joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e6aa
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
cmp dword [ebx + 4], esi
jne 0x47e6c4
xor eax, eax
jmp 0x47e867
lea eax, [ebp + 8]
push eax
mov edi, ebx
mov dword [ebp + 8], esi
call fcn.0047e5d7
cmp eax, 0x57
je 0x47e6bd
cmp eax, 2
jne 0x47e6e4
mov dword [ebx], 4
jmp 0x47e6bd
cmp eax, 0x3ee
jne 0x47e78c
mov eax, dword [ebx + 4]
add eax, 0x410
push eax
call fcn.0047ea34
pop ecx
test eax, eax
je 0x47e6bd
test byte [ebp + 8], 1
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
je 0x47e764
mov dword [ebx], 3
call fcn.0044272f
test eax, eax
je 0x47e745
lea esi, [ebp - 0x18]
call fcn.00414c78
mov eax, dword [ebx + 4]
push 0
lea ecx, [eax + 0x208]
push ecx
add eax, 0x410
push eax
call edi
mov dword [ebp - 4], eax
call fcn.00414d54
xor esi, esi
jmp 0x47e75b
mov eax, dword [ebx + 4]
push esi
lea ecx, [eax + 0x208]
push ecx
add eax, 0x410
push eax
call edi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
je 0x47e6bd
test byte [ebp + 8], 2
je 0x47e85e
mov eax, dword [ebx + 4]
push esi
lea ecx, [eax + 0xa28]
push ecx
add eax, 0x410
push eax
mov dword [ebx], 2
call edi
jmp 0x47e856
mov edi, dword [ebx + 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
add edi, 0x410
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], esi
call fcn.004413a9
pop ecx
pop ecx
test al, al
je 0x47e6bd
mov edi, dword [ebx + 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
add edi, 0x208
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.004413a9
pop ecx
pop ecx
test al, al
je 0x47e6bd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jb 0x47e7ea
jne 0x47e85e
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x47e85e
call fcn.0044272f
test eax, eax
je 0x47e81e
lea esi, [ebp - 0x18]
call fcn.00414c78
mov eax, dword [ebx + 4]
push 0
lea ecx, [eax + 0x208]
push ecx
add eax, 0x410
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
call fcn.00414d54
xor esi, esi
jmp 0x47e837
mov eax, dword [ebx + 4]
push esi
lea ecx, [eax + 0x208]
push ecx
add eax, 0x410
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp edi, esi
je 0x47e6bd
mov eax, dword [ebx + 4]
push esi
lea ecx, [eax + 0xa28]
push ecx
add eax, 0x410
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x47e6bd
push ebx
call fcn.0047e86e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x47e86e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
xor esi, esi
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.004e7380
push dword [ebx + 4]
lea edi, [ebp - 0x414]
push str.SystemCurrentControlSetServices_s
push 0x104
call fcn.00421d97
add esp, 0x18
test eax, eax
jl 0x47ea23
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 2
push esi
push esi
push esi
mov eax, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47ea23
push 4
pop edi
push edi
lea eax, [ebp - 0x41c]
push eax
push edi
push esi
push str.Start
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004e7380
add esp, 0xc
push str.system32DRIVERS_
push 0x104
lea edx, [ebp - 0x20c]
call fcn.00424ffd
test eax, eax
jl 0x47ea23
mov eax, dword [ebx + 4]
add eax, 0x820
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042388f
test eax, eax
jl 0x47ea23
lea eax, [ebp - 0x20c]
push eax
call fcn.004e73fa
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.ImagePath
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 4]
push edi
add eax, 0xc34
push eax
push edi
push 0
push str.Type
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 4]
push edi
add eax, 0xc38
push eax
push edi
push 0
push str.ErrorControl
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 4]
mov edi, 0x618
add eax, edi
push eax
call fcn.004e73fa
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebx + 4]
add eax, edi
push eax
push 1
push 0
push str.DisplayName
push dword [ebp - 0x418]
call esi
mov ebx, str.Early_Launch
push ebx
call fcn.004e73fa
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push str.Group
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e736b
leave
ret 4
Function at 0x481161
Capabilities:
Resume thread

Disassembly:
push 0x21c
mov eax, 0x51b8db
call fcn.004f21c7
mov esi, 0x582e91
push esi
push 0x22c
call fcn.004eb6e3
xor ebx, ebx
pop ecx
pop ecx
cmp eax, ebx
je 0x4811ab
or dword [eax], 0xffffffff
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x220], ebx
mov dword [eax + 0x224], ebx
mov dword [eax + 0x228], ebx
jmp 0x4811ad
xor eax, eax
push esi
mov dword [0x58564c], eax
xor ecx, ecx
push 2
pop edx
mov eax, 0x105
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004eb416
push esi
push 0x20
mov dword [0x585650], eax
call fcn.004eb6e3
add esp, 0x10
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4811f1
push eax
call fcn.0043e8b9
jmp 0x4811f3
xor eax, eax
or esi, 0xffffffff
mov dword [ebp - 4], esi
push 0x585178
mov dword [0x585648], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.004c8640
mov dword [0x57a980], eax
cmp dword [0x58564c], ebx
je 0x4812bc
cmp dword [0x585650], ebx
je 0x4812bc
cmp dword [0x585648], ebx
je 0x4812bc
call fcn.004c8e30
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea esi, [ebp - 0x220]
mov ecx, edi
call fcn.004c8f20
xor esi, esi
inc esi
cmp eax, esi
pop ecx
jl 0x481288
lea eax, [ebp - 0x220]
push eax
push str..pipe_ws
push 0x208
push dword [0x585650]
call fcn.004250b8
mov ecx, dword [0x585650]
add esp, 0x10
xor eax, eax
mov word [ecx + 0x208], ax
call fcn.004a501c
cmp eax, esi
jne 0x4812b0
cmp byte [0x5856ce], bl
je 0x4812b0
mov eax, dword [0x57a2b4]
mov byte [0x5856cd], bl
cmp eax, 0xffffffff
je 0x4812b0
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x585640], esi
mov dword [0x585644], ebx
mov eax, esi
call fcn.004f224a
ret

Function at 0x484a2f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
mov eax, dword [ebp + 8]
call fcn.00483fc4
test al, al
jne 0x484a61
push 0x64
call sub.KERNEL32.dll_Sleep
call esi
sub eax, edi
cmp eax, 0x7d0
jb 0x484a3e
push 0xfffffffffffffffc
pop eax
jmp 0x484a6c
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.00484952
pop edi
pop esi
pop ebp
ret 8

Function at 0x485132
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push 0x545d4c
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x485157
cmp eax, 5
jne 0x48515a
xor edi, edi
inc edi
test esi, esi
je 0x48516c
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x48579f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push 0x485171
push eax
push eax
mov dword [ebp - 4], eax
mov byte [0x5856b7], al
call fcn.004eb0fa
add esp, 0x18
mov dword [0x57a7ac], eax
leave
ret
Function at 0x485c48
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp byte [esi + 0x18], bl
jne 0x485cd2
cmp dword [0x5856b8], ebx
jne 0x485c81
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x485c81
push str.CancelIoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5856b8], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0xac], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0xa4], eax
call edi
mov dword [esi + 0xa0], eax
mov eax, esi
call fcn.00486323
lea eax, [esi + 0xb0]
push eax
push ebx
push esi
push 0x48636d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa8], eax
mov byte [esi + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
pop ecx
ret
Function at 0x486b69
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor eax, eax
movzx esi, ax
push edi
add edx, 4
mov eax, esi
shl esi, 0x10
or eax, esi
mov edi, edx
mov ecx, 0x82
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push edx
lea eax, [ebp - 8]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x208
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop edi
pop esi
leave
ret
Function at 0x487711
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x218
mov eax, 0x51b8a0
call fcn.004f21c7
mov esi, 0x5873e8
mov dword [ebp - 0x224], esi
call fcn.00404939
and dword [ebp - 4], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004e7380
and dword [ebp - 0x21c], 0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4877b6
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00405721
push str._softmgrdata_softpackgelist.dat
push esi
call fcn.004047b1
mov eax, esi
call fcn.004f224a
ret
Function at 0x487b49
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x51f4d0
call fcn.004f215e
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x48]
xor edi, edi
push eax
mov dword [ebp - 0x18], edi
call fcn.00439706
mov dword [ebp - 4], edi
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], edi
sar eax, 2
test eax, eax
jbe 0x487c3d
mov edi, dword [ebp - 0x14]
mov esi, ebx
call fcn.004b1b7d
mov eax, dword [eax]
sub eax, 0x10
call fcn.0040499b
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00425111
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041787f
lea edi, [ebp - 0x20]
mov esi, eax
call fcn.0049da45
mov esi, dword [ebp + 0xc]
test al, al
je 0x487c19
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0041775c
mov edi, eax
lea eax, [ebp + 0xc]
call fcn.004044e5
push dword [esi - 0xc]
lea eax, [ebp - 0x10]
push esi
call fcn.0040473e
push 0x53e940
lea eax, [ebp - 0x10]
push eax
call fcn.004047b1
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.0040557a
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [ebp - 0x14]
sar eax, 2
cmp dword [ebp - 0x14], eax
jb 0x487b94
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
xor edi, edi
cmp eax, edi
mov eax, dword [ebp + 8]
jne 0x487c73
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
call fcn.0040557a
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x48]
push eax
call fcn.0042241a
mov eax, esi
call fcn.004f2236
ret 8
mov eax, dword [eax]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x487d31
cmp eax, 0xffffffff
je 0x487d22
mov eax, dword [esi - 0xc]
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
push 0x582e91
push eax
call fcn.004eb416
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x487d22
lea eax, [ebx + 2]
push eax
push 0
push edi
call fcn.004e7380
add esp, 0xc
push 0
lea esi, [ebp - 0x10]
mov byte [edi], 0xff
mov byte [edi + 1], 0xfe
call fcn.0040566b
push eax
push ebx
lea eax, [edi + 2]
push eax
call fcn.00421170
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x487d18
cmp ebx, dword [ebp + 0xc]
jne 0x487d18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp + 8], 0
mov dword [ebp - 0x18], 1
push edi
call fcn.004e85e3
mov esi, dword [ebp - 0x10]
pop ecx
cmp dword [ebp + 8], 0
je 0x487d31
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
call fcn.0040557a
mov esi, dword [ebp - 0x18]
jmp 0x487c5c
Function at 0x487e18
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
mov edi, str.SOFTWARE360Safe_stat
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x487e4a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push 4
lea eax, [ebp - 8]
push eax
push 4
push str.ManExit
push edi
push esi
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
leave
ret

Function at 0x488020
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x214], esi
test byte [0x587594], 1
jne 0x48806c
mov eax, dword [0x582d44]
or dword [0x587594], 1
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
push 0x529344
mov dword [0x587590], eax
call fcn.004e9f4f
pop ecx
mov eax, dword [0x587590]
cmp dword [eax - 0xc], esi
jne 0x488107
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.004e7380
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
mov dword [ebp - 0x214], 0x104
call esi
test eax, eax
jne 0x4880da
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
mov dword [ebp - 0x214], 0x104
call esi
mov eax, dword [ebp - 0x214]
cmp eax, 0x105
jae 0x488102
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
push eax
push 0x587590
call fcn.00405721
mov eax, dword [0x587590]
add eax, 0xfffffff0
call fcn.0040499b
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop esi
call fcn.004e736b
leave
ret

Function at 0x488123
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x51b9e1
call fcn.004f21c7
mov ebx, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x228], 0
push 0x52f388
push ebx
mov dword [ebp - 0x22c], ebx
call fcn.00405747
and dword [ebp - 4], 0
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x21c], ax
xor esi, esi
lea eax, [ebp - 0x21a]
inc esi
push eax
mov dword [ebp - 0x228], esi
call fcn.004e7380
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push str.RecordDeviceName
push str.software360TotalSecurityUserProfile
push SysReAllocString
mov dword [ebp - 0x224], 0x209
mov dword [ebp - 0x220], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4881c7
lea eax, [ebp - 0x21c]
push eax
push ebx
call fcn.00405721
mov eax, ebx
call fcn.004f224a
ret

Function at 0x488728
Capabilities:
Set registry value

Disassembly:
push 2
push 0x52f388
push 1
push 0x5462b8
push str.SOFTWARE360SafeMsgCenter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
ret
Function at 0x489457
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0xc]
sub eax, 0x10
call fcn.0040557a
mov eax, dword [esi + 8]
sub eax, 0x10
call fcn.0040557a
mov eax, dword [esi + 4]
sub eax, 0x10
call fcn.0040557a
mov eax, dword [esi]
sub eax, 0x10
jmp fcn.0040557a
Function at 0x48b776
Capabilities:
Get common file path

Disassembly:
push 0x1c
mov eax, 0x52116b
call fcn.004f215e
mov eax, dword [0x582d44]
mov edi, 0x582d44
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
xor ebx, ebx
push 0x104
lea esi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0040566b
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x48b7cc
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040557a
mov al, bl
call fcn.004f2236
ret
or eax, 0xffffffff
lea esi, [ebp - 0x14]
call fcn.00423989
mov eax, dword [0x582d44]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov byte [ebp - 0xd], bl
call fcn.0040adfd
test al, al
lea eax, [ebp - 0x18]
je 0x48b811
push str.360box64.sys
push dword [ebp - 0x14]
push str._sdrivers_s
push eax
call fcn.00404568
mov al, 1
jmp 0x48b827
push str.360box.sys
push dword [ebp - 0x14]
push str._sdrivers_s
push eax
call fcn.00404568
mov al, byte [ebp - 0xd]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x28]
add esp, 0x10
push eax
mov dword [ebp - 0x28], str.ipc_sbmon.dll
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], bl
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x1c], bl
call fcn.0049de31
mov bl, al
pop ecx
lea eax, [esi - 0x10]
call fcn.0040557a
jmp 0x48b7b9
Function at 0x48f62d
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0040a4e1
test al, al
jne 0x48f73e
xor edi, edi
push edi
push str.Q360TaskBtn
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x48f671
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x48f73e
push 0x53e61c
push dword [0x5864c0]
call fcn.004ead89
pop ecx
pop ecx
test eax, eax
jne 0x48f73e
mov ebx, 0x585d80
mov eax, ebx
call fcn.00443792
test al, al
jne 0x48f73e
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004e7380
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.360safe360SoftMgrLiteTaskBarBtn.ini
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
push 1
push str.StartFlag
push str.TaskBarBtn
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x48f73e
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.004e7380
add esp, 0xc
push str.softmgrSMLSoftMgrLite.exe
push ebx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
push 1
push edi
lea eax, [ebp - 0x418]
call fcn.00442a8c
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e736b
leave
ret

Function at 0x48fbf8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov edi, ecx
call fcn.004e7380
add esp, 0xc
push str.safemon360safemonpro.tpi
push 0x585d80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48fcc8
lea eax, [ebp - 0x210]
push eax
call fcn.004426d5
pop ecx
test eax, eax
je 0x48fcc8
push str.CreateTrayClient
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48fcc8
and dword [ebp - 0x218], 0
lea ecx, [ebp - 0x218]
push ecx
push 1
call eax
mov dword [edi + 0x434], eax
test eax, eax
je 0x48fcc8
and dword [ebp - 0x214], 0
mov edx, dword [eax]
lea esi, [ebp - 0x214]
lea ecx, [edi + 0x24]
push esi
push ecx
mov ecx, eax
call dword [edx + 8]
test eax, eax
je 0x48fcc8
mov ecx, dword [edi + 0x434]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
je 0x48fcc8
mov dword [edi + 0x118], 1
push 0x582e91
push 0xc
call fcn.004eb6e3
pop ecx
pop ecx
test eax, eax
je 0x48fce3
mov esi, eax
call fcn.00486cb3
jmp 0x48fce5
xor eax, eax
push eax
add edi, 0x97c
call fcn.0049b694
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e736b
leave
ret
Function at 0x4917d3
Capabilities:
Shutdown system

Disassembly:
push 0x40
mov eax, 0x51df96
call fcn.004f215e
xor edi, edi
push edi
push str.IDS_TRAP_TIP
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.0043913e
add esp, 0xc
mov dword [ebp - 4], edi
cmp dword [eax + 0x18], 8
jb 0x491802
mov eax, dword [eax + 4]
jmp 0x491805
add eax, 4
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405747
push edi
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00404e82
push edi
push str.IDS_TRAY_REBOOT_FIX_TEXT
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.0043913e
add esp, 0xc
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x491840
mov eax, dword [eax + 4]
jmp 0x491843
add eax, 4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405747
push edi
push 1
lea esi, [ebp - 0x4c]
call fcn.00404e82
mov eax, dword [ebp + 8]
push 0x34
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x491883
call fcn.00491773
push 0x80020004
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040557a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040557a
xor eax, eax
call fcn.004f2236
ret 4

Function at 0x491e30
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
push esi
mov esi, eax
mov dword [esi + 0x528], ebx
push edi
mov dword [esi + 0x444], ebx
mov dword [esi + 0x44c], ebx
mov dword [esi + 0x450], ebx
mov dword [esi + 0x448], ebx
lea edi, [esi + 0x470]
call fcn.0049b57c
push ebx
push 0x2710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push ebx
push ebx
xor edi, edi
inc edi
push edi
mov dword [esi + 0x444], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x491ece
push ebx
push ebx
mov dword [esi + 0x450], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x44c], eax
mov eax, dword [esi + 0x444]
test eax, eax
je 0x491ebd
cmp dword [esi + 0x450], ebx
je 0x491ebd
cmp dword [esi + 0x44c], ebx
je 0x491ebd
mov dword [esi + 0x528], edi
cmp dword [esi + 0x528], ebx
jne 0x491eca
call fcn.004921e1
pop edi
pop esi
pop ebx
ret