joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4914fa
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x613055
call fcn.0060c3a8
sub esp, 0x408
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x414]
push esi
push edi
push 0x400
push 0
push eax
mov esi, str.https:__wpa1.qq.com_5ciKQjBf__typewpaqidiantrue
mov edi, str.MarketQQLink
call fcn.005e1e60
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [0x6c8ec4]
cmp eax, dword [ecx + 4]
jle 0x49157d
push 0x6c8ec4
call fcn.0049a15e
cmp dword [0x6c8ec4], 0xffffffff
pop ecx
jne 0x49157d
and dword [ebp - 4], 0
call fcn.00491386
push 0x613a6b
call fcn.0049a4b5
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x6c8ec4
call fcn.0049a11f
pop ecx
mov ecx, dword [0x6c8ecc]
test ecx, ecx
je 0x49159b
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
test al, al
je 0x49159b
mov esi, str.https:__wpa1.qq.com_FDdK6y0s__typewpaqidiantrue
mov edi, str.VipMarketQQLink
xor edx, edx
lea ecx, [ebp - 0x10]
call fcn.0040b184
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040ab52
push str.dataoperation_contact.dat
lea ecx, [ebp - 0x10]
call fcn.004062d3
push dword [ebp - 0x10]
lea eax, [ebp - 0x414]
push 0x200
push eax
push esi
push edi
push str.FeedBack
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.00406173
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4924e7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
sub eax, 1
je 0x49252a
sub eax, 1
je 0x492523
sub eax, 1
je 0x49250b
sub eax, 1
jne 0x49252f
call fcn.0049453d
jmp 0x49252f
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x49252f
call fcn.00492f3b
jmp 0x49252f
call fcn.004929ae
pop esi
pop ebp
ret 4

Function at 0x49268e
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x60d0c5
call fcn.0060c3a8
push ecx
push ebx
push edi
push 1
xor edi, edi
mov ebx, str.https:__www.ijinshan.com_privacy_duba_enduserlicenseandsevice_agreement.html
push edi
push edi
push ebx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4926f8
push 1
push edi
push ebx
push str.IEXPLORE.EXE
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4926f8
lea ecx, [ebp - 0x10]
call fcn.00470d1e
sub esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call fcn.004701f0
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492708
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, 0x61318c
call fcn.0060c3a8
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 4], 0
push 0x66
push dword [0x6c45a8]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
mov dword [ebx + 0x648], 7
mov eax, dword [ebx + 4]
lea edi, [ebx + 0x63c]
push 0x69faec
lea edx, [ebx + 0x61c]
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov dword [ebx + 0x650], esi
mov dword [edi], 0x3bc
mov dword [ebx + 0x64c], 0x468
mov dword [ebx + 0x640], eax
mov dword [ebx + 0x95c], 3
mov dword [ebx + 0x644], 2
call fcn.0040aec1
push dword [eax]
lea eax, [ebx + 0x654]
push 0x80
push eax
call fcn.005f1efc
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
test esi, esi
je 0x4927c4
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49302f
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
mov edx, dword [esi]
call fcn.00470738
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [esi]
push 3
pop edi
cmp dword [eax - 0xc], edi
jl 0x4930f1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x493073
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x4930f1
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
cmp eax, edi
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x4930a0
push 2
pop eax
jmp 0x4930f4
mov ecx, esi
call fcn.00492fba
test eax, eax
je 0x4930af
mov eax, edi
jmp 0x4930f4
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00491330
mov ecx, dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
add bl, 1
je 0x4930dc
push 4
jmp 0x49309d
mov eax, dword [esi]
xor ecx, ecx
push 5
pop edx
cmp dword [eax - 0xc], 0x96
cmovg ecx, edx
mov eax, ecx
jmp 0x4930f4
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4930fb
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x6131f3
call fcn.0060c3a8
sub esp, 0x448
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x454]
push esi
push eax
mov ebx, ecx
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push 0x11
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push 0x105
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040682a
push esi
lea ecx, [ebp - 0x14]
call fcn.00406601
push 0x69fdc8
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
cmp dword [edi - 4], 1
jle 0x4931a2
push dword [edi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406af0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], edi
push eax
mov dword [ebp - 0x34], 0x69fe10
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x49327a
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
lea edx, [ebp - 0x24c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00470738
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00406668
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push str.kingsoft_antivirus_
lea ecx, [ebp - 0x18]
call fcn.004062d3
mov esi, dword [ebp - 0x18]
push esi
push dword [ebx + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x18]
call fcn.0049302f
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [ebx + 0x5b8], 2
lea ecx, [esi - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [edi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49343d
Capabilities:
Get common file path
Get program files directory

Disassembly:
push esi
push edi
lea edi, [ecx + 0x5b0]
push 0x104
mov ecx, edi
call fcn.0040682a
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, edi
mov esi, eax
call fcn.00408f1c
test esi, esi
jne 0x493479
push str.c:program_files
mov ecx, edi
call fcn.004060f8
push str.kingsoftkingsoft_antivirus_
mov ecx, edi
call fcn.004062d3
pop edi
pop esi
ret
Function at 0x493ab1
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x60d30a
call fcn.0060c3a8
push ecx
push ecx
push ebx
push esi
push edi
push 0x208
push 0x199
mov esi, ecx
call fcn.00493926
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x5d4], eax
sete al
push eax
call fcn.00494015
mov ecx, esi
call fcn.00493c18
push str.soguo_mainbg_new
push str.skin
lea edi, [esi + 0x28]
push 3
mov ecx, edi
call fcn.0044b460
push str.0_0__0__0
mov ebx, 0x69b178
mov ecx, edi
push ebx
push 3
call fcn.0044b460
cmp dword [esi + 0x5d4], 0
jne 0x493c07
push str.15__153__15__63
push ebx
push 0xc8
mov ecx, edi
call fcn.0044b460
push str.softtemprory.png
lea edx, [esi + 0x620]
lea ecx, [ebp - 0x10]
call fcn.0040aec1
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, edi
test eax, eax
je 0x493b77
push dword [ebp - 0x10]
mov esi, 0x25c
push str.filepath
push esi
call fcn.004486f0
push str._36_103_36_175
mov ecx, edi
jmp 0x493b81
push str._30_103_30_163
mov esi, 0x25d
push ebx
push esi
call fcn.0044b460
push 1
push esi
mov ecx, edi
call fcn.004486ab
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
call fcn.004384e3
add eax, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.00406123
mov esi, dword [ebp - 0x14]
mov ebx, 0x25e
push esi
push ebx
mov ecx, edi
call fcn.00448768
push str.30_190__30_234
push 0x69b178
push ebx
mov ecx, edi
call fcn.0044b460
push str.sogou_aladdin_titlt
push str.class
push ebx
mov ecx, edi
call fcn.004486f0
push 1
push ebx
mov ecx, edi
call fcn.004486ab
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493d87
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x61323a
call fcn.0060c3a8
sub esp, 0x90
push ebx
push esi
push edi
push 0x1b8
push 0x258
mov edi, ecx
call fcn.00493926
push 1
mov ecx, edi
call fcn.00494015
push str.scene5_logo
push str.skin
lea esi, [edi + 0x28]
mov ebx, 0x25a
push ebx
mov ecx, esi
call fcn.0044b460
push str.16_0
push 0x69b178
push ebx
mov ecx, esi
call fcn.0044b460
push 1
push ebx
mov ecx, esi
call fcn.004486ab
push str.scene5_bg
push str.skin
push 3
mov ecx, esi
call fcn.0044b460
push str.0_0__0__0
mov ebx, 0x69b178
mov ecx, esi
push ebx
push 3
call fcn.0044b460
push str.0__105__0__15
push ebx
push 0xc8
mov ecx, esi
call fcn.0044b460
push 1
push 0x262
mov ecx, esi
call fcn.004486ab
push str.softtemprory.png
lea edx, [edi + 0x624]
lea ecx, [ebp - 0x14]
call fcn.0040aec1
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
je 0x493e7a
push dword [ebp - 0x14]
mov ebx, 0x264
push str.filepath
push ebx
call fcn.004486f0
push 1
push ebx
mov ecx, esi
call fcn.004486ab
xor ebx, ebx
jmp 0x493e86
push 1
push 0x265
call fcn.004486ab
push 1
push 0x263
mov ecx, esi
call fcn.004486ab
push 0x64
lea eax, [ebp - 0x10]
push eax
call fcn.004943b6
mov byte [ebp - 4], 1
mov ecx, esi
push dword [eax]
push 0x266
call fcn.00448768
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.004943b6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push 0xfde9
push dword [eax]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x9c]
call fcn.00408f48
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
push dword [ebp - 0x9c]
call fcn.00413e4d
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x9c], eax
je 0x493f1c
push dword [ebp - 0x9c]
call fcn.005f06f3
pop ecx
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00494a69
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404ea9
push ecx
push ecx
mov ecx, edi
call fcn.00494436
xor eax, eax
mov ecx, esi
cmp dword [edi + 0x5d4], ebx
sete al
push eax
push 0x267
call fcn.004486ab
cmp dword [edi + 0x5d4], ebx
jne 0x493f79
push ebx
push 0x53
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x493f8f
push str.0_268__0_300
push 0x69b178
push 0x1fb
mov ecx, esi
call fcn.0044b460
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x494645
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x49467c
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x49466f
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
Function at 0x49486a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x4948e2
cmp dword [ebp + 0xc], esi
je 0x4948e2
cmp dword [edi + 0x10], esi
je 0x4948a1
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x49489c
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x4948e2
mov ebx, dword [edi]
push 0x18
call fcn.00431d79
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4948d6
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48e247
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f3fd0
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x4948e4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x494e34
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x494f80
mov ebx, dword [ebp + 0xc]
xor esi, esi
inc esi
cmp ebx, 0x4e
jne 0x494e85
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x494f89
push ecx
mov ecx, edi
mov dword [edi + 0x580], esi
call fcn.00494d8e
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], 0
je 0x494f5c
mov eax, esi
jmp 0x494f82
cmp ebx, 0x113
jne 0x494ed4
mov eax, 0x2711
mov dword [edi + 0x580], esi
cmp dword [ebp + 0x10], eax
jne 0x494ecc
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [edi + 0x58c]
push 0x3ed
push 0x476
push dword [edi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp + 0x18]
and dword [ecx], 0
jmp 0x494e71
cmp ebx, 0x110
jne 0x494ef6
push 0
push 0
push 0x473
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x494ecc
cmp ebx, 0x473
jne 0x494f19
call fcn.004951a9
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x494f82
cmp ebx, 0x477
jne 0x494f36
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.0049500c
jmp 0x494e6c
cmp ebx, 0x478
jne 0x494f89
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.0049506e
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x580], 0
jne 0x494f14
mov ecx, esi
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0044b4de
mov dword [edi + 0x578], esi
test eax, eax
jne 0x494f14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
jmp 0x494f5c
Function at 0x49526e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x4952d7
cmp dword [ebp + 0x1c], 0x12d
jne 0x495441
cmp dword [ebp + 0xc], 0x100
jne 0x495441
xor ebx, ebx
push 0x11
mov dword [edi + 0x580], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp + 0x10], 0x61
movzx eax, ax
je 0x4952b5
cmp dword [ebp + 0x10], 0x41
jne 0x4952c7
test al, al
jns 0x4952c7
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00494841
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x580], ebx
jmp 0x49543f
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
xor ebx, ebx
cmp eax, 0x4e
jne 0x49532e
mov edx, dword [ebp + 0x14]
cmp dword [edx + 4], 0xffffffff
jne 0x49541a
mov dword [edi + 0x580], esi
cmp dword [edx + 8], esi
jne 0x49530e
cmp dword [edx + 0xc], 0x12e
jne 0x49530e
call fcn.004955d7
mov eax, esi
jmp 0x495316
mov dword [edi + 0x580], ebx
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], ebx
je 0x49541a
mov eax, esi
jmp 0x495443
cmp eax, 0x110
jne 0x495351
mov dword [edi + 0x580], esi
call fcn.00495746
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
jmp 0x49531b
cmp eax, 0x465
jne 0x49536a
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00495527
jmp 0x495316
cmp eax, 0x466
jne 0x495381
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.0049557d
jmp 0x495316
mov edx, 0x46c
cmp eax, edx
jne 0x49539d
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.004959f3
jmp 0x495316
cmp eax, 0x46f
jne 0x4953be
push dword [edi + 0x5b0]
mov dword [edi + 0x580], esi
push dword [edi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x49534a
cmp eax, 0x10
jne 0x4953df
push ebx
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49534a
cmp eax, 0x111
jne 0x49541a
mov eax, dword [ebp + 0x10]
mov ecx, 0x300
shr eax, 0x10
mov dword [edi + 0x580], ebx
cmp cx, ax
jne 0x495408
push ebx
push ebx
push edx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
cmp dword [edi + 0x580], ebx
je 0x49541a
xor eax, eax
inc eax
jmp 0x495443
mov esi, dword [edi + 0x578]
mov ecx, edi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044b4de
mov dword [edi + 0x578], esi
test eax, eax
jne 0x495415
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x4955d7
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x60db35
call fcn.0060c3a8
sub esp, 0x43c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x18], ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov edi, 0x208
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.005e1e60
push edi
lea eax, [ebp - 0x448]
push ebx
push eax
call fcn.005e1e60
add esp, 0x18
lea eax, [ebp - 0x448]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x69fdc8
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
push 0x105
mov dword [ebp - 0x34], eax
call fcn.0040682a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], 0x69fe10
mov dword [ebp - 0x28], 0x8041
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00408f1c
test edi, edi
je 0x49571d
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x240]
push eax
call fcn.005f06f8
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x10]
call fcn.00470738
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov dword [esp], str.kingsoft_antivirus_
call fcn.004062d3
push dword [ebp - 0x10]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00495918
push eax
push 0x46c
push dword [esi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x495746
Capabilities:
Get common file path
Get program files directory
Hide graphical window

Disassembly:
mov eax, 0x60d0c5
call fcn.0060c3a8
sub esp, 0x20c
push ebx
push esi
push edi
push ecx
push ecx
mov eax, esp
mov ebx, ecx
sub esp, 0x10
xor esi, esi
mov dword [eax], 0x12d
lea edi, [ebx + 0x588]
mov eax, esp
mov ecx, edi
mov dword [eax], esi
push dword [ebx + 4]
call fcn.004946b4
push str.Arial
push 0x20
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x64
push esi
push esi
push esi
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi]
call esi
push 0
push 0x96
push 0xc5
push dword [edi]
call esi
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
xor esi, esi
lea eax, [ebp - 0x218]
push 0x208
push esi
push eax
mov dword [ebp - 4], esi
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x495818
push str.c:program_files
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005f1efc
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push 0x6a0348
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x5b0]
call fcn.00406123
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x495918
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], ecx
lea ecx, [ebp + 8]
mov edx, dword [edi]
call fcn.00470738
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [edi]
cmp dword [eax - 0xc], 3
jl 0x4959d6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x495960
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x4959d6
push 3
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp + 8]
cmp eax, 3
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x49598f
push 2
pop esi
jmp 0x4959d9
push edi
call fcn.00495864
push 3
test eax, eax
jne 0x49598c
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00491330
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00404ea9
add bl, 1
je 0x4959c7
push 4
jmp 0x49598c
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x4959d9
push 5
jmp 0x49598c
xor esi, esi
inc esi
mov eax, dword [ebp - 4]
push dword [eax + 0x584]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4