joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454e5a
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x14
mov eax, 0x48b333
call fcn.004677c7
mov edi, ecx
call fcn.0044a074
xor ebx, ebx
cmp eax, ebx
je 0x454ffd
mov ecx, eax
call fcn.0044c8ca
mov esi, eax
cmp esi, ebx
je 0x454ffd
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00454dc8
push dword [ebp - 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x454ff2
push str.componentsguard360bpsvc.exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040d822
push str.componentsguarddownload360bprot.sys
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0040d822
push str.componentsguarddownload360bprot64.sys
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.0040d822
push str.componentsguardhookport.sys
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.0040d822
add esp, 0x30
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
call edi
test eax, eax
je 0x454fc6
push ebx
push dword [ebp - 0x10]
call fcn.00402032
pop ecx
pop ecx
test eax, eax
je 0x454fc6
lea ecx, [ebp]
call fcn.00402ffd
lea eax, [ebp]
push eax
mov byte [ebp - 4], 5
call fcn.004034f5
push dword [ebp - 0x18]
test eax, eax
je 0x454f6c
call edi
test eax, eax
je 0x454fba
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x454fba
xor edi, edi
inc edi
jmp 0x454f92
call edi
test eax, eax
je 0x454fba
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x454fba
mov eax, dword [esi]
push 0xffffffffffffffff
push ebx
xor edi, edi
inc edi
push edi
push edi
push ebx
push str.install_hookport
push dword [ebp - 0x10]
push esi
call dword [eax + 0x24]
mov eax, dword [esi]
push 0xffffffffffffffff
push ebx
push edi
push edi
push ebx
push str.install_360bprot
push dword [ebp - 0x10]
push esi
call dword [eax + 0x24]
mov eax, dword [esi]
push 0xffffffffffffffff
push ebx
push edi
push edi
push ebx
push str.install_service
push dword [ebp - 0x10]
push esi
call dword [eax + 0x24]
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.004030ca
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x124
leave
ret
Function at 0x4551e7
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 8
mov eax, 0x48b38e
call fcn.004677c7
mov esi, ecx
xor ebx, ebx
push ebx
push ebx
push 0x1422
mov ecx, 0x4c37f8
call fcn.00428caf
mov ecx, esi
call fcn.0044a074
push 0x4c4f30
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00401ce4
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x455258
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.0044d9fe
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401d13
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push str.modules360Inst.exe
lea ecx, [ebp - 0x14]
call fcn.00402f00
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x455286
push ebx
push edi
call fcn.00402032
pop ecx
pop ecx
test eax, eax
je 0x455286
push 5
push ebx
push str._URL:http:__pinst.360.cn_360safebeta_uninst_instbeta.cab
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4552b1
push str.https:__dl.360safe.com_instbeta.exe
lea ecx, [ebp - 0x10]
call fcn.004029f9
push 5
push ebx
push dword [ebp - 0x10]
push str.explorer.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
cmp dword [esi + 8], ebx
je 0x4552bf
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x1c]
mov ecx, esi
call fcn.0044a0dc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4552d5
lea ecx, [edi - 0x10]
jmp 0x4553f9
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x40e
push dword [esi + 4]
call edi
cmp eax, ebx
je 0x455314
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x455314
push ebx
push ebx
push 0x141f
mov ecx, 0x4c37f8
call fcn.00428caf
mov ecx, dword [ebp - 0x10]
call fcn.00420df8
push 0x40f
push dword [esi + 4]
call edi
cmp eax, ebx
je 0x45534d
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x45534d
push ebx
push ebx
push 0x1420
mov ecx, 0x4c37f8
call fcn.00428caf
mov ecx, dword [ebp - 0x10]
call fcn.00420cfb
mov ecx, dword [ebp - 0x10]
call fcn.00421915
test eax, eax
je 0x455392
push 0x410
push dword [esi + 4]
call edi
cmp eax, ebx
je 0x455392
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x455392
push ebx
push ebx
push 0x1421
mov ecx, 0x4c37f8
call fcn.00428caf
mov ecx, dword [ebp - 0x10]
call fcn.00421857
mov edi, dword [ebp - 0x10]
mov ecx, edi
call fcn.0042175c
mov ecx, edi
call fcn.004210e9
mov ecx, edi
call fcn.00420f75
mov ecx, edi
call fcn.00422a32
mov ecx, esi
call fcn.00454e5a
cmp dword [esi + 8], ebx
je 0x4553ec
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push 1
call dword [eax + 0x20]
cmp dword [esi + 8], ebx
je 0x4553ec
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x4553ec
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax]
mov ecx, eax
call fcn.0044c6fc
mov ecx, eax
call fcn.0041fbe5
mov ecx, esi
call fcn.004543a4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e9
call fcn.0046789f
ret
Function at 0x455884
Capabilities:
Check if file exists
Get common file path
Get file size

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x398], eax
push esi
push edi
xor esi, esi
push esi
push 0x1a
lea eax, [ebp - 0x78]
push eax
push esi
xor edi, edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x455946
xor eax, eax
push 0x206
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push esi
push eax
call fcn.004670a0
add esp, 0xc
push str.360safeMobileAssistantlocalId.dat
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x455946
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x455946
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45594d
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x455946
cmp dword [ebp - 0x7c], esi
jl 0x455946
jg 0x455943
cmp dword [ebp - 0x80], esi
jbe 0x455946
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x398]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0046711a
add ebp, 0x39c
leave
ret

Function at 0x455b8b
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.http:__zt.360.cn_heixiazi.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x455d76
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x10]
call fcn.0040206b
test eax, eax
jne 0x455d8c
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x456408
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 4
mov eax, 0x48794e
call fcn.004677c7
mov edi, ecx
call fcn.0044a099
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x4564cc
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0044a074
cmp eax, esi
je 0x4564c1
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.0044d477
push 0x800
lea eax, [ebp]
push esi
push eax
call fcn.004670a0
add esp, 0xc
push str.firstaidSuperKiller.exe
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4564ac
mov eax, dword [ebx]
push 0xffffffffffffffff
push esi
push esi
push 1
push 5
push esi
lea ecx, [ebp]
push ecx
push ebx
call dword [eax + 0x24]
jmp 0x4564c1
push 1
push esi
push esi
push str.http:__down.360safe.com_SuperKiller.zip
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret

Function at 0x456666
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 4
mov eax, 0x48794e
call fcn.004677c7
mov esi, ecx
call fcn.0044a099
mov edi, eax
test edi, edi
je 0x456715
push 0x4c4f30
lea ecx, [ebp - 0x10]
call fcn.00401ce4
and dword [ebp - 4], 0
mov ecx, esi
call fcn.0044a074
test eax, eax
je 0x45670a
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.0044d477
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push str.360DiagnoseScan.exe
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45670a
mov eax, dword [edi]
push 0xffffffffffffffff
push 0
push 0
push 1
push 5
push str._locateproblem11001
lea ecx, [ebp]
push ecx
push edi
call dword [eax + 0x24]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret
Function at 0x457953
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x6c
mov eax, 0x48b5ad
call fcn.004677c7
xor esi, esi
mov dword [ebp - 0x14], 1
cmp dword [ecx + 0x84], esi
je 0x457990
mov dword [ebp - 0x14], esi
jmp 0x457aeb
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, esi
je 0x457aeb
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push esi
push eax
call fcn.004670a0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x208]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x457aeb
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
push ebx
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.004670a0
add esp, 0xc
push str.ConfigChildDeskTop.ini
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x457aeb
lea ecx, [ebp - 0x78]
call fcn.0040673f
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004029f9
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00406811
mov ecx, dword [ebp - 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
mov byte [ebp - 4], 0
call fcn.004023e9
test bl, bl
jne 0x457adf
push 0x4999a4
lea ecx, [ebp - 0x10]
call fcn.004029f9
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 2
call fcn.0040691c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov ebx, eax
mov byte [ebp - 4], 0
call fcn.004023e9
cmp ebx, esi
je 0x457adf
push str.canpopup
lea ecx, [ebp - 0x18]
call fcn.004029f9
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.004065b0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov ebx, eax
mov byte [ebp - 4], 0
call fcn.004023e9
cmp ebx, esi
je 0x457adf
push 0x491d2c
lea ecx, [ebx + 4]
call fcn.00407163
test eax, eax
jne 0x457adf
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004067ca
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x414
leave
ret
Function at 0x457d73
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0x78], 4
push edi
je 0x457e75
call fcn.00455884
xor ebx, ebx
inc ebx
xor ebp, ebp
test eax, eax
je 0x457dd0
mov ecx, esi
mov dword [esi + 0x84], ebx
call fcn.0044a074
push dword [esi + 4]
lea edi, [esi + 0x94]
push eax
mov ecx, edi
call fcn.00441e29
push ebp
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ecx, edi
call fcn.00456823
cmp eax, ebx
je 0x457ea3
cmp eax, 2
je 0x457ea3
mov ecx, esi
call fcn.00457b11
test eax, eax
je 0x457e08
push str.360DirectUICls_SwitchBar
push str.360DirectUICls
call dword [sym.imp.USER32.dll_FindWindowW]
push 2
push ebp
push 0x2278
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x20]
jmp 0x457ea3
cmp dword [esi + 0x78], 5
mov ecx, esi
jne 0x457e1c
push 0x208
call fcn.0044a0ed
jmp 0x457e32
push 0x206
call fcn.0044a0ed
push 0xfae
mov ecx, esi
call fcn.0044a108
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push ebp
push eax
mov dword [esp + 0x18], eax
call edi
push ebp
push ebp
push esi
push 0x45793f
push ebp
push ebp
mov dword [0x4c6514], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebp
je 0x457e6c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x457ea3
push ebx
push dword [esp + 0x14]
call edi
jmp 0x457ea3
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push 1
call dword [eax + 0x20]
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x204
mov ecx, esi
call fcn.0044a0ed
push 0xfaf
mov ecx, esi
call fcn.0044a108
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x457eac
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0044a074
xor ebx, ebx
inc ebx
cmp dword [esi + 0x78], 4
mov ebp, eax
jne 0x457f35
mov ecx, esi
call fcn.00455884
test eax, eax
je 0x457f05
push dword [esi + 4]
lea edi, [esi + 0x94]
push ebp
mov ecx, edi
mov dword [esi + 0x84], ebx
call fcn.00441e29
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ecx, edi
call fcn.00456823
cmp eax, ebx
je 0x45808b
cmp eax, 2
je 0x45808b
mov ecx, esi
call fcn.00457b11
test eax, eax
je 0x457f35
push str.360DirectUICls_SwitchBar
push str.360DirectUICls
call dword [sym.imp.USER32.dll_FindWindowW]
push 2
push 0
push 0x2278
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x45807c
test ebp, ebp
je 0x45808b
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x457f68
push 0x202
mov ecx, esi
call fcn.0044a0ed
push 0xfab
mov ecx, esi
call fcn.0044a108
mov ecx, esi
call fcn.004564ef
jmp 0x45807c
cmp eax, ebx
jne 0x457f84
push 0x200
mov ecx, esi
call fcn.0044a0ed
mov ecx, esi
call fcn.0045c363
jmp 0x45807c
cmp eax, 2
jne 0x457fad
push 0x201
mov ecx, esi
call fcn.0044a0ed
push 0xfb5
mov ecx, esi
call fcn.0044a108
mov ecx, esi
call fcn.00456408
jmp 0x45807c
cmp eax, 3
jne 0x457fde
push 0x205
mov ecx, esi
call fcn.0044a0ed
push 0xfb6
mov ecx, esi
call fcn.0044a108
mov esi, dword [esi + 8]
test esi, esi
je 0x45808b
mov eax, dword [esi]
mov ecx, esi
jmp 0x458081
cmp eax, 4
jne 0x458036
push 0x203
mov ecx, esi
call fcn.0044a0ed
push 0xfae
mov ecx, esi
call fcn.0044a108
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov ebp, eax
push 0
push ebp
call edi
xor eax, eax
push eax
push eax
push esi
push 0x45793f
push eax
push eax
mov dword [0x4c6514], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x458087
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45808b
cmp eax, 5
jne 0x458058
mov ecx, esi
call fcn.00456bab
push 0x207
mov ecx, esi
call fcn.0044a0ed
push 0xfac
jmp 0x457fc3
cmp eax, 6
jne 0x45808b
push 0x209
mov ecx, esi
call fcn.0044a0ed
push 0xfad
mov ecx, esi
call fcn.0044a108
mov ecx, esi
call fcn.00456666
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x20]
jmp 0x45808b
push ebx
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x458090
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x48b62e
call fcn.004677c7
mov esi, ecx
xor edi, edi
push edi
push 0x458
call fcn.00455ac4
push edi
push 0x459
mov ecx, esi
call fcn.00455ac4
push edi
push 0x45a
mov ecx, esi
call fcn.00455ac4
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x438
push ebx
push dword [esi + 4]
call edi
push dword [esi + 0x8c]
mov ecx, esi
push dword [esi + 0x88]
push eax
call fcn.0044a2e8
push str.SetupBlackboard.png
lea ecx, [ebp - 0x10]
call fcn.004029f9
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push ebx
mov ecx, esi
call fcn.00456373
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
xor ebx, ebx
inc ebx
push ebx
push 0x439
mov ecx, esi
call fcn.00455da6
push 0x45b
push dword [esi + 4]
call edi
xor edi, edi
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
lea ecx, [ebp - 0x28]
call fcn.00457cb2
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], edi
je 0x45816f
mov eax, dword [ebp - 0x20]
mov esi, eax
cmp eax, edi
je 0x45816f
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x4c]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x4c]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e9
call fcn.0046789f
ret

Function at 0x458da6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.00455ba3
mov ecx, esi
call fcn.004569f0
mov ecx, esi
call fcn.00458c1f
mov ecx, esi
pop esi
jmp fcn.00456e4c

Function at 0x459205
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
pop esi
jmp method.CSetupPageImpl_class_CPromoteDialog__3_.virtual_8
Function at 0x459b68
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x1804]
mov eax, 0x1804
call fcn.00467130
push 0xffffffffffffffff
push 0x48b80a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x1800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0044a074
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x459d5f
push 0x4c4f30
lea ecx, [ebp - 0x14]
call fcn.00401ce4
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0044d477
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0044d9fe
push dword [ebp - 0x18]
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.360net.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040d822
add esp, 0xc
push dword [ebp - 0x20]
mov byte [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x459c19
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x800
push ebx
lea eax, [ebp + 0x800]
push edi
push eax
call fcn.004670a0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x499e80
push dword [ebp - 0x14]
lea eax, [ebp + 0x800]
push eax
call esi
push edi
push dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp + 0x800]
push eax
call edi
push str.360Base.dll
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d822
add esp, 0xc
push dword [ebp - 0x1c]
mov byte [ebp - 4], 3
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x459c88
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push 0x498000
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
call esi
push 0
push dword [ebp - 0x1c]
lea eax, [ebp]
push eax
call edi
push str.modules
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040d822
add esp, 0xc
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.360Inst.exe
lea ecx, [ebp - 0x10]
call fcn.00402f00
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x459cf7
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp + 0x1000]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push 0x496604
push dword [ebp - 0x14]
lea eax, [ebp + 0x1000]
push eax
call esi
push 0
push dword [ebp - 0x10]
lea eax, [ebp + 0x1000]
push eax
call edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x1804
leave
ret
Function at 0x45a542
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x6c
mov eax, 0x48b5ad
call fcn.004677c7
xor edi, edi
push edi
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
cmp ebx, edi
je 0x45a6c8
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x45a6c8
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
push esi
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.004670a0
add esp, 0xc
push str.ConfigChildDeskTop.ini
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a6c8
lea ecx, [ebp - 0x78]
call fcn.0040673f
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.004029f9
push edi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00406811
mov ecx, dword [ebp - 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
mov byte [ebp - 4], 0
call fcn.004023e9
test bl, bl
jne 0x45a6bc
push 0x4999a4
lea ecx, [ebp - 0x10]
call fcn.004029f9
push edi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 2
call fcn.0040691c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
mov byte [ebp - 4], bl
call fcn.004023e9
cmp esi, edi
je 0x45a6bc
push str.canpopup
lea ecx, [ebp - 0x18]
call fcn.004029f9
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004065b0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov esi, eax
mov byte [ebp - 4], bl
call fcn.004023e9
cmp esi, edi
je 0x45a6bc
push 0x491d2c
lea ecx, [esi + 4]
call fcn.00407163
test eax, eax
jne 0x45a6bc
mov dword [ebp - 0x14], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004067ca
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x414
leave
ret