.004352fd
pop ecx
test eax, eax
je 0x46c009
push edi
lea ecx, [ebp - 0x48]
inc ebx
call fcn.00413c4d
push eax
lea ecx, [ebp - 0x44]
call fcn.0040b0d5
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00413c4d
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d5
push edi
push edi
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.004ccfed
pop ecx
pop ecx
test eax, eax
jne 0x46bff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0040b67e
mov esi, dword [ebp - 0x48]
push esi
push edi
push ebx
push dword [ebp - 0x4c]
push 0x245
push str.C360SafeHbMgr::RunDesktopRest
push str.__s__d___param__s__hasfile__d__err__d__exe__s_
call fcn.0040a649
add esp, 0x1c
lea ecx, [ebp - 0x48]
call fcn.0040a4ed
lea ecx, [ebp - 0x4c]
call fcn.0040a4ed
call fcn.0059bb81
ret 4
Function at 0x46c05a
Capabilities:
Read .ini file

Disassembly:
push 0x218
mov eax, 0x5e9ab1
call fcn.0059bbd7
mov edi, ecx
mov esi, dword [0x6d3fd4]
mov dword [ebp - 0x21c], esi
xor ebx, ebx
lea eax, [ebp - 0x218]
push 0x208
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [edi + 0x38]
push 0x104
push eax
push 0x649e10
push str.EyeLastGamma
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2a
pop eax
cmp ax, word [ebp - 0x218]
je 0x46c0e7
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040a358
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 8], ebx
je 0x46c120
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], ebx
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], ebx
push eax
push str._d__d
push esi
call fcn.0040a1c3
xor ebx, ebx
add esp, 0x10
cmp dword [ebp - 0x220], 1
sete bl
lea ecx, [ebp - 0x21c]
call fcn.0040a4ed
mov eax, ebx
call fcn.0059bb81
ret

Function at 0x46c3c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
mov esi, ecx
lea eax, [ebp - 0x20c]
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
mov dword [ebp - 0x210], esi
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360desktoplite.exe
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46c462
lea eax, [ebp - 0x218]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0x206
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push 0x6335fc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00423634
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0059a7a2
leave
ret

Function at 0x46cee1
Capabilities:
Change user account password

Disassembly:
mov eax, 0x6335fc
push eax
push eax
push 0
push 0
call dword [sym.imp.NETAPI32.dll_NetUserChangePassword]
mov ecx, eax
test ecx, ecx
je 0x46cf0a
cmp ecx, 0x8c5
je 0x46cf0a
xor eax, eax
cmp ecx, 0x56
sete al
dec eax
ret
xor eax, eax
inc eax
ret
Function at 0x46cf49
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push str.CheckPwdTime
mov edx, str.Software360360huabao
movlpd qword [esp + 0x20], xmm0
call fcn.004265a6
xor ebx, ebx
mov esi, str._anonymous_namespace::InitHaveSystem
pop ecx
pop ecx
cmp dword [esp + 0x1c], ebx
jl 0x46cfc1
jg 0x46cf89
cmp dword [esp + 0x18], ebx
jbe 0x46cfc1
push ebx
call fcn.005c35ca
sub eax, dword [esp + 0x1c]
pop ecx
sbb edx, dword [esp + 0x1c]
cmp edx, ebx
jg 0x46cfd4
jl 0x46cfa5
cmp eax, 0x13c680
jae 0x46cfd4
push 0xa9
push str._anonymous_namespace::InitHaveSystem
push str.__s__d___HealthMgr::check_pwd_in_interval
call fcn.0040a649
add esp, 0xc
jmp 0x46d07e
push 0xaf
push esi
push str.__s__d___HealthMgr::check_pwd_not_in_interval
call fcn.0040a649
add esp, 0xc
push 0xb2
push esi
push str.__s__d___HealthMgr::has_system_screen_saver
call fcn.0040a649
add esp, 0xc
cmp dword [0x6d4640], 0xffffffff
jne 0x46d07e
push ebx
push ebx
push 1
push ebx
mov dword [0x6d4640], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov dword [esp + 0xc], ebx
lea eax, [esp + 0xc]
push eax
push ebx
push edi
push 0x46cf0e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.005c35ca
pop ecx
mov dword [esp + 0x10], eax
mov ebx, str.Software360360huabao
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
push str.CheckPwdTime
mov edx, ebx
call fcn.00426586
mov eax, dword [0x6d4640]
mov edx, ebx
mov dword [esp + 0x18], eax
mov ecx, reloc.WS2_32.dll_accept
lea eax, [esp + 0x18]
push eax
push str.SystemHasPwd
call fcn.00426539
add esp, 0x10
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46dfff
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x270
mov eax, 0x5e9f05
call fcn.0059bbd7
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, dword [ebp + 8]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x27c], edi
push ebx
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00404267
lea ecx, [ebp - 0x278]
call fcn.00435b82
add esp, 0x18
mov dword [ebp - 4], esi
cmp dword [eax + 0x14], 8
jb 0x46e049
mov eax, dword [eax]
push eax
push 0x226
push str.HealthMgr::NotifyPopDialog
push str.__s__d___NotifyPopDialog_data_s__msgId_d
call fcn.0040a649
add esp, 0x14
lea ecx, [ebp - 0x278]
call fcn.0040b67e
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.004ca551
mov esi, str.serverpopmsg_
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040b220
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46e0ec
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x218]
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
cmovae esi, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x64a5a8
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040b0d5
push 0x627e3e
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.004045aa
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 3
mov ecx, ebx
call fcn.004168cd
cmp dword [ebp - 0x234], 0x10
lea edx, [ebp - 0x248]
push dword [ebp - 0x238]
cmovae edx, dword [ebp - 0x248]
lea ecx, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
cmovae ecx, dword [ebp - 0x260]
call fcn.0041e514
sub esp, 0x14
lea eax, [ebp - 0x260]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040b155
mov ecx, edi
call fcn.00435a2c
add esp, 0x18
lea ecx, [ebp - 0x248]
call fcn.00404812
lea ecx, [ebp - 0x260]
call fcn.0040b67e
lea ecx, [ebp - 0x230]
call fcn.0040b67e
mov eax, edi
call fcn.0059bb81
ret 0xc
Function at 0x47388a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x6deab0], 1
push esi
push edi
mov esi, ecx
jne 0x4738b5
push 0x784
push str.HealthMgr::StartMangoTvReport
push str.__s__d___report_mangotv_thread_is_exists_
call fcn.0040a649
add esp, 0xc
jmp 0x473910
lea eax, [ebp - 4]
xor edi, edi
push eax
push str.mango_tv_healthCheck
mov edx, str.Software360360huabaohuabao
mov dword [ebp - 4], edi
mov ecx, reloc.WS2_32.dll_accept
call fcn.004261bf
cmp dword [ebp - 4], 1
pop ecx
pop ecx
jne 0x473910
push 0x78c
push str.HealthMgr::StartMangoTvReport
push str.__s__d___start_report_heart_theard_
call fcn.0040a649
add esp, 0xc
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x472873
push edi
push edi
call fcn.005c30ff
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x473914
Capabilities:
Read .ini file

Disassembly:
push 0x810
mov eax, 0x5eaa0d
call fcn.0059bbd7
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x81c], edi
push eax
mov dword [ebp - 0x814], eax
lea eax, [ebp - 0x810]
push eax
call fcn.005b24a0
add esp, 0xc
lea eax, [ebp - 0x810]
push esi
push 0x400
push eax
xor esi, esi
push esi
push esi
push str.dotData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x814], 1
test ebx, ebx
je 0x4739d3
push 2
mov eax, esi
xor ecx, ecx
pop esi
cmp word [ebp + esi - 0x812], cx
jne 0x4739cb
lea ecx, [ebp - 0x810]
add ecx, eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x818], ecx
cmp dword [edi + 8], eax
je 0x4739b8
push ecx
mov ecx, eax
call fcn.0040b0d5
add dword [edi + 4], 0x18
jmp 0x4739c7
lea ecx, [ebp - 0x818]
push ecx
push eax
mov ecx, edi
call fcn.0047f7b0
mov eax, esi
xor ecx, ecx
add esi, 2
sub ebx, 1
jne 0x47398a
mov eax, edi
call fcn.0059bb81
ret 0xc

Function at 0x4739dd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x3ec]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x3e8
push 0
push eax
mov dword [ebp - 0x3f0], edi
call fcn.005b24a0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x473a20
mov esi, dword [esi]
push ebx
push 0x1f4
lea eax, [ebp - 0x3ec]
push eax
push 0
push esi
push str.dotData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
lea ecx, [ebp - 0x3ec]
mov edx, 0x6335fc
cmove ecx, edx
push ecx
mov ecx, edi
call fcn.0040b0d5
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059a7a2
leave
ret 0x10