joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ef9f
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x52a39e
call fcn.004fc6ce
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x48]
xor edi, edi
push eax
mov dword [ebp - 0x18], edi
call fcn.004277ed
mov dword [ebp - 4], edi
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], edi
sar eax, 2
test eax, eax
jbe 0x48f093
mov edi, dword [ebp - 0x14]
mov esi, ebx
call fcn.004bbe71
mov eax, dword [eax]
sub eax, 0x10
call fcn.00404942
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.0042a5b4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041b4b1
lea edi, [ebp - 0x20]
mov esi, eax
call fcn.004a65a0
mov esi, dword [ebp + 0xc]
test al, al
je 0x48f06f
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041b38e
mov edi, eax
lea eax, [ebp + 0xc]
call fcn.00404477
push dword [esi - 0xc]
lea eax, [ebp - 0x10]
push esi
call fcn.004046e5
push 0x54a270
lea eax, [ebp - 0x10]
push eax
call fcn.00404758
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00405521
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [ebp - 0x14]
sar eax, 2
cmp dword [ebp - 0x14], eax
jb 0x48efea
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
xor edi, edi
cmp eax, edi
mov eax, dword [ebp + 8]
jne 0x48f0c9
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
call fcn.00405521
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x48]
push eax
call fcn.004277c5
mov eax, esi
call fcn.004fc7a6
ret 8
mov eax, dword [eax]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x48f187
cmp eax, 0xffffffff
je 0x48f178
mov eax, dword [esi - 0xc]
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
push 0x590f51
push eax
call fcn.004f5946
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48f178
lea eax, [ebx + 2]
push eax
push 0
push edi
call fcn.004f18b0
add esp, 0xc
push 0
lea esi, [ebp - 0x10]
mov byte [edi], 0xff
mov byte [edi + 1], 0xfe
call fcn.00405612
push eax
push ebx
lea eax, [edi + 2]
push eax
call fcn.0042653b
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48f16e
cmp ebx, dword [ebp + 0xc]
jne 0x48f16e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp + 8], 0
mov dword [ebp - 0x18], 1
push edi
call fcn.004f2b13
mov esi, dword [ebp - 0x10]
pop ecx
cmp dword [ebp + 8], 0
je 0x48f187
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
call fcn.00405521
mov esi, dword [ebp - 0x18]
jmp 0x48f0b2
Function at 0x48f331
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
mov edi, str.SOFTWARE360Safe_stat
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x48f363
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.ManExit
push edi
push esi
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
leave
ret

Function at 0x48f539
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x585698]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x214], esi
test byte [0x595784], 1
jne 0x48f585
mov eax, dword [0x590e04]
or dword [0x595784], 1
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
push 0x534d85
mov dword [0x595780], eax
call fcn.004f447f
pop ecx
mov eax, dword [0x595780]
cmp dword [eax - 0xc], esi
jne 0x48f620
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.004f18b0
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
mov dword [ebp - 0x214], 0x104
call esi
test eax, eax
jne 0x48f5f3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0x214], 0x104
call esi
mov eax, dword [ebp - 0x214]
cmp eax, 0x105
jae 0x48f61b
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
push eax
push 0x595780
call fcn.004056c8
mov eax, dword [0x595780]
add eax, 0xfffffff0
call fcn.00404942
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop esi
call fcn.004f189b
leave
ret

Function at 0x48f63c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x52707a
call fcn.004fc737
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x228], 0
push 0x53a3d8
push ebx
mov dword [ebp - 0x22c], ebx
call fcn.004056ee
and dword [ebp - 4], 0
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x21c], ax
xor esi, esi
lea eax, [ebp - 0x21a]
inc esi
push eax
mov dword [ebp - 0x228], esi
call fcn.004f18b0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push str.RecordDeviceName
push str.software360TotalSecurityUserProfile
push SysReAllocString
mov dword [ebp - 0x224], 0x209
mov dword [ebp - 0x220], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x48f6e0
lea eax, [ebp - 0x21c]
push eax
push ebx
call fcn.004056c8
mov eax, ebx
call fcn.004fc7ba
ret

Function at 0x48fec5
Capabilities:
Set registry value

Disassembly:
push 2
push 0x53a3d8
push 1
push 0x551d18
push str.SOFTWARE360SafeMsgCenter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret
Function at 0x492f44
Capabilities:
Get common file path

Disassembly:
push 0x1c
mov eax, 0x52c3a6
call fcn.004fc6ce
mov eax, dword [0x590e04]
mov edi, 0x590e04
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
xor ebx, ebx
push 0x104
lea esi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00405612
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x492f9a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405521
mov al, bl
call fcn.004fc7a6
ret
or eax, 0xffffffff
lea esi, [ebp - 0x14]
call fcn.00428e0c
mov eax, dword [0x590e04]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov byte [ebp - 0xd], bl
call fcn.0040d5c7
test al, al
lea eax, [ebp - 0x18]
je 0x492fdf
push str.360box64.sys
push dword [ebp - 0x14]
push str._sdrivers_s
push eax
call fcn.0040450f
mov al, 1
jmp 0x492ff5
push str.360box.sys
push dword [ebp - 0x14]
push str._sdrivers_s
push eax
call fcn.0040450f
mov al, byte [ebp - 0xd]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x28]
add esp, 0x10
push eax
mov dword [ebp - 0x28], str.ipc_sbmon.dll
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], bl
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x1c], bl
call fcn.004a6aec
mov bl, al
pop ecx
lea eax, [esi - 0x10]
call fcn.00405521
jmp 0x492f87
Function at 0x496ec2
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x585698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0040ccef
test al, al
jne 0x496fd3
xor edi, edi
push edi
push str.Q360TaskBtn
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x496f06
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x496fd3
push 0x549f4c
push dword [0x594588]
call fcn.004f52b9
pop ecx
pop ecx
test eax, eax
jne 0x496fd3
mov ebx, 0x593e48
mov eax, ebx
call fcn.0044a435
test al, al
jne 0x496fd3
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004f18b0
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.360safe360SoftMgrLiteTaskBarBtn.ini
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
push 1
push str.StartFlag
push str.TaskBarBtn
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x496fd3
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.004f18b0
add esp, 0xc
push str.softmgrSMLSoftMgrLite.exe
push ebx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push 1
push edi
lea eax, [ebp - 0x418]
call fcn.0044972a
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f189b
leave
ret

Function at 0x497492
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x585698]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov edi, ecx
call fcn.004f18b0
add esp, 0xc
push str.safemon360safemonpro.tpi
push 0x593e48
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x497562
lea eax, [ebp - 0x210]
push eax
call fcn.00449373
pop ecx
test eax, eax
je 0x497562
push str.CreateTrayClient
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x497562
and dword [ebp - 0x218], 0
lea ecx, [ebp - 0x218]
push ecx
push 1
call eax
mov dword [edi + 0x434], eax
test eax, eax
je 0x497562
and dword [ebp - 0x214], 0
mov edx, dword [eax]
lea esi, [ebp - 0x214]
lea ecx, [edi + 0x24]
push esi
push ecx
mov ecx, eax
call dword [edx + 8]
test eax, eax
je 0x497562
mov ecx, dword [edi + 0x434]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
je 0x497562
mov dword [edi + 0x118], 1
push 0x590f51
push 0xc
call fcn.004f5c13
pop ecx
pop ecx
test eax, eax
je 0x49757d
mov esi, eax
call fcn.0048e109
jmp 0x49757f
xor eax, eax
push eax
add edi, 0x97c
call fcn.004a3be9
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f189b
leave
ret
Function at 0x499075
Capabilities:
Shutdown system

Disassembly:
push 0x40
mov eax, 0x528c71
call fcn.004fc6ce
xor edi, edi
push edi
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.0043e727
add esp, 0xc
mov dword [ebp - 4], edi
cmp dword [eax + 0x18], 8
jb 0x4990a4
mov eax, dword [eax + 4]
jmp 0x4990a7
add eax, 4
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004056ee
push edi
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00404e29
push edi
push str.IDS_TRAY_REBOOT_FIX_TEXT
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.0043e727
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x4990e2
mov eax, dword [eax + 4]
jmp 0x4990e5
add eax, 4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004056ee
push edi
push 1
lea esi, [ebp - 0x4c]
call fcn.00404e29
mov eax, dword [ebp + 8]
push 0x34
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x499125
call fcn.00499015
push 0x80020004
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405521
xor eax, eax
call fcn.004fc7a6
ret 4

Function at 0x4996d2
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, eax
mov dword [esi + 0x528], ebx
push edi
mov dword [esi + 0x444], ebx
mov dword [esi + 0x44c], ebx
mov dword [esi + 0x450], ebx
mov dword [esi + 0x448], ebx
lea edi, [esi + 0x470]
call fcn.004a3ad1
push ebx
push 0x2710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push ebx
push ebx
xor edi, edi
inc edi
push edi
mov dword [esi + 0x444], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x499770
push ebx
push ebx
mov dword [esi + 0x450], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44c], eax
mov eax, dword [esi + 0x444]
test eax, eax
je 0x49975f
cmp dword [esi + 0x450], ebx
je 0x49975f
cmp dword [esi + 0x44c], ebx
je 0x49975f
mov dword [esi + 0x528], edi
cmp dword [esi + 0x528], ebx
jne 0x49976c
call fcn.00499c8d
pop edi
pop esi
pop ebx
ret
Function at 0x499e24
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x528c31
call fcn.004fc76d
push 0x55387c
push 0x593e48
lea eax, [ebp - 0x224]
mov edi, ecx
push eax
mov dword [ebp - 0x22c], edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x499f1b
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x499f1b
xor ebx, ebx
push ebx
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.0043e727
add esp, 0xc
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x499e99
mov eax, dword [eax + 4]
jmp 0x499e9c
add eax, 4
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.004056ee
push ebx
push 1
lea esi, [ebp - 0x248]
mov byte [ebp - 4], 3
call fcn.00404e29
push 0x8c
call fcn.004f1aab
pop ecx
cmp eax, ebx
je 0x499eda
lea ecx, [ebp - 0x224]
push ecx
mov esi, eax
call fcn.0048ccfc
jmp 0x499edc
xor eax, eax
mov dword [edi + 0x414], eax
cmp eax, ebx
je 0x499f0d
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x499f0d
push dword [ebp - 0x228]
push ebx
push ebx
call eax
add esp, 0xc
cmp al, bl
je 0x499f0d
mov eax, dword [edi + 0x414]
mov eax, dword [eax + 0x6c]
cmp eax, ebx
je 0x499f0d
call eax
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.00405521
call fcn.004fc7c9
ret

Function at 0x499fb9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
je 0x499fd3
push 0x1388
call sub.KERNEL32.dll_Sleep
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 4
pop edi
push 2
pop ebx
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp - 4]
test eax, edi
je 0x49a001
mov al, byte [ebp + 0xc]
add al, 0x41
movzx eax, al
push eax
call fcn.0043fd17
pop ecx
cmp eax, ebx
jne 0x49a001
or esi, edi
add edi, edi
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x1a
jl 0x499fe5
test esi, esi
jbe 0x49a049
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
push 0x8000
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], esi
call fcn.004a2bb6
mov eax, dword [ebp + 8]
push 0
push esi
push 0x472
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x49a07d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x590f51
push 8
call fcn.004f5c13
pop ecx
pop ecx
test eax, eax
je 0x49a0be
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push 0x499f8e
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push 0
push 0
mov dword [eax + 4], ecx
call fcn.004f5629
add esp, 0x18
test eax, eax
je 0x49a0be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 8
Function at 0x49a2bc
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.LocalQ360SafeI18N
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x49a2dd
inc edi
test esi, esi
je 0x49a2ef
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x49a637
Capabilities:
Shutdown system

Disassembly:
push 0x28c
mov eax, 0x52ed4f
call fcn.004fc737
lea eax, [ebp - 0x240]
push eax
call fcn.004522c2
push ecx
xor ebx, ebx
mov eax, esp
mov dword [ebp - 0x244], esp
push ecx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
mov eax, esp
mov dword [ebp - 0x244], esp
push ebx
lea esi, [ebp - 0x214]
mov dword [eax], ebx
call fcn.00454766
cmp eax, ebx
je 0x49a78a
lea eax, [ebp - 0x240]
push eax
call fcn.00453dd8
push ebx
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0x298]
call fcn.0043e727
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x49a6ae
mov eax, dword [eax + 4]
jmp 0x49a6b1
add eax, 4
push eax
push dword [ebp - 0x210]
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x298]
call fcn.00404e29
push ebx
push str.IDI_BTN_REBOOT
push 0xffffffffffffffff
lea ecx, [ebp - 0x260]
call fcn.0043e727
add esp, 0xc
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x49a6f3
mov eax, dword [eax + 4]
jmp 0x49a6f6
add eax, 4
push edi
push eax
push edi
lea ecx, [ebp - 0x240]
call fcn.00453eb2
push ebx
push edi
lea esi, [ebp - 0x260]
mov byte [ebp - 4], bl
call fcn.00404e29
push ebx
push str.IDS_SERVICE_REPAIR_NEED_RESTART_PROMPT
push 0xffffffffffffffff
lea ecx, [ebp - 0x27c]
call fcn.0043e727
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [eax + 0x18], 8
jb 0x49a739
mov eax, dword [eax + 4]
jmp 0x49a73c
add eax, 4
push ebx
mov edx, eax
lea ecx, [ebp - 0x240]
call fcn.00453af7
push ebx
push edi
lea esi, [ebp - 0x27c]
mov byte [ebp - 4], bl
call fcn.00404e29
call fcn.004ae7dd
push ebx
mov byte [eax + 0xc], bl
push edi
lea esi, [ebp - 0x240]
call fcn.00453a1b
call fcn.004ae7dd
mov byte [eax + 0xc], 1
call fcn.00499015
push 0x80020004
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x240]
push eax
call fcn.0045241d
xor eax, eax
call fcn.004fc7ba
ret
Function at 0x49aaac
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, eax
push edi
lea edi, [esi + 0x504]
mov eax, dword [edi]
test eax, eax
jne 0x49ab2e
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.0049a8c4
cmp eax, 4
jne 0x49ab2e
mov eax, dword [esi + 0x114]
test eax, eax
jne 0x49ab2e
push eax
push 4
push esi
push 0x49b7d0
push eax
push eax
call fcn.004f5629
add esp, 0x18
mov dword [ebp - 4], eax
test eax, eax
je 0x49ab2e
push 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call edi
push 0
lea eax, [esi + 0x50c]
push eax
call edi
mov esi, dword [esi + 0x518]
test esi, esi
je 0x49ab1c
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x49b4b6
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
push edi
lea edi, [esi + 0x508]
mov eax, dword [edi]
test eax, eax
jne 0x49b546
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov eax, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0049b2d0
cmp eax, 8
je 0x49b4ea
cmp eax, 9
jne 0x49b546
mov eax, dword [esi + 0x114]
test eax, eax
jne 0x49b546
push ebx
push 4
push esi
push 0x49b7f7
push ebx
push ebx
call fcn.004f5629
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x49b546
push 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call edi
push ebx
lea eax, [esi + 0x50c]
push eax
call edi
mov esi, dword [esi + 0x518]
cmp esi, ebx
je 0x49b534
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49c236
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52c2c3
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x585698]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push str.https:__free.360totalsecurity.com_se_360SecureBrowser_setup.exe
lea eax, [esp + 0x1c]
push eax
call fcn.004056ee
push str.TS_Recommended_Apps
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x68], ebx
call fcn.004056ee
lea edx, [esp + 0x14]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 1
call fcn.004baefd
lea ecx, [esp + 0x10]
push str.360SecureBrowser_setup.exe
push ecx
mov edi, eax
mov byte [esp + 0x68], 2
call fcn.00405a46
pop ecx
pop ecx
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.00405521
mov byte [esp + 0x60], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00405521
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
call fcn.004baced
pop ecx
test al, al
je 0x49c420
call esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1288]
sub eax, 0x10
call fcn.00404942
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
push ebx
push ebx
push esi
mov byte [esp + 0x6c], 6
push dword [esp + 0x1c]
lea eax, [esp + 0x48]
push eax
call fcn.004baa96
add esp, 0x14
cmp dword [esp + 0x38], 1
jne 0x49c418
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.WsUpdateParam
push eax
xor esi, esi
call fcn.004056ee
push ecx
mov byte [esp + 0x68], 7
mov eax, esp
mov dword [esp + 0x28], esp
mov ebx, str.SOFTWARE360TotalSecurityUserProfile
push ebx
push eax
call fcn.004056ee
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov byte [esp + 0x70], 6
call fcn.0040499a
call fcn.004048f5
lea esi, [esp + 0x24]
call fcn.00401105
push 0
call fcn.004f5c9c
pop ecx
mov esi, eax
mov eax, dword [0x590e04]
mov ecx, 0x590e04
mov dword [esp + 0x28], edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x60], 8
push dword [esp + 0x28]
lea eax, [esp + 0x18]
push esi
push 0x554ca0
push eax
call fcn.0040450f
add esp, 0x10
xor esi, esi
push esi
push dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [esp + 0x2c], esp
push str.Install360SeDate
push eax
call fcn.004056ee
push ecx
mov byte [esp + 0x70], 9
mov eax, esp
mov dword [esp + 0x34], esp
push ebx
push eax
call fcn.004056ee
push edi
lea eax, [esp + 0x58]
push eax
mov ecx, esi
mov byte [esp + 0x78], 8
call fcn.0040499a
push eax
call fcn.00404a80
add esp, 0xc
lea esi, [esp + 0x44]
call fcn.00401105
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00405521
mov esi, dword [esp + 0x1c]
lea eax, [esi - 0x10]
call fcn.00405521
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.00405521
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00405521
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4