joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479406
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x6c45ac]
xor eax, esp
mov dword [esp + 0x210], eax
cmp dword [0x6cfc08], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x4794ad
xor edi, edi
push edi
push 0x646644
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.C:_temp360huabao_d.log
mov ebx, 0x104
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.0040b613
add esp, 0x10
lea eax, [esp + 0x10]
push edi
push accept
push 4
push edi
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x479488
push 2
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.start
mov ecx, esi
call fcn.0040a518
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.0040a518
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00590be8
mov esp, ebp
pop ebp
ret

Function at 0x479520
Capabilities:
Check if file exists
Copy file

Disassembly:
push 0x68
mov eax, 0x5e1cf6
call fcn.00592017
lea ecx, [ebp - 0x58]
call fcn.004c1d4b
xor esi, esi
lea ecx, [ebp - 0x40]
push str.360ini.dll
mov edx, eax
mov dword [ebp - 4], esi
call fcn.0041151c
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0040b67b
push 8
pop edi
cmp dword [ebp - 0x2c], edi
lea eax, [ebp - 0x40]
mov ebx, str.CopyIniDllProc
cmovae eax, dword [ebp - 0x40]
push eax
push 0x87
push ebx
push str.__s__d___CopyIniDllProc_dstPath_s
call fcn.0040a649
push ecx
push ecx
mov ecx, esp
push str.installer360ini.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x70]
call fcn.004c1243
add esp, 0x18
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], edi
jb 0x47959c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b0d5
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.0040b67b
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x89
push ebx
push str.__s__d___CopyIniDllProc_oriPath_s
call fcn.0040a649
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4795fc
push 0x8b
push ebx
push str.__s__d___oriPath_path_is_not_exists
call fcn.0040a649
add esp, 0xc
or esi, 0xffffffff
jmp 0x479633
cmp dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x40]
push esi
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8f
push ebx
push str.__s__d___CopyFile_oriPath_to_dstPath_res_d
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040b67b
lea ecx, [ebp - 0x40]
call fcn.0040b67b
mov eax, esi
call fcn.00591fc1
ret 4
Function at 0x47968e
Capabilities:
Create thread

Disassembly:
push 0x1c8
mov eax, 0x5e1d49
call fcn.00592017
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push edx
push ecx
lea ecx, [ebp - 0x1d0]
call fcn.00491157
xor ebx, ebx
lea ecx, [ebp - 0x1d0]
push esi
mov dword [ebp - 4], ebx
call fcn.0049bb32
push edi
lea ecx, [ebp - 0x1d0]
call fcn.0049bb41
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1d0]
push dword [ebp + 8]
call fcn.00493d18
test al, al
jne 0x4796f7
push 0xbb
push str.ShowScreenSaver
push str.__s__d___CreateFrame_failed
jmp 0x479836
call fcn.004c3599
test eax, eax
je 0x47971e
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1d4], ebx
push eax
push ebx
push ebx
push 0x47964d
push ebx
push ebx
call fcn.005b953f
add esp, 0x18
sub esp, 0x18
lea eax, [ebp - 0x1d0]
mov ecx, esp
mov dword [0x6d65e4], eax
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
call fcn.004c1243
add esp, 0x18
push 8
pop edi
cmp dword [eax + 0x14], edi
jb 0x47974d
mov eax, dword [eax]
push eax
call fcn.004302c4
pop ecx
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040b67b
test esi, esi
je 0x47983e
push edi
push ebx
sub esp, 0x18
mov ecx, esp
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x28]
call fcn.004c1243
add esp, 0x18
cmp dword [eax + 0x14], edi
jb 0x479789
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040b67b
sub esp, 0x18
mov ecx, esp
push str.chrome.dll
call fcn.0040b0d5
lea ecx, [ebp - 0x40]
call fcn.004c1243
add esp, 0x18
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], edi
jb 0x4797bf
mov eax, dword [eax]
push eax
push 0xc8
mov edi, str.ShowScreenSaver
push edi
push str.__s__d___chrome.dll__s
call fcn.0040a649
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.0040b67b
test esi, esi
je 0x47982b
push str.ChromeShell
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x47981c
push 0xcd
push edi
push str.__s__d___chrome_main__null
call fcn.0040a649
add esp, 0xc
push ebx
push ebx
push 0x10
push dword [ebp - 0x1c4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x47983e
push 0x6d5dc8
push dword [0x6cf9f4]
call eax
pop ecx
pop ecx
push 0xdd
push edi
push str.__s__d___exit
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x1d0]
call fcn.00491517
call fcn.00591fc1
ret
Function at 0x47984f
Capabilities:
Check if file exists

Disassembly:
push 0x25c
mov eax, 0x5e1d90
call fcn.00592017
and dword [ebp - 0x268], 0
lea ecx, [ebp - 0x28]
call fcn.004ca953
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
push 8
mov ecx, ebx
pop esi
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
cmp dword [eax + 0x14], esi
jb 0x47988c
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4798bb
lea ecx, [ebp - 0x40]
call fcn.004ca953
mov dword [ebp - 0x264], 3
cmp dword [eax + 0x14], esi
jb 0x4798b0
mov eax, dword [eax]
push eax
call fcn.004302c4
pop ecx
test eax, eax
jne 0x4798bd
xor bl, bl
test byte [ebp - 0x264], 2
je 0x4798ce
lea ecx, [ebp - 0x40]
call fcn.0040b67b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b67b
test bl, bl
je 0x479971
lea ecx, [ebp - 0x28]
call fcn.004ca953
cmp dword [eax + 0x14], esi
jb 0x4798f1
mov eax, dword [eax]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0040b67b
test esi, esi
je 0x479971
push str.Start
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x47996a
push 0x20a
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.005a88e0
movaps xmm0, xmmword [0x66d5c0]
lea eax, [ebp - 0x260]
add esp, 0xc
mov dword [ebp - 0x250], 0x1b7740
movups xmmword [ebp - 0x260], xmm0
push eax
call edi
push eax
push 0xf6
push str.Install360Safe
push str.__s__d___HealthMgr::Install360Safe_ret___d
call fcn.0040a649
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00591fc1
ret

Function at 0x479b6c
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
test cl, cl
je 0x479c14
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.005a88e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x62c018
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x479bf3
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x479bf3
push str.SetProcessDpiAwareness
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
call fcn.00426d50
xor ecx, ecx
test al, al
setne cl
inc ecx
test esi, esi
je 0x479c14
push ecx
call esi
test eax, eax
jne 0x479c0e
inc eax
jmp 0x479c16
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00590be8
leave
ret
Function at 0x47b4cc
Capabilities:
Check if file exists

Disassembly:
push 0x134
mov eax, 0x5e21fe
call fcn.00592017
xor ebx, ebx
lea eax, [ebp - 0x94]
push 0x82
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.005a88e0
push 0xa
push 0x40
lea eax, [ebp - 0x94]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005b9854
add esp, 0x20
test eax, eax
je 0x47b52c
push eax
push 0x399
push str.EscapeVirtualizationEx
push str.__s__d___LaunchExitPopup__i64tot_s_error_re___d
call fcn.0040a649
add esp, 0x10
jmp 0x47b768
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.sftldr_wow64.dll
call esi
test eax, eax
jne 0x47b56d
push str.sftldr.dll
call esi
test eax, eax
jne 0x47b56d
call fcn.0047b440
test al, al
jne 0x47b56d
push 0x3b9
push str.EscapeVirtualizationEx
push str.__s__d___WmiLaunchProcess_no_excute
call fcn.0040a649
add esp, 0xc
jmp 0x47b768
lea ecx, [ebp - 0xac]
call fcn.004c0e61
mov byte [ebp - 4], 1
cmp dword [ebp - 0x9c], 0
je 0x47b59e
mov esi, 0x629104
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0xac]
call fcn.0040b220
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0040b0d5
push str._hep:
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 2
call fcn.0040b0d5
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 3
push eax
call fcn.005b93d0
pop ecx
push eax
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0xc4]
call fcn.0040b220
mov esi, str.__efrom:
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc4]
call fcn.0040b220
cmp dword [ebp + 0x24], 8
lea eax, [ebp + 0x10]
push dword [ebp + 0x20]
cmovae eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0040b220
lea eax, [ebp - 0xac]
mov esi, 0x62af60
push eax
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00440e2c
push esi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10c]
call fcn.0041151c
push 0x629244
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf4]
call fcn.0041151c
add esp, 0x14
mov ecx, eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0xc4]
cmp dword [ebp - 0xb0], 8
push dword [ebp - 0xb4]
cmovae eax, dword [ebp - 0xc4]
push eax
call fcn.0040b220
mov byte [ebp - 0x140], bl
lea ecx, [ebp - 0xdc]
push dword [ebp - 0x140]
mov dword [ebp - 0xcc], ebx
push eax
mov dword [ebp - 0xc8], ebx
call fcn.0040b62f
lea ecx, [ebp - 0xf4]
call fcn.0040b67b
lea ecx, [ebp - 0x10c]
call fcn.0040b67b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x124]
call fcn.0040b67b
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47b73a
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push eax
call fcn.004302c4
pop ecx
test eax, eax
je 0x47b73a
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0xdc]
call fcn.004383a1
test al, al
jne 0x47b73a
push 0x3b2
push str.EscapeVirtualizationEx
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x47b73c
mov bl, 1
lea ecx, [ebp - 0xdc]
call fcn.0040b67b
lea ecx, [ebp - 0xc4]
call fcn.0040b67b
lea ecx, [ebp - 0x13c]
call fcn.0040b67b
lea ecx, [ebp - 0xac]
call fcn.0040b67b
lea ecx, [ebp + 0x10]
call fcn.0040b67b
mov al, bl
call fcn.00591fc1
ret
Function at 0x47b778
Capabilities:
Check if file exists

Disassembly:
push 0x80
mov eax, 0x5e2251
call fcn.00592017
mov edi, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.sftldr_wow64.dll
call esi
test eax, eax
jne 0x47b7cc
push str.sftldr.dll
call esi
test eax, eax
jne 0x47b7cc
call fcn.0047b440
test al, al
jne 0x47b7cc
push 0x3d2
push str.CreateProcessByCmd
push str.__s__d___WmiLaunchProcess_no_excute
call fcn.0040a649
add esp, 0xc
xor al, al
jmp 0x47b90b
lea ecx, [ebp - 0x28]
call fcn.004c0e61
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x47b7f4
mov esi, 0x629104
push esi
call fcn.005b93d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0x28]
mov esi, 0x62af60
push eax
lea eax, [ebp - 0x88]
push esi
push eax
call fcn.00440e2c
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0041151c
push 0x629244
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0041151c
add esp, 0x14
push edi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004114f6
mov byte [ebp - 0x8c], bl
lea ecx, [ebp - 0x40]
push dword [ebp - 0x8c]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0040b62f
lea ecx, [ebp - 0x58]
call fcn.0040b67b
lea ecx, [ebp - 0x70]
call fcn.0040b67b
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 7
call fcn.0040b67b
push 8
pop esi
cmp dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edi, str.CreateProcessByCmd
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], esi
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x3c7
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47b8f7
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c4
pop ecx
test eax, eax
je 0x47b8f7
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x40]
call fcn.004383a1
test al, al
jne 0x47b8f7
push 0x3cb
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x47b8f9
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.0040b67b
lea ecx, [ebp - 0x28]
call fcn.0040b67b
mov al, bl
call fcn.00591fc1
ret
Function at 0x47bb82
Capabilities:
Check if file exists

Disassembly:
push 0x80
mov eax, 0x5e2251
call fcn.00592017
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004c0e61
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x47bbbb
mov edi, 0x629104
push edi
call fcn.005b93d0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
lea eax, [ebp - 0x28]
mov edi, 0x62af60
push eax
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.00440e2c
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0041151c
push 0x629244
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0041151c
add esp, 0x14
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004114f6
mov byte [ebp - 0x8c], bl
lea ecx, [ebp - 0x40]
push dword [ebp - 0x8c]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.0040b62f
lea ecx, [ebp - 0x58]
call fcn.0040b67b
lea ecx, [ebp - 0x70]
call fcn.0040b67b
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 7
call fcn.0040b67b
push 8
pop esi
cmp dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edi, str.CreateProcessByWmi
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], esi
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 0x416
push edi
push str.__s__d__szExePath:_s__strCmdLine:_s
call fcn.0040a649
add esp, 0x14
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47bcbe
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c4
pop ecx
test eax, eax
je 0x47bcbe
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x40]
call fcn.004383a1
test al, al
jne 0x47bcbe
push 0x41b
push edi
push str.__s__d___WmiLaunchProcess_excute_failed
call fcn.0040a649
add esp, 0xc
jmp 0x47bcc0
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.0040b67b
lea ecx, [ebp - 0x28]
call fcn.0040b67b
mov al, bl
call fcn.00591fc1
ret
Function at 0x4821df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x5e27fc
call fcn.00592085
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x48225c
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x48225c
call fcn.0045dd92
mov esi, eax
jmp 0x482362
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x48227f
call fcn.0045dd92
jmp 0x482355
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x482275
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x4822b2
mov esi, 0x8007000e
jmp 0x482357
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x482385
jb 0x4822cd
cmp eax, 0xffffffff
ja 0x482385
cmp eax, 0x400
jbe 0x4822e2
push eax
lea ecx, [ebp - 0x418]
call fcn.00480e48
jmp 0x482304
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x482304
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x4822a8
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x482275
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0048208a
mov esi, eax
test edi, edi
je 0x482362
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x48237b
lea ecx, [ebp - 0x418]
call fcn.00480e33
mov eax, esi
call fcn.00591fd2
ret 0x10
push 0x80070216
call fcn.00422a7e
int3
Function at 0x482f39
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x483043
cmp dword [ebp + 0xc], 0x104
jne 0x482fa3
cmp dword [ebp + 0x10], 0x73
jne 0x483007
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x483007
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, dword [ebp + 8]
jne 0x482f8f
push 0xe0
push str.BaseWallPaperFrame::DidProcessEvent
push str.__s__d___DidProcessEvent_close
call fcn.0040a649
add esp, 0xc
push 0
push 0
push 0x10
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x483043
cmp dword [ebp + 0xc], 0x112
jne 0x483007
cmp dword [ebp + 0x10], 0xf120
jne 0x483007
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x483007
mov eax, dword [ecx]
call dword [eax + 4]
cmp eax, dword [ebp + 8]
jne 0x483007
mov eax, dword [esi + 0xc4]
sub eax, dword [esi + 0xc0]
push 0x6c
cdq
pop ecx
idiv ecx
cmp eax, 1
jbe 0x483007
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, dword [esi + 0x28]
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esi + 0x170]
mov eax, dword [ecx]
push dword [esi + 0x16c]
push 0
call dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x6cfc04], 0
je 0x483043
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x483043
cmp dword [ebp + 0x10], 0x7b
jne 0x483043
mov ecx, dword [esi + 0x28]
push 0
push 4
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0x38]
mov ecx, dword [esi + 0x28]
call fcn.00482794
pop esi
pop ebp
ret 0x10
Function at 0x484904
Capabilities:
Check if file exists

Disassembly:
push 0xd8
mov eax, 0x5e2c7b
call fcn.00592017
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xe0], eax
cmp dword [eax + 0x10], 0
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ebx
je 0x484a5f
mov edi, dword [ebx]
mov eax, dword [ebx + 4]
cmp edi, eax
je 0x484a5f
mov ebx, eax
push edi
lea ecx, [ebp - 0x78]
call fcn.0048263f
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x484a29
lea ecx, [ebp - 0xd0]
call fcn.0040ba44
push 0x170
mov byte [ebp - 4], 1
call fcn.00590c07
pop ecx
mov dword [ebp - 0xd4], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040b6ae
mov esi, eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.0040b8c8
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040b9f1
push 0x12c
mov ecx, esi
call fcn.0040b8d1
push esi
call fcn.0040bde0
test eax, eax
je 0x484a1e
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x90]
call fcn.00430aaf
add esp, 0x18
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x4849fb
mov eax, dword [eax]
push eax
push 0x34f
push str.BaseWallPaperFrame::AddWaterMark
push str.__s__d___HttpDownloadSync_watermark:_s
call fcn.0040a649
add esp, 0x10
lea ecx, [ebp - 0x90]
call fcn.0040b67b
lea ecx, [ebp - 0xd0]
call fcn.0040ba5f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004848e0
add edi, 0x68
cmp edi, ebx
jne 0x484947
mov ebx, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xdc]
mov edx, ecx
mov ecx, dword [ebp - 0xe0]
push ebx
push dword [ebp + 0x10]
call fcn.004b3b9b
pop ecx
pop ecx
call fcn.00591fc1
ret 0x10

Function at 0x486b3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x154], eax
test eax, eax
jne 0x486b6b
push 0x550
push str.BaseWallPaperFrame::StartSetWallpaperThread
push str.__s__d___create_event_failed
jmp 0x486b9c
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x486ba8
push edi
push edi
call fcn.005b953f
add esp, 0x18
mov dword [esi + 0x158], eax
test eax, eax
jne 0x486ba4
push 0x557
push str.BaseWallPaperFrame::StartSetWallpaperThread
push str.__s__d___create_thread_failed
call fcn.0040a649
add esp, 0xc
pop edi
pop esi
leave
ret