joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a102
Capabilities:
Create thread

Disassembly:
push 0x1c8
mov eax, 0x5e3963
call fcn.00593b07
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push edx
push ecx
lea ecx, [ebp - 0x1d0]
call fcn.00491ce3
xor ebx, ebx
lea ecx, [ebp - 0x1d0]
push esi
mov dword [ebp - 4], ebx
call fcn.0049c7eb
push edi
lea ecx, [ebp - 0x1d0]
call fcn.0049c7fa
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1d0]
push dword [ebp + 8]
call fcn.004948a7
test al, al
jne 0x47a16b
push 0xbb
push str.ShowScreenSaver
push str.__s__d___CreateFrame_failed
jmp 0x47a2aa
call fcn.004c4cd0
test eax, eax
je 0x47a192
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1d4], ebx
push eax
push ebx
push ebx
push 0x47a0c1
push ebx
push ebx
call fcn.005bb02f
add esp, 0x18
sub esp, 0x18
lea eax, [ebp - 0x1d0]
mov ecx, esp
mov dword [0x6d9634], eax
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
call fcn.004c297a
add esp, 0x18
push 8
pop edi
cmp dword [eax + 0x14], edi
jb 0x47a1c1
mov eax, dword [eax]
push eax
call fcn.004302c7
pop ecx
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040b67e
test esi, esi
je 0x47a2b2
push edi
push ebx
sub esp, 0x18
mov ecx, esp
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
call fcn.004c297a
add esp, 0x18
cmp dword [eax + 0x14], edi
jb 0x47a1fd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040b67e
sub esp, 0x18
mov ecx, esp
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x40]
call fcn.004c297a
add esp, 0x18
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], edi
jb 0x47a233
mov eax, dword [eax]
push eax
push 0xc8
mov edi, str.ShowScreenSaver
push edi
push str.__s__d___chrome.dll__s
call fcn.0040a649
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.0040b67e
test esi, esi
je 0x47a29f
push str.ChromeShell
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x47a290
push 0xcd
push edi
push str.__s__d___chrome_main__null
call fcn.0040a649
add esp, 0xc
push ebx
push ebx
push 0x10
push dword [ebp - 0x1c4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x47a2b2
push 0x6d8e18
push dword [0x6d2a44]
call eax
pop ecx
pop ecx
push 0xdd
push edi
push str.__s__d___exit
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x1d0]
call fcn.004920a2
call fcn.00593ab1
ret
Function at 0x47a2c3
Capabilities:
Check if file exists

Disassembly:
push 0x25c
mov eax, 0x5e39aa
call fcn.00593b07
and dword [ebp - 0x268], 0
lea ecx, [ebp - 0x28]
call fcn.004cc41b
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
push 8
mov ecx, ebx
pop esi
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
cmp dword [eax + 0x14], esi
jb 0x47a300
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a32f
lea ecx, [ebp - 0x40]
call fcn.004cc41b
mov dword [ebp - 0x264], 3
cmp dword [eax + 0x14], esi
jb 0x47a324
mov eax, dword [eax]
push eax
call fcn.004302c7
pop ecx
test eax, eax
jne 0x47a331
xor bl, bl
test byte [ebp - 0x264], 2
je 0x47a342
lea ecx, [ebp - 0x40]
call fcn.0040b67e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b67e
test bl, bl
je 0x47a3e5
lea ecx, [ebp - 0x28]
call fcn.004cc41b
cmp dword [eax + 0x14], esi
jb 0x47a365
mov eax, dword [eax]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040b67e
test esi, esi
je 0x47a3e5
push str.Start
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x47a3de
push 0x20a
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.005aa3d0
movaps xmm0, xmmword [0x66fc10]
lea eax, [ebp - 0x260]
add esp, 0xc
mov dword [ebp - 0x250], 0x1b7740
movups xmmword [ebp - 0x260], xmm0
push eax
call edi
push eax
push 0xf6
push str.Install360Safe
push str.__s__d___HealthMgr::Install360Safe_ret___d
call fcn.0040a649
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00593ab1
ret

Function at 0x47a5e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
test cl, cl
je 0x47a688
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x62e010
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a667
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x47a667
push str.SetProcessDpiAwareness
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
call fcn.00426d53
xor ecx, ecx
test al, al
setne cl
inc ecx
test esi, esi
je 0x47a688
push ecx
call esi
test eax, eax
jne 0x47a682
inc eax
jmp 0x47a68a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005926d8
leave
ret
Function at 0x47bfe0
Capabilities:
Check if file exists

Disassembly:
push 0x134
mov eax, 0x5e3e64
call fcn.00593b07
xor ebx, ebx
lea eax, [ebp - 0x94]
push 0x82
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.005aa3d0
push 0xa
push 0x40
lea eax, [ebp - 0x94]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005bb344
add esp, 0x20
test eax, eax
je 0x47c040
push eax
push 0x3ae
push str.EscapeVirtualizationEx
push str.__s__d___LaunchExitPopup__i64tot_s_error_re___d
call fcn.0040a649
add esp, 0x10
jmp 0x47c27c
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.sftldr_wow64.dll
call esi
test eax, eax
jne 0x47c081
push str.sftldr.dll
call esi
test eax, eax
jne 0x47c081
call fcn.004c5a14
test al, al
jne 0x47c081
push 0x3ce
push str.EscapeVirtualizationEx
push str.__s__d___WmiLaunchProcess_no_excute
call fcn.0040a649
add esp, 0xc
jmp 0x47c27c
lea ecx, [ebp - 0xac]
call fcn.004c2598
mov byte [ebp - 4], 1
cmp dword [ebp - 0x9c], 0
je 0x47c0b2
mov esi, 0x62b0fc
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0xac]
call fcn.0040b220
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0040b0d5
push str._hep:
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 2
call fcn.0040b0d5
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 3
push eax
call fcn.005baec0
pop ecx
push eax
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0xc4]
call fcn.0040b220
mov esi, str.__efrom:
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc4]
call fcn.0040b220
cmp dword [ebp + 0x24], 8
lea eax, [ebp + 0x10]
push dword [ebp + 0x20]
cmovae eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0040b220
lea eax, [ebp - 0xac]
mov esi, 0x62cf58
push eax
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00440e2c
push esi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10c]
call fcn.0041151f
push 0x62b23c
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf4]
call fcn.0041151f
add esp, 0x14
mov ecx, eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0xc4]
cmp dword [ebp - 0xb0], 8
push dword [ebp - 0xb4]
cmovae eax, dword [ebp - 0xc4]
push eax
call fcn.0040b220
mov byte [ebp - 0x140], bl
lea ecx, [ebp - 0xdc]
push dword [ebp - 0x140]
mov dword [ebp - 0xcc], ebx
push eax
mov dword [ebp - 0xc8], ebx
call fcn.0040b632
lea ecx, [ebp - 0xf4]
call fcn.0040b67e
lea ecx, [ebp - 0x10c]
call fcn.0040b67e
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x124]
call fcn.0040b67e
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47c24e
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x47c24e
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0xdc]
call fcn.004383a4
test al, al
jne 0x47c24e
push 0x3c7
push str.EscapeVirtualizationEx
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x47c250
mov bl, 1
lea ecx, [ebp - 0xdc]
call fcn.0040b67e
lea ecx, [ebp - 0xc4]
call fcn.0040b67e
lea ecx, [ebp - 0x13c]
call fcn.0040b67e
lea ecx, [ebp - 0xac]
call fcn.0040b67e
lea ecx, [ebp + 0x10]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x47c28c
Capabilities:
Check if file exists

Disassembly:
push 0x80
mov eax, 0x5e3eb7
call fcn.00593b07
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.sftldr_wow64.dll
call esi
test eax, eax
jne 0x47c2e0
push str.sftldr.dll
call esi
test eax, eax
jne 0x47c2e0
call fcn.004c5a14
test al, al
jne 0x47c2e0
push 0x3e7
push str.CreateProcessByCmd
push str.__s__d___WmiLaunchProcess_no_excute
call fcn.0040a649
add esp, 0xc
xor al, al
jmp 0x47c41f
lea ecx, [ebp - 0x28]
call fcn.004c2598
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x47c308
mov esi, 0x62b0fc
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0x28]
mov esi, 0x62cf58
push eax
lea eax, [ebp - 0x88]
push esi
push eax
call fcn.00440e2c
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0041151f
push 0x62b23c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0041151f
add esp, 0x14
push edi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004114f9
mov byte [ebp - 0x8c], bl
lea ecx, [ebp - 0x40]
push dword [ebp - 0x8c]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0040b632
lea ecx, [ebp - 0x58]
call fcn.0040b67e
lea ecx, [ebp - 0x70]
call fcn.0040b67e
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 7
call fcn.0040b67e
push 8
pop esi
cmp dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edi, str.CreateProcessByCmd
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], esi
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x3dc
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47c40b
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x47c40b
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x40]
call fcn.004383a4
test al, al
jne 0x47c40b
push 0x3e0
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x47c40d
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x47c696
Capabilities:
Check if file exists

Disassembly:
push 0x80
mov eax, 0x5e3eb7
call fcn.00593b07
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004c2598
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x47c6cf
mov edi, 0x62b0fc
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0x28]
mov edi, 0x62cf58
push eax
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.00440e2c
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0041151f
push 0x62b23c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0041151f
add esp, 0x14
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004114f9
mov byte [ebp - 0x8c], bl
lea ecx, [ebp - 0x40]
push dword [ebp - 0x8c]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0040b632
lea ecx, [ebp - 0x58]
call fcn.0040b67e
lea ecx, [ebp - 0x70]
call fcn.0040b67e
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 7
call fcn.0040b67e
push 8
pop esi
cmp dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edi, str.CreateProcessByWmi
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], esi
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x42b
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47c7d2
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x47c7d2
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x40]
call fcn.004383a4
test al, al
jne 0x47c7d2
push 0x430
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x47c7d4
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x482d6b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x5e4462
call fcn.00593b75
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x482de8
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x482de8
call fcn.0045e621
mov esi, eax
jmp 0x482eee
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x482e0b
call fcn.0045e621
jmp 0x482ee1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x482e01
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x482e3e
mov esi, 0x8007000e
jmp 0x482ee3
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x482f11
jb 0x482e59
cmp eax, 0xffffffff
ja 0x482f11
cmp eax, 0x400
jbe 0x482e6e
push eax
lea ecx, [ebp - 0x418]
call fcn.004819d4
jmp 0x482e90
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x482e90
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x482e34
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x482e01
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00482c16
mov esi, eax
test edi, edi
je 0x482eee
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x482f07
lea ecx, [ebp - 0x418]
call fcn.004819bf
mov eax, esi
call fcn.00593ac2
ret 0x10
push 0x80070216
call fcn.00422a81
int3
Function at 0x483ac5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x483bcf
cmp dword [ebp + 0xc], 0x104
jne 0x483b2f
cmp dword [ebp + 0x10], 0x73
jne 0x483b93
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x483b93
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, dword [ebp + 8]
jne 0x483b1b
push 0xe0
push str.BaseWallPaperFrame::DidProcessEvent
push str.__s__d___DidProcessEvent_close
call fcn.0040a649
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x483bcf
cmp dword [ebp + 0xc], 0x112
jne 0x483b93
cmp dword [ebp + 0x10], 0xf120
jne 0x483b93
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x483b93
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, dword [ebp + 8]
jne 0x483b93
mov eax, dword [esi + 0xc4]
sub eax, dword [esi + 0xc0]
push 0x6c
cdq
pop ecx
idiv ecx
cmp eax, 1
jbe 0x483b93
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, dword [esi + 0x28]
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esi + 0x170]
mov eax, dword [ecx]
push dword [esi + 0x16c]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x6d2c58], 0
je 0x483bcf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x483bcf
cmp dword [ebp + 0x10], 0x7b
jne 0x483bcf
mov ecx, dword [esi + 0x28]
push 0
push 4
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0x38]
mov ecx, dword [esi + 0x28]
call fcn.00483320
pop esi
pop ebp
ret 0x10
Function at 0x485490
Capabilities:
Check if file exists

Disassembly:
push 0xd8
mov eax, 0x5e48e1
call fcn.00593b07
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xe0], eax
cmp dword [eax + 0x10], 0
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ebx
je 0x4855eb
mov edi, dword [ebx]
mov eax, dword [ebx + 4]
cmp edi, eax
je 0x4855eb
mov ebx, eax
push edi
lea ecx, [ebp - 0x78]
call fcn.004831cb
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4855b5
lea ecx, [ebp - 0xd0]
call fcn.0040ba47
push 0x170
mov byte [ebp - 4], 1
call fcn.005926f7
pop ecx
mov dword [ebp - 0xd4], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040b6b1
mov esi, eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.0040b8cb
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040b9f4
push 0x12c
mov ecx, esi
call fcn.0040b8d4
push esi
call fcn.0040bde3
test eax, eax
je 0x4855aa
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x90]
call fcn.00430ab2
add esp, 0x18
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x485587
mov eax, dword [eax]
push eax
push 0x34f
push str.BaseWallPaperFrame::AddWaterMark
push str.__s__d___HttpDownloadSync_watermark:_s
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x90]
call fcn.0040b67e
lea ecx, [ebp - 0xd0]
call fcn.0040ba62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.0048546c
add edi, 0x68
cmp edi, ebx
jne 0x4854d3
mov ebx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xdc]
mov edx, ecx
mov ecx, dword [ebp - 0xe0]
push ebx
push dword [ebp + 0x10]
call fcn.004b52d2
pop ecx
pop ecx
call fcn.00593ab1
ret 0x10

Function at 0x4876c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x154], eax
test eax, eax
jne 0x4876f7
push 0x550
push str.BaseWallPaperFrame::StartSetWallpaperThread
push str.__s__d___create_event_failed
jmp 0x487728
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x487734
push edi
push edi
call fcn.005bb02f
add esp, 0x18
mov dword [esi + 0x158], eax
test eax, eax
jne 0x487730
push 0x557
push str.BaseWallPaperFrame::StartSetWallpaperThread
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x487a21
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x6c75ac]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [esp + 8], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
push edi
cmp eax, 0x67
jne 0x487ab6
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 2
movzx edi, ax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xf
or ax, di
pop ecx
bt ax, cx
jb 0x487a6b
push 0x67
jmp 0x487acb
call dword [sym.imp.USER32.dll_GetMessagePos]
mov ecx, dword [ebx + 0x28]
movsx edx, ax
sub edx, dword [ebx + 0xf4]
shr eax, 0x10
cwde
sub eax, dword [ebx + 0xf8]
mov dword [ebx + 0x16c], edx
mov dword [ebx + 0x170], eax
test ecx, ecx
je 0x487ba1
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov eax, dword [ecx]
push edx
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x487ba1
cmp eax, 0x68
je 0x487ba1
cmp eax, 0x69
jne 0x487ad9
mov eax, dword [ebx]
call dword [eax + 0x44]
push 0x69
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x487ba1
cmp eax, 0x6a
jne 0x487aee
call fcn.00431d55
mov dword [ebx + 0x168], eax
jmp 0x487ba1
cmp eax, 0x6b
jne 0x487b24
push 0x5f8
push str.BaseWallPaperFrame::OnTimer
push str.__s__d___OnTimer_TIMER_RESTART_WORKER_n
call fcn.0040a649
add esp, 0xc
push 0x6b
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
push ecx
xor edx, edx
push 2
inc edx
pop ecx
call fcn.004d4fbc
pop ecx
jmp 0x487ba1
cmp eax, 0x6c
jne 0x487ba1
push 0x5fe
push str.BaseWallPaperFrame::OnTimer
push str.__s__d___OnTimer_TIMER_START_EMPTY_WORKER_n
call fcn.0040a649
add esp, 0xc
push 0x6c
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebx + 0x110], 0
je 0x487b89
sub esp, 0x18
lea eax, [ebx + 0x100]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [esp + 0x2c]
call fcn.00430ab2
add esp, 0x18
mov ecx, eax
call fcn.004c6c97
lea ecx, [esp + 0x14]
call fcn.0040b67e
and dword [ebx + 0x110], 0
add ebx, 0x100
cmp dword [ebx + 0x14], 0x10
jb 0x487b9e
mov ebx, dword [ebx]
mov byte [ebx], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
pop edi
pop ebx
and dword [eax], 0
xor ecx, esp
xor eax, eax
call fcn.005926d8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4882bb
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x4882f9
mov eax, dword [ecx]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x73e
push str.BaseWallPaperFrame::OnClickClose
push str.__s__d___OnClick_Close
call fcn.0040a649
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x489b65
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x34
mov eax, 0x5da632
call fcn.00593b07
push 0x208
xor ebx, ebx
push ebx
push 0x6d8e20
call fcn.005aa3d0
mov eax, dword [ebp + 8]
mov dword [0x6d9230], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
push str.InstallPath
mov edx, str.Software360360huabao
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425d08
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
push 8
pop edi
cmp dword [ebp - 0x18], ebx
je 0x489c1d
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x489c1d
push 0x64f148
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0041154e
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b0ac
lea ecx, [ebp - 0x40]
call fcn.0040b67e
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0x489c1d
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
je 0x489c58
push dword [0x6d9230]
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str._schromeshell_d
push 0x103
push 0x6d8e20
call fcn.00412a08
add esp, 0x14
jmp 0x489c8d
lea ecx, [ebp - 0x40]
call fcn.004250d6
cmp dword [eax + 0x14], edi
jb 0x489c67
mov eax, dword [eax]
push dword [0x6d9230]
push eax
push str._schromeshell_d
push 0x103
push 0x6d8e20
call fcn.00412a08
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
call fcn.00593ab1
ret 4