joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c79
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x483150], 0
push esi
mov esi, ecx
jne 0x418d13
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [0x483150], 1
call fcn.0044c960
push str.safemonieplus.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418d13
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040aa22
mov edi, eax
pop ecx
test edi, edi
je 0x418d12
push str.IsSupport
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418d0b
call eax
mov dword [esi + 0x770], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x770]
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret
Function at 0x418d26
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x638]
imul edi, edi, 0xa
add edi, dword [esi + 0x63c]
cmp dword [0x483160], 0
jne 0x418dc6
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0044c960
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x418dc6
push str._ntoskrnl.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x418dc6
lea eax, [ebp - 0x20c]
push 0x483158
push eax
call fcn.00413c79
pop ecx
pop ecx
test eax, eax
je 0x418dc6
mov dword [0x483160], 1
movzx eax, word [0x48315e]
movzx edx, word [0x48315c]
mov ecx, eax
imul ecx, ecx, 0xa
add ecx, edx
cmp edi, ecx
jge 0x418df2
mov dword [esi + 0x638], eax
movzx eax, word [0x48315c]
mov dword [esi + 0x63c], eax
mov eax, dword [0x47d024]
mov ecx, ebx
mov dword [ebx], eax
call fcn.0040e62e
mov eax, dword [esi + 0x638]
xor edi, edi
cmp eax, 5
jne 0x418e5f
cmp dword [esi + 0x63c], edi
jne 0x418e1f
push str.win2k
jmp 0x418f2b
cmp eax, 5
jne 0x418e5f
cmp dword [esi + 0x63c], 1
jne 0x418e37
push str.winxp
jmp 0x418f2b
cmp eax, 5
jne 0x418e5f
cmp dword [esi + 0x63c], 2
jne 0x418e5f
cmp dword [esi + 0x78c], edi
je 0x418e55
cmp dword [esi + 0x788], edi
jne 0x418e2d
push str.win2003
jmp 0x418f2b
push 6
pop ecx
cmp eax, ecx
jne 0x418ed9
cmp dword [esi + 0x63c], edi
jne 0x418e8c
mov ecx, ebx
cmp dword [esi + 0x78c], edi
jne 0x418e82
push str.win2008
jmp 0x418f2d
push str.vista
jmp 0x418f2d
cmp eax, ecx
jne 0x418ed9
cmp dword [esi + 0x63c], 1
jne 0x418eb4
mov ecx, ebx
cmp dword [esi + 0x78c], edi
jne 0x418ead
push str.win2008R2
jmp 0x418f2d
push str.win7
jmp 0x418f2d
cmp eax, ecx
jne 0x418ed9
cmp dword [esi + 0x63c], 2
jne 0x418ed9
mov ecx, ebx
cmp dword [esi + 0x78c], edi
jne 0x418ed2
push str.win2012
jmp 0x418f2d
push str.win8
jmp 0x418f2d
cmp eax, 0xa
jne 0x418ef5
cmp dword [esi + 0x63c], edi
jne 0x418ef5
cmp dword [esi + 0x78c], edi
je 0x418f32
push str.win10
jmp 0x418f2b
cmp eax, ecx
jne 0x418f32
cmp dword [esi + 0x63c], 3
jb 0x418f11
cmp dword [esi + 0x78c], edi
je 0x418f32
push str.win81later
jmp 0x418f2b
cmp eax, ecx
jne 0x418f32
cmp dword [esi + 0x63c], 2
jb 0x418f32
cmp dword [esi + 0x78c], edi
je 0x418f32
push str.win8later
mov ecx, ebx
call fcn.0040ad64
mov eax, dword [ebx]
cmp dword [eax - 8], edi
je 0x418f4d
cmp dword [esi + 0x788], edi
je 0x418f4d
push 0x46c9d0
mov ecx, ebx
call fcn.00409730
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0044cbcc
leave
ret 4
Function at 0x4286ba
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
push ebx
mov ebx, dword [ebp + 0x1c4]
push esi
push edi
mov edi, dword [ebp + 0x1c0]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x428770
push 0x228
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.0044c960
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push esi
mov dword [ebp - 0x78], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x428769
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x70]
je 0x42875b
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.00451160
pop ecx
pop ecx
test eax, eax
jne 0x42875b
push dword [ebp - 0x70]
call fcn.0041fcc8
pop ecx
test eax, eax
je 0x42875b
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call fcn.00428667
lea eax, [ebp - 0x78]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x428725
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x1b8
leave
ret
Function at 0x428788
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x244
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x1c0], eax
mov eax, dword [ebp + 0x1cc]
push edi
mov edi, dword [ebp + 0x1d0]
mov dword [ebp - 0x50], eax
test edi, edi
jne 0x4287be
xor eax, eax
jmp 0x4288c0
push ebx
push esi
lea ecx, [ebp - 0x68]
call fcn.00419303
lea ecx, [ebp - 0x80]
call fcn.00419303
lea eax, [ebp - 0x68]
push eax
push str.ModuleUpdate.exe
call fcn.004286ba
mov esi, dword [ebp - 0x58]
sub esi, dword [ebp - 0x5c]
pop ecx
sar esi, 2
xor ebx, ebx
pop ecx
test esi, esi
jle 0x428868
push ebx
lea ecx, [ebp - 0x68]
call fcn.00411540
push dword [eax]
push str.Q360DownloadMain
call fcn.0041fd25
pop ecx
pop ecx
push eax
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x428863
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x46]
push eax
call fcn.0044c960
add esp, 0xc
push 0x104
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x428863
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.00451160
pop ecx
pop ecx
test eax, eax
jne 0x428863
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00428667
inc ebx
cmp ebx, esi
jl 0x4287ef
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x74]
and eax, 0xfffffffc
cmp eax, 4
jne 0x428886
push 0
lea ecx, [ebp - 0x80]
call fcn.00411540
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x428889
and dword [edi], 0
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x5c]
xor ecx, ecx
sar eax, 2
cmp ecx, eax
sbb esi, esi
lea ecx, [ebp - 0x80]
neg esi
call fcn.00412ca5
push dword [ebp - 0x80]
call fcn.0044c8ea
pop ecx
lea ecx, [ebp - 0x68]
call fcn.00412ca5
push dword [ebp - 0x68]
call fcn.0044c8ea
pop ecx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1c0]
xor ecx, ebp
pop edi
call fcn.0044cbcc
add ebp, 0x1c4
leave
ret
Function at 0x4288d6
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7f0]
sub esp, 0x870
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x7ec], eax
mov eax, dword [ebp + 0x7fc]
mov ecx, dword [ebp + 0x814]
push ebx
mov ebx, dword [ebp + 0x80c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x808]
push esi
mov esi, dword [ebp + 0x800]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 0x818]
push edi
mov edi, dword [ebp + 0x804]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x810]
mov dword [ebp - 0x28], ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b682
mov eax, dword [0x47d024]
push dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push str.__updateidAF868A92_0866_45d4_9BD8_A8EE2BB2033F__SECTIONIDDCEC36FC_64A3_471f_9DEE_7D01310E1E2C__NOTIFYWINDOW_d__NAME51FA7BCF_DF17_4b1a_8052_C4D98AA5F93D___UPDATETYPEE7CF2847_EEE7_4dc3_9BD5_23902EBF1D89
push eax
call fcn.00413acf
add esp, 0xc
cmp dword [ebp + 0x7f8], 0
je 0x428981
lea eax, [ebp - 0x18]
push eax
push str.__s
lea eax, [ebp - 0x20]
push eax
call fcn.0040b75b
push eax
lea ecx, [ebp - 0x18]
call fcn.0040ad14
lea ecx, [ebp - 0x20]
call fcn.00408318
mov eax, dword [ebp - 0x24]
push dword [eax]
lea ecx, [ebp - 0x18]
push str.AF868A92_0866_45d4_9BD8_A8EE2BB2033F
call fcn.00420fb1
push dword [esi]
lea ecx, [ebp - 0x18]
push str.DCEC36FC_64A3_471f_9DEE_7D01310E1E2C
call fcn.00420fb1
push dword [ebx]
lea ecx, [ebp - 0x18]
push str.51FA7BCF_DF17_4b1a_8052_C4D98AA5F93D
call fcn.00420fb1
push dword [edi]
lea ecx, [ebp - 0x18]
push 0x46eb60
call fcn.00420fb1
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428a90
push dword [ebp - 0x1c]
call fcn.00432b24
pop ecx
test eax, eax
je 0x428a90
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0044c960
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 5
pop eax
mov esi, 0x400
push esi
push dword [ebp - 0x1c]
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x54], 1
call fcn.0044fc24
push esi
lea eax, [ebp - 0x14]
push 0x46eb5c
push eax
call fcn.004512ab
push esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.004512ab
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, ebx
je 0x428a79
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x428a79
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.00428788
pop ecx
pop ecx
jmp 0x428a92
xor esi, esi
lea ecx, [ebp - 0x18]
call fcn.00408318
lea ecx, [ebp - 0x1c]
call fcn.00408318
mov ecx, dword [ebp + 0x7ec]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x7f0
leave
ret
Function at 0x42a68c
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.00436423
mov ecx, eax
call fcn.00436305
call fcn.004127b6
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x30]
call ebx
lea esi, [edi + 0x76c]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42a6c7
push 0
push dword [esi]
call ebx
mov ecx, 0x482c1c
call fcn.00410b50
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42a704
call fcn.0040daa8
mov ecx, eax
call fcn.00445c45
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi + 0x30]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x42bf61
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
call fcn.00407c12
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
lea ebx, [esi + 0x50]
mov ecx, ebx
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
call fcn.0042b91f
mov dword [ebx], vtable.PrivilegeElevationProDlg.0
mov dword [esi], vtable.PrivilegeElevationProDlg.2.0
mov dword [esi + 0x2c], vtable.PrivilegeElevationProDlg.1.0
lea ebx, [esi + 0x78]
mov dword [ebx], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov eax, dword [0x47d024]
mov dword [esi + 0x9c], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4845f0
call fcn.00417bfd
mov ecx, eax
call fcn.0042c8d7
lea ecx, [ebp - 0xc]
mov dword [0x483650], eax
call fcn.0042c1c2
push edi
lea ecx, [esi + 0x8c]
mov dword [esi + 0x98], edi
mov dword [esi + 0x94], edi
call fcn.0040dfa6
push edi
lea ecx, [esi + 0x7c]
call fcn.0040dfa6
push edi
mov ecx, ebx
call fcn.0040dfa6
push str.Global__Q360BlockPrivElevationMutex__
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x74], eax
cmp eax, edi
je 0x42c042
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42c04c
push dword [ebp + 8]
mov ecx, esi
call fcn.0042ba5a
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x42c918
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
push 0x104
lea eax, [ebp - 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....ipc_sbmon.dll
lea eax, [ebp - 0x74]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x74]
push eax
call fcn.0042c8ec
mov ecx, eax
call fcn.00433e7a
push 4
mov ebx, eax
pop eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
mov esi, str.SB_State
push esi
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], 2
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x78], 2
jne 0x42c9ae
call fcn.0042c8ec
mov ecx, eax
call fcn.00433e24
mov ebx, eax
push 1
call fcn.0042c8ec
mov ecx, eax
call fcn.00433ddb
cmp eax, 1
jne 0x42c9c5
xor eax, eax
jmp 0x42c9ec
push 0x168
push 0xa3
push 0x41c
call fcn.0041497b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push esi
call fcn.00410b05
pop ecx
pop ecx
mov eax, ebx
mov ecx, dword [ebp + 0x194]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x198
leave
ret
Function at 0x42ca03
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x70], ax
xor edi, edi
lea eax, [ebp - 0x6e]
push edi
push eax
call fcn.0044c960
xor eax, eax
push esi
mov word [ebp + 0x198], ax
lea eax, [ebp + 0x19a]
push edi
push eax
call fcn.0044c960
push edi
mov esi, 0x104
lea eax, [ebp - 0x70]
push esi
push eax
mov dword [ebp - 0x80], str.safemon360webpro.dll
mov dword [ebp - 0x7c], str.Netmon360arpinstdrv.dll
mov dword [ebp - 0x78], str.antiarp360LanProtect.sys
call fcn.00412517
mov dword [ebp - 0x74], edi
add esp, 0x24
mov ebx, 0x208
mov edi, 0x46a7e4
push ebx
lea eax, [ebp + 0x198]
push 0
push eax
call fcn.0044c960
mov eax, dword [ebp - 0x74]
push dword [ebp + eax*4 - 0x80]
lea eax, [ebp - 0x70]
push eax
push edi
lea eax, [ebp + 0x198]
push esi
push eax
call fcn.0041214c
add esp, 0x20
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cace
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 3
jb 0x42ca85
xor eax, eax
jmp 0x42cb20
push ebx
lea eax, [ebp + 0x198]
push 0
push eax
call fcn.0044c960
push str.UtilsModuleUpdate.exe
lea eax, [ebp - 0x70]
push eax
push edi
lea eax, [ebp + 0x198]
push esi
push eax
call fcn.0041214c
lea eax, [ebp + 0x198]
push eax
call fcn.00432b24
add esp, 0x24
test eax, eax
je 0x42cb1d
push 1
lea eax, [ebp + 0x198]
push str._updateidarpattack__SECTIONIDarpattack__UPDATETYPEPRODUCT___NAME
push eax
call fcn.00411a3a
add esp, 0xc
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a4
leave
ret
Function at 0x42cb38
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x6c], ax
xor edi, edi
lea eax, [ebp - 0x6a]
push edi
push eax
call fcn.0044c960
xor eax, eax
push esi
mov word [ebp + 0x19c], ax
lea eax, [ebp + 0x19e]
push edi
push eax
call fcn.0044c960
push edi
mov esi, 0x104
lea eax, [ebp - 0x6c]
push esi
push eax
mov dword [ebp - 0x80], str.safemon360SoftPrivMgr.exe
mov dword [ebp - 0x7c], str.safemon360SoftPrivMgr.dll
mov dword [ebp - 0x78], str.Config_newui_themesdefault360SoftPrivMgr360SoftPrivMgr_theme.ui
mov dword [ebp - 0x74], str.Config_newui_themesdefault_theme_360SoftPrivMgr.xml
call fcn.00412517
mov dword [ebp - 0x70], edi
add esp, 0x24
mov ebx, 0x208
mov edi, 0x46a7e4
push ebx
lea eax, [ebp + 0x19c]
push 0
push eax
call fcn.0044c960
mov eax, dword [ebp - 0x70]
push dword [ebp + eax*4 - 0x80]
lea eax, [ebp - 0x6c]
push eax
push edi
lea eax, [ebp + 0x19c]
push esi
push eax
call fcn.0041214c
add esp, 0x20
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cc16
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 4
jb 0x42cbc1
push 0
push str.360SoftPrivMgr.exe
call fcn.00411b1c
pop ecx
pop ecx
jmp 0x42cc65
push ebx
lea eax, [ebp + 0x19c]
push 0
push eax
call fcn.0044c960
push str.UtilsModuleUpdate.exe
lea eax, [ebp - 0x6c]
push eax
push edi
lea eax, [ebp + 0x19c]
push esi
push eax
call fcn.0041214c
lea eax, [ebp + 0x19c]
push eax
call fcn.00432b24
add esp, 0x24
test eax, eax
je 0x42cc65
push 1
lea eax, [ebp + 0x19c]
push str._updateid360SoftPrivMgr__sectionid360SoftPrivMgr__updatetypeProduct__name
push eax
call fcn.00411a3a
add esp, 0xc
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044cbcc
add ebp, 0x3a8
leave
ret
Function at 0x42cc7d
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x74], ax
xor edi, edi
lea eax, [ebp - 0x72]
push edi
push eax
call fcn.0044c960
xor eax, eax
push esi
mov word [ebp + 0x194], ax
lea eax, [ebp + 0x196]
push edi
push eax
call fcn.0044c960
push edi
mov esi, 0x104
lea eax, [ebp - 0x74]
push esi
push eax
mov dword [ebp - 0x80], str.safemonNetworkPenetratePro.exe
mov dword [ebp - 0x7c], str.Config_newui_themesdefaultNetworkPenetrateProNetworkPenetratePro_theme.ui
call fcn.00412517
mov dword [ebp - 0x78], edi
add esp, 0x24
mov ebx, 0x208
mov edi, 0x46a7e4
push ebx
lea eax, [ebp + 0x194]
push 0
push eax
call fcn.0044c960
mov eax, dword [ebp - 0x78]
push dword [ebp + eax*4 - 0x80]
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp + 0x194]
push esi
push eax
call fcn.0041214c
add esp, 0x20
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cd4d
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 2
jb 0x42ccf8
push 0
push str.safemonNetworkPenetratePro.exe
call fcn.00412924
pop ecx
pop ecx
jmp 0x42cd9c
push ebx
lea eax, [ebp + 0x194]
push 0
push eax
call fcn.0044c960
push str.UtilsModuleUpdate.exe
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp + 0x194]
push esi
push eax
call fcn.0041214c
lea eax, [ebp + 0x194]
push eax
call fcn.00432b24
add esp, 0x24
test eax, eax
je 0x42cd9c
push 1
lea eax, [ebp + 0x194]
push str._updateidNetworkPenetratePro__sectionidNetworkPenetratePro__updatetypeProduct__name
push eax
call fcn.00411a3a
add esp, 0xc
mov ecx, dword [ebp + 0x39c]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0044cbcc
add ebp, 0x3a0
leave
ret

Function at 0x42d13e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044c960
push str.safemon360SoftPrivMgr.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d1b5
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
cmp eax, esi
je 0x42d1b5
push str.GetState
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x42d1b5
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret
Function at 0x42d1c4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044c960
push str.Utils360seclogon360DBGuard.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d23b
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
cmp eax, esi
je 0x42d23b
push str.GetState
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x42d23b
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x42d24a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044c960
push str.Utils360seclogon360DBGuard.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d2bd
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
test eax, eax
je 0x42d2bd
push str.OpenNewPage
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d2bd
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044cbcc
leave
ret

Function at 0x42d2c9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044c960
push str.Utils360Protect.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d343
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
cmp eax, esi
je 0x42d343
push str.GetState
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x42d343
push 0x2c
call eax
pop ecx
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret

Function at 0x42d352
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x480900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0044c960
push str.Utils360Protect.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00412517
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d3cc
lea eax, [ebp - 0x20c]
push eax
call fcn.0040aa22
pop ecx
cmp eax, esi
je 0x42d3cc
push str.GetState
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x42d3cc
push 0x30
call eax
pop ecx
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044cbcc
leave
ret