joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490133
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x6138c3
call fcn.0060cc48
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.KInstallTool::KUIInfoReport.0
mov dword [ebp + 8], esi
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
and dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov eax, dword [edi + 0x10]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [ebx + 0x14]
mov eax, dword [edi + 0x14]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea esi, [ebx + 0x18]
mov eax, dword [edi + 0x18]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [ebx + 0x1c]
mov eax, dword [edi + 0x1c]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x20]
mov eax, dword [edi + 0x20]
sub eax, 0x10
mov dword [ebp + 8], esi
push eax
call fcn.004067cf
add esp, 0x18
add eax, 0x10
mov dword [esi], eax
mov al, byte [edi + 0x24]
mov byte [ebx + 0x24], al
mov al, byte [edi + 0x25]
mov byte [ebx + 0x25], al
mov al, byte [edi + 0x26]
mov byte [ebx + 0x26], al
mov al, byte [edi + 0x27]
mov byte [ebx + 0x27], al
mov al, byte [edi + 0x28]
mov byte [ebx + 0x28], al
mov eax, dword [edi + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [edi + 0x30]
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x49129c
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x60db0f
call fcn.0060cc48
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x4913af
mov ecx, dword [ecx + 0xc]
cmp ecx, ebx
jne 0x4912c3
mov ecx, esi
call fcn.004927da
mov eax, ebx
jmp 0x4913b8
cmp ecx, 2
jne 0x4912e4
cmp byte [esi + 0x5f2], 0
jne 0x4912d7
mov byte [esi + 0x5f2], bl
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4912bc
cmp ecx, 0x65
jne 0x4912f2
mov ecx, esi
call fcn.004928f8
jmp 0x4912bc
cmp ecx, 0x66
jne 0x49130c
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x584], eax
sete al
push eax
call fcn.0049389f
jmp 0x4912bc
cmp ecx, 0x191
jne 0x49131d
mov ecx, esi
call fcn.004929ec
jmp 0x4912bc
cmp ecx, 0x96
jne 0x491347
push dword [esi + 0x5b0]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
mov ecx, esi
call fcn.0049233c
jmp 0x4912bc
cmp ecx, 0x1f5
jne 0x49135b
mov ecx, esi
call fcn.00492a58
jmp 0x4912bc
cmp ecx, 0xa0
jne 0x49136d
call fcn.00492b46
jmp 0x4912bc
cmp ecx, 0x68
jne 0x49137e
mov ecx, esi
call fcn.00493612
jmp 0x4912bc
cmp ecx, 0x2bf
jne 0x4913af
push str.https:__www.ijinshan.com_privacy_dubaPrivacy.html
lea ecx, [ebp + 8]
call fcn.00406173
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00471cbf
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x4912bc
and dword [esi + 0x5b4], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4919a7
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x613981
call fcn.0060cc48
sub esp, 0x408
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x414]
push esi
push edi
push 0x400
push 0
push eax
mov esi, str.https:__wpa1.qq.com_5ciKQjBf__typewpaqidiantrue
mov edi, str.MarketQQLink
call fcn.005e26d0
mov eax, dword fs:[0x2c]
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [0x6caeec]
cmp eax, dword [ecx + 4]
jle 0x491a2a
push 0x6caeec
call fcn.0049a991
cmp dword [0x6caeec], 0xffffffff
pop ecx
jne 0x491a2a
and dword [ebp - 4], 0
call fcn.00491833
push 0x61439b
call fcn.0049ace8
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x6caeec
call fcn.0049a952
pop ecx
mov ecx, dword [0x6caef4]
test ecx, ecx
je 0x491a48
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
test al, al
je 0x491a48
mov esi, str.https:__wpa1.qq.com_FDdK6y0s__typewpaqidiantrue
mov edi, str.VipMarketQQLink
xor edx, edx
lea ecx, [ebp - 0x10]
call fcn.0040b184
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0040ab52
push str.dataoperation_contact.dat
lea ecx, [ebp - 0x10]
call fcn.004062d3
push dword [ebp - 0x10]
lea eax, [ebp - 0x414]
push 0x200
push eax
push esi
push edi
push str.FeedBack
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.00406173
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x49299f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
sub eax, 1
je 0x4929e2
sub eax, 1
je 0x4929db
sub eax, 1
je 0x4929c3
sub eax, 1
jne 0x4929e7
call fcn.00494a51
jmp 0x4929e7
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4929e7
call fcn.00493452
jmp 0x4929e7
call fcn.00492e66
pop esi
pop ebp
ret 4

Function at 0x492b46
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x60d965
call fcn.0060cc48
push ecx
push ebx
push edi
push 1
xor edi, edi
mov ebx, str.https:__www.ijinshan.com_privacy_duba_enduserlicenseandsevice_agreement.html
push edi
push edi
push ebx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x492bb0
push 1
push edi
push ebx
push str.IEXPLORE.EXE
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x492bb0
lea ecx, [ebp - 0x10]
call fcn.00470c1a
sub esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call fcn.004700ec
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492bc0
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, 0x613ab8
call fcn.0060cc48
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 4], 0
push 0x66
push dword [0x6c65c8]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
mov dword [ebx + 0x648], 7
mov eax, dword [ebx + 4]
lea edi, [ebx + 0x63c]
push 0x6a1034
lea edx, [ebx + 0x61c]
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov dword [ebx + 0x650], esi
mov dword [edi], 0x3bc
mov dword [ebx + 0x64c], 0x468
mov dword [ebx + 0x640], eax
mov dword [ebx + 0x95c], 3
mov dword [ebx + 0x644], 2
call fcn.0040aec1
push dword [eax]
lea eax, [ebx + 0x654]
push 0x80
push eax
call fcn.005f27ac
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
test esi, esi
je 0x492c7c
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493546
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
mov edx, dword [esi]
call fcn.00470634
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [esi]
push 3
pop edi
cmp dword [eax - 0xc], edi
jl 0x493608
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49358a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x493608
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
cmp eax, edi
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x4935b7
push 2
pop eax
jmp 0x49360b
mov ecx, esi
call fcn.004934d1
test eax, eax
je 0x4935c6
mov eax, edi
jmp 0x49360b
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.004917dd
mov ecx, dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
add bl, 1
je 0x4935f3
push 4
jmp 0x4935b4
mov eax, dword [esi]
xor ecx, ecx
push 5
pop edx
cmp dword [eax - 0xc], 0x96
cmovg ecx, edx
mov eax, ecx
jmp 0x49360b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493612
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x613b27
call fcn.0060cc48
sub esp, 0x448
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x454]
push esi
push eax
mov ebx, ecx
call fcn.005e26d0
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push 0x11
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push 0x105
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040682a
push esi
lea ecx, [ebp - 0x14]
call fcn.00406601
push 0x6a1340
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
cmp dword [edi - 4], 1
jle 0x4936b9
push dword [edi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406af0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], edi
push eax
mov dword [ebp - 0x34], 0x6a1388
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x493791
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.005e26d0
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
lea edx, [ebp - 0x24c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00470634
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00406668
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push str.kingsoft_antivirus_
lea ecx, [ebp - 0x18]
call fcn.004062d3
mov esi, dword [ebp - 0x18]
push esi
push dword [ebx + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x18]
call fcn.00493546
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [ebx + 0x5b8], 2
lea ecx, [esi - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [edi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493954
Capabilities:
Get common file path
Get program files directory

Disassembly:
push esi
push edi
lea edi, [ecx + 0x5b0]
push 0x104
mov ecx, edi
call fcn.0040682a
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, edi
mov esi, eax
call fcn.00408f1c
test esi, esi
jne 0x493990
push str.c:program_files
mov ecx, edi
call fcn.004060f8
push str.kingsoftkingsoft_antivirus_
mov ecx, edi
call fcn.004062d3
pop edi
pop esi
ret
Function at 0x493fc8
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x60dbaa
call fcn.0060cc48
push ecx
push ecx
push ebx
push esi
push edi
push 0x208
push 0x199
mov esi, ecx
call fcn.00493e3d
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x5d4], eax
sete al
push eax
call fcn.00494529
mov ecx, esi
call fcn.0049412f
push str.soguo_mainbg_new
push str.skin
lea edi, [esi + 0x28]
push 3
mov ecx, edi
call fcn.0044b4b1
push str.0_0__0__0
mov ebx, 0x69c628
mov ecx, edi
push ebx
push 3
call fcn.0044b4b1
cmp dword [esi + 0x5d4], 0
jne 0x49411e
push str.15__153__15__63
push ebx
push 0xc8
mov ecx, edi
call fcn.0044b4b1
push str.softtemprory.png
lea edx, [esi + 0x620]
lea ecx, [ebp - 0x10]
call fcn.0040aec1
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, edi
test eax, eax
je 0x49408e
push dword [ebp - 0x10]
mov esi, 0x25c
push str.filepath
push esi
call fcn.00448741
push str._36_103_36_175
mov ecx, edi
jmp 0x494098
push str._30_103_30_163
mov esi, 0x25d
push ebx
push esi
call fcn.0044b4b1
push 1
push esi
mov ecx, edi
call fcn.004486fc
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
call fcn.00438543
add eax, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.00406123
mov esi, dword [ebp - 0x14]
mov ebx, 0x25e
push esi
push ebx
mov ecx, edi
call fcn.004487b9
push str.30_190__30_234
push 0x69c628
push ebx
mov ecx, edi
call fcn.0044b4b1
push str.sogou_aladdin_titlt
push str.class
push ebx
mov ecx, edi
call fcn.00448741
push 1
push ebx
mov ecx, edi
call fcn.004486fc
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49429e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x613b6e
call fcn.0060cc48
sub esp, 0x90
push ebx
push esi
push edi
push 0x1b8
push 0x258
mov edi, ecx
call fcn.00493e3d
push 1
mov ecx, edi
call fcn.00494529
push str.scene5_logo
push str.skin
lea esi, [edi + 0x28]
mov ebx, 0x25a
push ebx
mov ecx, esi
call fcn.0044b4b1
push str.16_0
push 0x69c628
push ebx
mov ecx, esi
call fcn.0044b4b1
push 1
push ebx
mov ecx, esi
call fcn.004486fc
push str.scene5_bg
push str.skin
push 3
mov ecx, esi
call fcn.0044b4b1
push str.0_0__0__0
mov ebx, 0x69c628
mov ecx, esi
push ebx
push 3
call fcn.0044b4b1
push str.0__105__0__15
push ebx
push 0xc8
mov ecx, esi
call fcn.0044b4b1
push 1
push 0x262
mov ecx, esi
call fcn.004486fc
push str.softtemprory.png
lea edx, [edi + 0x624]
lea ecx, [ebp - 0x14]
call fcn.0040aec1
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
je 0x494391
push dword [ebp - 0x14]
mov ebx, 0x264
push str.filepath
push ebx
call fcn.00448741
push 1
push ebx
mov ecx, esi
call fcn.004486fc
xor ebx, ebx
jmp 0x49439d
push 1
push 0x265
call fcn.004486fc
push 1
push 0x263
mov ecx, esi
call fcn.004486fc
push 0x64
lea eax, [ebp - 0x10]
push eax
call fcn.004948ca
mov byte [ebp - 4], 1
mov ecx, esi
push dword [eax]
push 0x266
call fcn.004487b9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.004948ca
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push 0xfde9
push dword [eax]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x9c]
call fcn.00408f48
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
push dword [ebp - 0x9c]
call fcn.00413e4d
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x9c], eax
je 0x494433
push dword [ebp - 0x9c]
call fcn.005f0fb3
pop ecx
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00494f7d
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404ea9
push ecx
push ecx
mov ecx, edi
call fcn.0049494a
xor eax, eax
mov ecx, esi
cmp dword [edi + 0x5d4], ebx
sete al
push eax
push 0x267
call fcn.004486fc
cmp dword [edi + 0x5d4], ebx
jne 0x494490
push ebx
push 0x53
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4944a6
push str.0_268__0_300
push 0x69c628
push 0x1fb
mov ecx, esi
call fcn.0044b4b1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x494b59
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x494b90
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x494b83
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
Function at 0x494d7e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x494df6
cmp dword [ebp + 0xc], esi
je 0x494df6
cmp dword [edi + 0x10], esi
je 0x494db5
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x494db0
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x494df6
mov ebx, dword [edi]
push 0x18
call fcn.00431ddf
pop ecx
mov ecx, eax
test ecx, ecx
je 0x494dea
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48e6f4
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f4880
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x494df8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x495348
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x495494
mov ebx, dword [ebp + 0xc]
xor esi, esi
inc esi
cmp ebx, 0x4e
jne 0x495399
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x49549d
push ecx
mov ecx, edi
mov dword [edi + 0x580], esi
call fcn.004952a2
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], 0
je 0x495470
mov eax, esi
jmp 0x495496
cmp ebx, 0x113
jne 0x4953e8
mov eax, 0x2711
mov dword [edi + 0x580], esi
cmp dword [ebp + 0x10], eax
jne 0x4953e0
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [edi + 0x58c]
push 0x3ed
push 0x476
push dword [edi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp + 0x18]
and dword [ecx], 0
jmp 0x495385
cmp ebx, 0x110
jne 0x49540a
push 0
push 0
push 0x473
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4953e0
cmp ebx, 0x473
jne 0x49542d
call fcn.004956bd
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x495496
cmp ebx, 0x477
jne 0x49544a
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00495520
jmp 0x495380
cmp ebx, 0x478
jne 0x49549d
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.00495582
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x580], 0
jne 0x495428
mov ecx, esi
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0044b52f
mov dword [edi + 0x578], esi
test eax, eax
jne 0x495428
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
jmp 0x495470
Function at 0x495782
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x4957eb
cmp dword [ebp + 0x1c], 0x12d
jne 0x495955
cmp dword [ebp + 0xc], 0x100
jne 0x495955
xor ebx, ebx
push 0x11
mov dword [edi + 0x580], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp + 0x10], 0x61
movzx eax, ax
je 0x4957c9
cmp dword [ebp + 0x10], 0x41
jne 0x4957db
test al, al
jns 0x4957db
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00494d55
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x580], ebx
jmp 0x495953
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
xor ebx, ebx
cmp eax, 0x4e
jne 0x495842
mov edx, dword [ebp + 0x14]
cmp dword [edx + 4], 0xffffffff
jne 0x49592e
mov dword [edi + 0x580], esi
cmp dword [edx + 8], esi
jne 0x495822
cmp dword [edx + 0xc], 0x12e
jne 0x495822
call fcn.00495aeb
mov eax, esi
jmp 0x49582a
mov dword [edi + 0x580], ebx
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], ebx
je 0x49592e
mov eax, esi
jmp 0x495957
cmp eax, 0x110
jne 0x495865
mov dword [edi + 0x580], esi
call fcn.00495c5a
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
jmp 0x49582f
cmp eax, 0x465
jne 0x49587e
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00495a3b
jmp 0x49582a
cmp eax, 0x466
jne 0x495895
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.00495a91
jmp 0x49582a
mov edx, 0x46c
cmp eax, edx
jne 0x4958b1
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.00495f07
jmp 0x49582a
cmp eax, 0x46f
jne 0x4958d2
push dword [edi + 0x5b0]
mov dword [edi + 0x580], esi
push dword [edi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x49585e
cmp eax, 0x10
jne 0x4958f3
push ebx
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49585e
cmp eax, 0x111
jne 0x49592e
mov eax, dword [ebp + 0x10]
mov ecx, 0x300
shr eax, 0x10
mov dword [edi + 0x580], ebx
cmp cx, ax
jne 0x49591c
push ebx
push ebx
push edx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
cmp dword [edi + 0x580], ebx
je 0x49592e
xor eax, eax
inc eax
jmp 0x495957
mov esi, dword [edi + 0x578]
mov ecx, edi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044b52f
mov dword [edi + 0x578], esi
test eax, eax
jne 0x495929
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x495aeb
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x60e3d5
call fcn.0060cc48
sub esp, 0x43c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x18], ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov edi, 0x208
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.005e26d0
push edi
lea eax, [ebp - 0x448]
push ebx
push eax
call fcn.005e26d0
add esp, 0x18
lea eax, [ebp - 0x448]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x6a1340
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
push 0x105
mov dword [ebp - 0x34], eax
call fcn.0040682a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], 0x6a1388
mov dword [ebp - 0x28], 0x8041
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00408f1c
test edi, edi
je 0x495c31
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x240]
push eax
call fcn.005f0fb8
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x10]
call fcn.00470634
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov dword [esp], str.kingsoft_antivirus_
call fcn.004062d3
push dword [ebp - 0x10]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00495e2c
push eax
push 0x46c
push dword [esi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret