joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e70f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x48e806
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x48e806
lea eax, [ebp - 0x4b8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x48e7fe
xor eax, eax
mov dword [ebp + 8], eax
cmp word [ebp - 0x4b8], ax
je 0x48e7fe
lea ebx, [ebp - 0x4b8]
mov dword [ebp + 0xc], eax
push 0x69f664
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48e7dd
push 0x69f66c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x48e7dd
mov ax, word [ebx]
mov word [ebp - 8], ax
mov eax, dword [ebp + 0xc]
push 0x64
mov ax, word [ebp + eax - 0x4b6]
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x48e806
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd0]
push ebx
push eax
push edi
call fcn.005f1b2d
add esp, 0xc
test eax, eax
je 0x48e811
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x4b8]
add eax, 4
mov dword [ebp + 8], eax
add eax, eax
add ebx, eax
mov dword [ebp + 0xc], eax
xor eax, eax
cmp word [ebx], ax
jne 0x48e766
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + ebx*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
inc eax
jmp 0x48e808

Function at 0x48e82c
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, edx
call fcn.0048e8f8
test al, al
jne 0x48e84c
or eax, 0xffffffff
jmp 0x48e8f1
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
call fcn.0048e9c5
test al, al
je 0x48e844
mov esi, str.Data_Buffer
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
jne 0x48e87b
xor eax, eax
jmp 0x48e8f1
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x48e894
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
jmp 0x48e877
push 0x28
call fcn.005f09b2
mov ebx, eax
pop ecx
test ebx, ebx
je 0x48e88b
mov dword [ebp - 4], 2
push 0x3e8
push 0x28
push ebx
push 0
push 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x48e8ce
cmp dword [ebx + 4], 0
jne 0x48e8ce
inc edi
sub dword [ebp - 4], 1
jne 0x48e8a9
push ebx
call fcn.005f0063
pop ecx
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
call fcn.0048e977
test al, al
push 0xffffffffffffffff
pop eax
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e8f8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x48e959
push 0x6c4330
call fcn.0048ea32
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_WSAStartup_operation:
mov ecx, esi
call fcn.00412451
mov edx, str.WSAGetLastError____
mov ecx, eax
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048ea32
xor al, al
jmp 0x48e971
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x16]
push eax
call fcn.005f1d07
mov al, 1
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48e9c5
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push ecx
mov esi, edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x48ea0e
push 0x6c4330
call fcn.0048ea32
pop ecx
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push ecx
mov edx, str.An_error_occured_in_gethostbyname_operation:_WSAGetLastError____
mov ecx, esi
call fcn.00412451
pop ecx
mov ecx, eax
call fcn.00410d92
push eax
call fcn.0048ea32
pop ecx
xor al, al
jmp 0x48ea2d
mov eax, dword [eax + 0xc]
push ecx
lea ecx, [esp + 8]
push dword [eax]
call fcn.0048eb1c
pop ecx
pop ecx
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48ebf4
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6127e3
call fcn.0060bcd8
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], edi
mov ebx, 0x693da4
push ebx
lea ecx, [edi + 0xc]
mov dword [edi], vtable.KInstallTool::KUIInfoReport.0
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00406173
push ebx
lea ecx, [edi + 0x10]
mov dword [ebp - 4], esi
call fcn.00406173
mov byte [ebp - 4], 1
call fcn.00404f47
push eax
lea ecx, [edi + 0x14]
call fcn.004065d8
push ebx
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
call fcn.00406173
push ebx
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00406173
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 4
call fcn.00406173
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov eax, edi
mov byte [edi + 0x28], 7
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48efe2
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
push edi
mov edi, ecx
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 8], eax
call esi
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 4], eax
call esi
cmp byte [edi + 4], bl
jne 0x48f010
push 0xfffffffffffffffd
pop ebx
jmp 0x48f026
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [edi + 4], bl
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f4e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x2c]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.0048f4c5
test al, al
je 0x48f50b
or esi, 0xffffffff
jmp 0x48f576
push ebx
push 8
call fcn.00430c2b
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x48f51e
push 0xfffffffffffffffa
jmp 0x48f574
lea eax, [edi + 0xc]
mov dword [ebx], edi
push eax
push esi
push ebx
push 0x48f7f2
push esi
push esi
mov dword [ebx + 4], esi
call fcn.005f3950
add esp, 0x18
mov dword [edi + 8], eax
test eax, eax
je 0x48f568
lea ebx, [edi + 0x14]
jmp 0x48f552
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 4], 0
push ebx
je 0x48f544
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x48f575
push 8
push ebx
call fcn.004998dc
pop ecx
pop ecx
push 0xfffffffffffffffe
pop esi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48f589
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6127e3
call fcn.0060bcd8
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.KInstallTool::KUIInfoReport.0
mov dword [ebp + 8], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov eax, dword [edi + 0x10]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x14]
mov eax, dword [edi + 0x14]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x1c]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x20]
mov eax, dword [edi + 0x20]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add esp, 0x18
add eax, 0x10
mov dword [esi], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
mov al, byte [edi + 0x25]
mov byte [ebx + 0x25], al
mov al, byte [edi + 0x26]
mov byte [ebx + 0x26], al
mov al, byte [edi + 0x27]
mov byte [ebx + 0x27], al
mov al, byte [edi + 0x28]
mov byte [ebx + 0x28], al
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4906f2
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60cb9f
call fcn.0060bcd8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x490805
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x490719
mov ecx, esi
call fcn.00491c25
mov eax, ebx
jmp 0x49080e
cmp ecx, 2
jne 0x49073a
cmp byte [esi + 0x5f2], 0
jne 0x49072d
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x490712
cmp ecx, 0x65
jne 0x490748
mov ecx, esi
call fcn.00491d43
jmp 0x490712
cmp ecx, 0x66
jne 0x490762
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.00492c8b
jmp 0x490712
cmp ecx, 0x191
jne 0x490773
mov ecx, esi
call fcn.00491e37
jmp 0x490712
cmp ecx, 0x96
jne 0x49079d
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.0049178f
jmp 0x490712
cmp ecx, 0x1f5
jne 0x4907b1
mov ecx, esi
call fcn.00491ea3
jmp 0x490712
cmp ecx, 0xa0
jne 0x4907c3
call fcn.00491f91
jmp 0x490712
cmp ecx, 0x68
jne 0x4907d4
mov ecx, esi
call fcn.004929fe
jmp 0x490712
cmp ecx, 0x2bf
jne 0x490805
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00470be1
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x490712
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x490dfd
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x6128a1
call fcn.0060bcd8
sub esp, 0x408
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x414]
push esi
push edi
push 0x400
push 0
push eax
mov esi, str.https:__wpa1.qq.com_5ciKQjBf__typewpaqidiantrue
mov edi, str.MarketQQLink
call fcn.005e1720
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [0x6c8e44]
cmp eax, dword [ecx + 4]
jle 0x490e80
push 0x6c8e44
call fcn.00499a41
cmp dword [0x6c8e44], 0xffffffff
pop ecx
jne 0x490e80
and dword [ebp - 4], 0
call fcn.00490c89
push 0x613234
call fcn.00499d98
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x6c8e44
call fcn.00499a02
pop ecx
mov ecx, dword [0x6c8e4c]
test ecx, ecx
je 0x490e9e
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
test al, al
je 0x490e9e
mov esi, str.https:__wpa1.qq.com_FDdK6y0s__typewpaqidiantrue
mov edi, str.VipMarketQQLink
xor edx, edx
lea ecx, [ebp - 0x10]
call fcn.0040b184
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040ab52
push str.dataoperation_contact.dat
lea ecx, [ebp - 0x10]
call fcn.004062d3
push dword [ebp - 0x10]
lea eax, [ebp - 0x414]
push 0x200
push eax
push esi
push edi
push str.FeedBack
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.00406173
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x491dea
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
sub eax, 1
je 0x491e2d
sub eax, 1
je 0x491e26
sub eax, 1
je 0x491e0e
sub eax, 1
jne 0x491e32
call fcn.00493e3d
jmp 0x491e32
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x491e32
call fcn.0049283e
jmp 0x491e32
call fcn.004922b1
pop esi
pop ebp
ret 4

Function at 0x491f91
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x60c9f5
call fcn.0060bcd8
push ecx
push ebx
push edi
push 1
xor edi, edi
mov ebx, str.https:__www.ijinshan.com_privacy_duba_enduserlicenseandsevice_agreement.html
push edi
push edi
push ebx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x491ffb
push 1
push edi
push ebx
push str.IEXPLORE.EXE
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x491ffb
lea ecx, [ebp - 0x10]
call fcn.0046fb48
sub esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call fcn.0046f01a
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49200b
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, 0x6129d8
call fcn.0060bcd8
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 4], 0
push 0x66
push dword [0x6c4548]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
mov dword [ebx + 0x648], 7
mov eax, dword [ebx + 4]
lea edi, [ebx + 0x63c]
push 0x69f9b0
lea edx, [ebx + 0x61c]
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov dword [ebx + 0x650], esi
mov dword [edi], 0x3bc
mov dword [ebx + 0x64c], 0x468
mov dword [ebx + 0x640], eax
mov dword [ebx + 0x95c], 3
mov dword [ebx + 0x644], 2
call fcn.0040aec1
push dword [eax]
lea eax, [ebx + 0x654]
push 0x80
push eax
call fcn.005f187c
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
test esi, esi
je 0x4920c7
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x492932
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
mov edx, dword [esi]
call fcn.0046f562
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [esi]
push 3
pop edi
cmp dword [eax - 0xc], edi
jl 0x4929f4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x492976
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x4929f4
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
cmp eax, edi
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x4929a3
push 2
pop eax
jmp 0x4929f7
mov ecx, esi
call fcn.004928bd
test eax, eax
je 0x4929b2
mov eax, edi
jmp 0x4929f7
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00490c33
mov ecx, dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
add bl, 1
je 0x4929df
push 4
jmp 0x4929a0
mov eax, dword [esi]
xor ecx, ecx
push 5
pop edx
cmp dword [eax - 0xc], 0x96
cmovg ecx, edx
mov eax, ecx
jmp 0x4929f7
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4929fe
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x612a3f
call fcn.0060bcd8
sub esp, 0x448
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x454]
push esi
push eax
mov ebx, ecx
call fcn.005e1720
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push 0x11
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push 0x105
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040682a
push esi
lea ecx, [ebp - 0x14]
call fcn.00406601
push 0x69fcd4
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
cmp dword [edi - 4], 1
jle 0x492aa5
push dword [edi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406af0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], edi
push eax
mov dword [ebp - 0x34], 0x69fcc4
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x492b7d
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.005e1720
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
lea edx, [ebp - 0x24c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0046f562
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00406668
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push str.kingsoft_antivirus_
lea ecx, [ebp - 0x18]
call fcn.004062d3
mov esi, dword [ebp - 0x18]
push esi
push dword [ebx + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x18]
call fcn.00492932
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [ebx + 0x5b8], 2
lea ecx, [esi - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [edi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x492d40
Capabilities:
Get common file path
Get program files directory

Disassembly:
push esi
push edi
lea edi, [ecx + 0x5b0]
push 0x104
mov ecx, edi
call fcn.0040682a
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, edi
mov esi, eax
call fcn.00408f1c
test esi, esi
jne 0x492d7c
push str.c:program_files
mov ecx, edi
call fcn.004060f8
push str.kingsoftkingsoft_antivirus_
mov ecx, edi
call fcn.004062d3
pop edi
pop esi
ret
Function at 0x4933b4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x60cc3a
call fcn.0060bcd8
push ecx
push ecx
push ebx
push esi
push edi
push 0x208
push 0x199
mov esi, ecx
call fcn.00493229
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x5d4], eax
sete al
push eax
call fcn.00493915
mov ecx, esi
call fcn.0049351b
push str.soguo_mainbg_new
push str.skin
lea edi, [esi + 0x28]
push 3
mov ecx, edi
call fcn.0044a310
push str.0_0__0__0
mov ebx, 0x69ae18
mov ecx, edi
push ebx
push 3
call fcn.0044a310
cmp dword [esi + 0x5d4], 0
jne 0x49350a
push str.15__153__15__63
push ebx
push 0xc8
mov ecx, edi
call fcn.0044a310
push str.softtemprory.png
lea edx, [esi + 0x620]
lea ecx, [ebp - 0x10]
call fcn.0040aec1
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, edi
test eax, eax
je 0x49347a
push dword [ebp - 0x10]
mov esi, 0x25c
push str.filepath
push esi
call fcn.004475a0
push str._36_103_36_175
mov ecx, edi
jmp 0x493484
push str._30_103_30_163
mov esi, 0x25d
push ebx
push esi
call fcn.0044a310
push 1
push esi
mov ecx, edi
call fcn.0044755b
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
call fcn.00437393
add eax, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.00406123
mov esi, dword [ebp - 0x14]
mov ebx, 0x25e
push esi
push ebx
mov ecx, edi
call fcn.00447618
push str.30_190__30_234
push 0x69ae18
push ebx
mov ecx, edi
call fcn.0044a310
push str.sogou_aladdin_titlt
push str.class
push ebx
mov ecx, edi
call fcn.004475a0
push 1
push ebx
mov ecx, edi
call fcn.0044755b
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49368a
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x612a86
call fcn.0060bcd8
sub esp, 0x90
push ebx
push esi
push edi
push 0x1b8
push 0x258
mov edi, ecx
call fcn.00493229
push 1
mov ecx, edi
call fcn.00493915
push str.scene5_logo
push str.skin
lea esi, [edi + 0x28]
mov ebx, 0x25a
push ebx
mov ecx, esi
call fcn.0044a310
push str.16_0
push 0x69ae18
push ebx
mov ecx, esi
call fcn.0044a310
push 1
push ebx
mov ecx, esi
call fcn.0044755b
push str.scene5_bg
push str.skin
push 3
mov ecx, esi
call fcn.0044a310
push str.0_0__0__0
mov ebx, 0x69ae18
mov ecx, esi
push ebx
push 3
call fcn.0044a310
push str.0__105__0__15
push ebx
push 0xc8
mov ecx, esi
call fcn.0044a310
push 1
push 0x262
mov ecx, esi
call fcn.0044755b
push str.softtemprory.png
lea edx, [edi + 0x624]
lea ecx, [ebp - 0x14]
call fcn.0040aec1
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
je 0x49377d
push dword [ebp - 0x14]
mov ebx, 0x264
push str.filepath
push ebx
call fcn.004475a0
push 1
push ebx
mov ecx, esi
call fcn.0044755b
xor ebx, ebx
jmp 0x493789
push 1
push 0x265
call fcn.0044755b
push 1
push 0x263
mov ecx, esi
call fcn.0044755b
push 0x64
lea eax, [ebp - 0x10]
push eax
call fcn.00493cb6
mov byte [ebp - 4], 1
mov ecx, esi
push dword [eax]
push 0x266
call fcn.00447618
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.00493cb6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push 0xfde9
push dword [eax]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x9c]
call fcn.00408f48
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
push dword [ebp - 0x9c]
call fcn.00413e4d
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x9c], eax
je 0x49381f
push dword [ebp - 0x9c]
call fcn.005f0063
pop ecx
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00494369
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404ea9
push ecx
push ecx
mov ecx, edi
call fcn.00493d36
xor eax, eax
mov ecx, esi
cmp dword [edi + 0x5d4], ebx
sete al
push eax
push 0x267
call fcn.0044755b
cmp dword [edi + 0x5d4], ebx
jne 0x49387c
push ebx
push 0x53
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x493892
push str.0_268__0_300
push 0x69ae18
push 0x1fb
mov ecx, esi
call fcn.0044a310
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493f45
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x493f7c
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x493f6f
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
xor eax, eax
inc eax
pop esi
pop ebp
ret 4