joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41717b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
xor eax, eax
cmp dword [esi + 8], edi
jne 0x417245
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.0044c960
push str.safemonBootLeakFixer.tpi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
test eax, eax
je 0x4171fb
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
cmp eax, edi
je 0x4171fb
push str.CreateEvtPubChannel
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4171fb
call eax
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x24]
cmp ecx, edi
je 0x417243
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
je 0x417243
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
lea eax, [ebp - 0x210]
push eax
push edi
push esi
push 0x41716f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
cmp eax, edi
jne 0x41723c
mov dword [esi + 8], edi
xor eax, eax
jmp 0x417246
mov dword [esi + 8], 1
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x417254
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4172db
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4172db
xor ecx, ecx
cmp cx, word [eax]
je 0x4172db
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4172db
and dword [ebp + 8], ecx
lea ecx, [ebp + 8]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4172db
lea eax, [esi + esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.Path
push dword [ebp + 8]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [edi]
je 0x4172d2
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
call fcn.0044cbfc
pop ecx
jmp 0x4172dd
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4172e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3c4]
mov esi, 0x208
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x80], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360EDRSensor.exe
mov dword [ebp - 0x7c], 0x200
mov dword [ebp - 0x78], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsMMScan.exe
mov dword [ebp - 0x74], 0x400
mov dword [ebp - 0x70], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360asset.exe
mov dword [ebp - 0x6c], 0x800
call fcn.0044c960
add esp, 0xc
push 0x104
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edi, edi
push esi
lea eax, [ebp + 0x1b0]
push ebx
push eax
call fcn.0044c960
mov eax, dword [ebp + edi*8 - 0x80]
lea ecx, [ebp + 0x1b0]
add esp, 0xc
test ecx, ecx
je 0x4173f9
cmp eax, ebx
je 0x4173f9
xor ecx, ecx
cmp cx, word [eax]
je 0x4173f9
lea ecx, [ebp - 0x5c]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417420
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push str.Path
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x68], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp + 0x1b0]
je 0x4173ea
lea eax, [ebp + 0x1b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp + 0x1b0]
push eax
call fcn.0044cbfc
pop ecx
jmp 0x4173fb
xor eax, eax
cmp eax, ebx
je 0x417420
xor ecx, ecx
cmp cx, word [ebp + 0x1b0]
je 0x417420
push eax
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x41742e
inc edi
cmp edi, 3
jl 0x417356
mov eax, ebx
jmp 0x41743c
mov eax, dword [ebp + edi*8 - 0x7c]
cmp eax, 0x200
jne 0x41743c
add eax, 0x40
mov ecx, dword [ebp + 0x3b8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3bc
leave
ret

Function at 0x417708
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x483114], 0
push esi
mov esi, ecx
jne 0x41777c
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0044c960
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41774d
lea ecx, [ebp - 0x24]
push ecx
call eax
jmp 0x417757
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc eax
cmp word [ebp - 0x24], 9
je 0x417771
cmp word [ebp - 0x24], 6
je 0x417771
and dword [esi + 0x788], 0
jmp 0x417777
mov dword [esi + 0x788], eax
mov dword [0x483114], eax
mov eax, dword [esi + 0x788]
pop esi
leave
ret
Function at 0x417785
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x483118], 0
push esi
mov esi, ecx
jne 0x41780b
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
xor edi, edi
lea eax, [ebp - 0x20a]
inc edi
push eax
mov dword [0x483118], edi
call fcn.0044c960
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....360entclient.exe
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41780a
mov dword [esi + 0x790], edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x790]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x417842
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044c960
push str.ipcDataProt.exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0044cbcc
leave
ret

Function at 0x4178d1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x41b
push 0xc0000
call fcn.0041102c
pop ecx
pop ecx
test eax, eax
je 0x4179bb
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0044c960
xor eax, eax
push esi
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.0044c960
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0044c960
push str.safemonDevicePro.exe
mov esi, 0x104
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00412517
push str.Config_newui_themesdefault_theme_DevicePro.xml
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00412517
push str.Config_newui_themesdefaultDeviceProDevicePro_theme.ui
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00412517
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x48
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x4179b8
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x4179b8
lea eax, [ebp - 0x61c]
push eax
call esi
test eax, eax
je 0x4179b8
xor eax, eax
inc eax
jmp 0x4179ba
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044cbcc
leave
ret
Function at 0x417b72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417bdb
cmp dword [ebp + 0x10], 1
je 0x417bb3
cmp dword [ebp + 0x10], 2
je 0x417bb3
push 0xd
pop eax
jmp 0x417bdb
mov eax, dword [ebp - 4]
test edi, edi
je 0x417bd5
test eax, eax
je 0x417bd0
test al, 1
jne 0x417bae
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x417bd5
jmp 0x417bae
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x417d1c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x417d80
test esi, esi
je 0x417d80
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044c960
push esi
push edi
push 0x46a7e4
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041214c
add esp, 0x20
test eax, eax
jl 0x417d80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x417d82
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret
Function at 0x418031
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
mov eax, dword [ebp + 0x3ac]
push ebx
push esi
push edi
mov esi, 0x208
push esi
mov dword [ebp - 0x78], eax
xor edi, edi
lea eax, [ebp + 0x198]
push edi
push eax
call fcn.0044c960
lea eax, [ebp + 0x198]
add esp, 0xc
test eax, eax
je 0x418104
xor ecx, ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
cmp ecx, eax
je 0x418104
lea ecx, [ebp - 0x74]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x74], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418176
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push str.Path
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp + 0x198]
je 0x4180f3
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp + 0x198]
push eax
call fcn.0044cbfc
pop ecx
mov ebx, eax
jmp 0x418106
xor ebx, ebx
cmp ebx, edi
je 0x418176
xor eax, eax
cmp ax, word [ebp + 0x198]
je 0x418176
cmp dword [ebp + 0x3b0], edi
je 0x418156
push esi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.0044c960
add esp, 0xc
push 0x104
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
neg eax
sbb eax, eax
inc eax
je 0x418172
lea eax, [ebp + 0x198]
push str.360SkinMgr.exe
push eax
call fcn.00417d1c
pop ecx
pop ecx
test eax, eax
je 0x418172
mov edi, 0x1000
mov eax, edi
jmp 0x418178
xor eax, eax
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a4
leave
ret
Function at 0x418190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3ac]
mov esi, 0x208
xor ebx, ebx
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x74], ebx
call fcn.0044c960
add esp, 0xc
push 0x104
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.0044c960
lea eax, [ebp + 0x198]
add esp, 0xc
test eax, eax
je 0x41827f
xor ecx, ecx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360ExtHost.exe
cmp ecx, eax
je 0x41827f
lea ecx, [ebp - 0x78]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4182d0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp + 0x198]
je 0x418270
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp + 0x198]
push eax
call fcn.0044cbfc
pop ecx
jmp 0x418281
xor eax, eax
cmp eax, ebx
je 0x4182d0
xor ecx, ecx
cmp cx, word [ebp + 0x198]
je 0x4182d0
push eax
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4182cb
lea eax, [ebp + 0x198]
push str.safemonwin7shield.dll
push eax
mov dword [ebp - 0x74], 0x40
call fcn.00417d1c
pop ecx
pop ecx
test eax, eax
je 0x4182cb
mov dword [ebp - 0x74], 0x140
mov eax, dword [ebp - 0x74]
jmp 0x4182d2
xor eax, eax
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a4
leave
ret
Function at 0x4183f8
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
mov esi, 0x208
push esi
xor ebx, ebx
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0044c960
push esi
lea eax, [ebp + 0x19c]
push ebx
push eax
call fcn.0044c960
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x78]
push eax
push str.ImagePath
mov dword [ebp - 0x80], esi
xor edi, edi
push str.SOFTWARE360Safe_tpi360Cactus
mov esi, reloc.OLEAUT32.dll_SysReAllocString
inc edi
push esi
mov dword [ebp - 0x78], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x41846f
xor eax, eax
jmp 0x418511
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call fcn.004088c2
lea ecx, [ebp - 0x74]
test eax, eax
je 0x418499
call fcn.0040884d
jmp 0x418468
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push str.Path
mov dword [ebp - 0x7c], 0x104
call fcn.00417b72
test eax, eax
je 0x4184bb
lea ecx, [ebp - 0x74]
jmp 0x418492
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.360leakfixer.exe
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x19c]
push eax
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp + 0x19c]
push eax
call ebx
test eax, eax
jne 0x4184b6
push str.hipsver.dll
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x19c]
push eax
call esi
lea eax, [ebp + 0x19c]
push eax
call ebx
test eax, eax
jne 0x418507
xor edi, edi
lea ecx, [ebp - 0x74]
call fcn.0040884d
mov eax, edi
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a8
leave
ret

Function at 0x418652
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x483130], 0
push esi
mov esi, ecx
jne 0x4186e1
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [0x483130], 1
call fcn.0044c960
push str.safemon360webpro.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4186e1
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
test eax, eax
je 0x4186e1
push str.IsSupported
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4186e1
call eax
mov dword [esi + 0x748], eax
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x748]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret
Function at 0x4186f4
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp + 0x194], ax
xor ebx, ebx
lea eax, [ebp + 0x196]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x7c], edi
call fcn.0044c960
push str.safemon360safecamera.tpi
mov esi, 0x104
lea eax, [ebp + 0x194]
push esi
push eax
call fcn.00412517
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x194]
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call fcn.00410611
add esp, 0x24
test eax, eax
je 0x418818
mov eax, 0x20000
cmp dword [ebp - 0x78], eax
ja 0x41878d
jne 0x418818
cmp dword [ebp - 0x80], 0x3e9
jb 0x418818
cmp dword [0x483134], ebx
je 0x41879d
mov eax, dword [edi + 0x754]
jmp 0x41881a
push 0x208
xor edi, edi
lea eax, [ebp - 0x74]
push ebx
inc edi
push eax
mov dword [0x483134], edi
call fcn.0044c960
push str.ipcDrvUtility.dll
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41880d
lea eax, [ebp - 0x74]
push eax
call fcn.0040aa22
mov esi, eax
pop ecx
cmp esi, ebx
je 0x41880d
push str.CheckSupportOs
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x418806
push 6
call eax
cmp eax, edi
jne 0x418806
mov eax, dword [ebp - 0x7c]
mov dword [eax + 0x754], edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0x754]
jmp 0x41881a
xor eax, eax
mov ecx, dword [ebp + 0x39c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a0
leave
ret

Function at 0x418832
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x483138], 0
push edi
mov edi, ecx
jne 0x4188d7
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push 0
inc esi
push eax
mov dword [0x483138], esi
call fcn.0044c960
push str.ipcDrvUtility.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4188d6
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0040aa22
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4188d5
push str.CheckSupportOs
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4188ce
push 5
call eax
cmp eax, esi
jne 0x4188ce
mov dword [edi + 0x74c], esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x74c]
xor ecx, ebp
pop edi
call fcn.0044cbcc
leave
ret
Function at 0x4188ea
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x48313c], 0
push esi
mov esi, ecx
jne 0x418999
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push 0
inc edi
push eax
mov dword [0x48313c], edi
call fcn.0044c960
push str.ipcDrvUtility.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418998
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0040aa22
mov ebx, eax
pop ecx
test ebx, ebx
je 0x418997
push str.CheckSupportOs
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418990
push 9
call eax
cmp eax, 4
je 0x418990
cmp eax, 9
je 0x418990
test eax, eax
je 0x418990
mov dword [esi + 0x750], edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x750]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x4189ac
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x18c], eax
cmp dword [0x483140], 0
push esi
mov esi, ecx
mov dword [ebp - 0x80], esi
jne 0x418a66
push 0x208
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [0x483140], 1
call fcn.0044c960
push str.safemon360SoftPrivMgr.dll
lea eax, [ebp - 0x7c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418a66
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.0040aa22
mov edi, eax
pop ecx
test edi, edi
je 0x418a65
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.SetState
push edi
call esi
push str.GetState
push edi
mov ebx, eax
call esi
test ebx, ebx
pop ebx
je 0x418a50
test eax, eax
je 0x418a50
xor eax, eax
inc eax
jmp 0x418a52
xor eax, eax
mov ecx, dword [ebp - 0x80]
push edi
mov dword [ecx + 0x75c], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x80]
pop edi
mov ecx, dword [ebp + 0x18c]
mov eax, dword [esi + 0x75c]
xor ecx, ebp
pop esi
call fcn.0044cbcc
add ebp, 0x190
leave
ret
Function at 0x418a82
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x483144], 0
push esi
mov esi, ecx
jne 0x418b1c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [0x483144], 1
call fcn.0044c960
push str.Utils360seclogon360DBGuard.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418b1c
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040aa22
mov edi, eax
pop ecx
test edi, edi
je 0x418b1b
push str.IsSupport
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418b14
call eax
mov dword [esi + 0x760], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x760]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x418b2f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x483148], 0
push esi
mov esi, ecx
jne 0x418bc1
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [0x483148], 1
call fcn.0044c960
push str.Utils360Protect.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418bc1
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
test eax, eax
je 0x418bc1
push str.IsSupport
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418bc1
push 0x2c
call eax
pop ecx
mov dword [esi + 0x768], eax
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x768]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x418bd4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x48314c], 0
push esi
mov esi, ecx
jne 0x418c66
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [0x48314c], 1
call fcn.0044c960
push str.Utils360Protect.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418c66
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
test eax, eax
je 0x418c66
push str.IsSupport
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418c66
push 0x30
call eax
pop ecx
mov dword [esi + 0x76c], eax
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x76c]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret