joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db5b6
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [esp + 0xc], edi
jne 0x4db5eb
mov eax, dword [0x5e58bc]
cmp eax, edi
je 0x4db5d9
mov ebx, dword [eax + 4]
jmp 0x4db5db
xor ebx, ebx
cmp ebx, edi
jne 0x4db5eb
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebx, eax
cmp ebx, edi
je 0x4db610
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x4db610
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4db610
push edi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0xc], 1
push dword [esp + 0x1c]
mov ecx, esi
push edi
push ebx
mov dword [esi + 0x370], edi
call fcn.004d9d55
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x4db63b
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x4db747
push eax
call fcn.004a337e
cmp dword [esp + 0x20], edi
pop ecx
mov dword [esp + 0x10], eax
jne 0x4db654
push ebx
mov ecx, esi
call fcn.004b2bb7
cmp dword [esi + 0x360], edi
je 0x4db6e9
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push edi
push edi
push 0x2001
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push edi
push edi
push edi
push edi
push edi
push dword [esp + 0x34]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebp, dword [esp + 0x20]
je 0x4db6ad
push 1
push ebp
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x20]
je 0x4db6c9
push edi
push ebp
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
pop ebp
je 0x4db6e9
push edi
push edi
push 0xf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
push 0x97
push edi
push edi
push edi
push edi
push edi
push dword [esi + 4]
mov dword [esi + 0x370], edi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0xc], edi
je 0x4db72e
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebx, edi
je 0x4db72e
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4db72e
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
push dword [esp + 0x10]
call fcn.004a337e
pop ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x374]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 8
Function at 0x4db74f
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [esp + 0xc], edi
jne 0x4db784
mov eax, dword [0x5e58bc]
cmp eax, edi
je 0x4db772
mov ebx, dword [eax + 4]
jmp 0x4db774
xor ebx, ebx
cmp ebx, edi
jne 0x4db784
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebx, eax
cmp ebx, edi
je 0x4db7a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x4db7a9
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4db7a9
push edi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0xc], 1
push dword [esp + 0x1c]
mov ecx, esi
push edi
push ebx
mov dword [esi + 0x370], edi
call fcn.004d9eea
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x4db7d4
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x4db8e0
push eax
call fcn.004a337e
cmp dword [esp + 0x20], edi
pop ecx
mov dword [esp + 0x10], eax
jne 0x4db7ed
push ebx
mov ecx, esi
call fcn.004b2d1b
cmp dword [esi + 0x360], edi
je 0x4db882
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push edi
push edi
push 0x2001
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push edi
push edi
push edi
push edi
push edi
push dword [esp + 0x34]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp ebp, dword [esp + 0x20]
je 0x4db846
push 1
push ebp
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x20]
je 0x4db862
push edi
push ebp
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
pop ebp
je 0x4db882
push edi
push edi
push 0xf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
push 0x97
push edi
push edi
push edi
push edi
push edi
push dword [esi + 4]
mov dword [esi + 0x370], edi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0xc], edi
je 0x4db8c7
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebx, edi
je 0x4db8c7
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 4]
jne 0x4db8c7
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
push dword [esp + 0x10]
call fcn.004a337e
pop ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x374]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 8
Function at 0x4ddc07
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
call fcn.0041d58d
mov ecx, eax
call fcn.0041cb8e
test eax, eax
je 0x4ddcdc
push esi
call fcn.0041d58d
mov ecx, eax
call fcn.0041d320
fstp dword [ebp - 4]
push 0x3ef
call fcn.004763cd
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0052e609
push 0x439
call fcn.004763cd
push eax
lea eax, [ebp - 8]
push eax
call fcn.0052e609
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x18
push dword [ebp - 8]
call esi
test eax, eax
jne 0x4ddcc5
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x4ddcc5
fld dword [0x58bc90]
fcomp dword [ebp - 4]
fnstsw ax
test ah, 0x44
jnp 0x4ddc97
fld dword [ebp - 4]
fcomp qword [0x5a37c0]
fnstsw ax
test ah, 1
jne 0x4ddcc5
call fcn.0041d58d
mov ecx, eax
call fcn.0041cbcc
cmp eax, 3
jge 0x4ddcc5
mov ecx, edi
mov dword [edi + 0x1754], 1
call fcn.004dc515
call fcn.0041d58d
mov ecx, eax
call fcn.0041cbf2
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401405
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.00401405
pop esi
pop edi
leave
ret

Function at 0x4de319
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 2
push esi
mov esi, ecx
jne 0x4de384
lea eax, [ebp + 0xc]
push str.feedbackwin.exe
push eax
call fcn.004112e5
pop ecx
push eax
lea eax, [ebp - 4]
push eax
call fcn.00407c58
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401405
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4de374
xor eax, eax
push eax
push eax
push str._vfrom:kprivacycleaner
push esi
push 0x58b168
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4de37f
push str.http:__www.ijinshan.com_help_index.shtml_fmenu
call fcn.0041b453
pop ecx
lea ecx, [esi - 0x10]
jmp 0x4de3b1
lea ecx, [ebp - 8]
call fcn.004b99f0
push str.maintab
lea ecx, [ebp - 8]
call fcn.004020d9
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.004dd2f0
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401405
xor eax, eax
pop esi
leave
ret 0xc

Function at 0x4e1a32
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov esi, ecx
push 0xb
push dword [esi + 4]
call edi
push 0xa
push dword [esi + 4]
call edi
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret
Function at 0x4e2d68
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push edi
mov edi, ecx
je 0x4e2e4b
push esi
push 1
push ebx
push ebx
call fcn.00410b2f
pop ecx
pop ecx
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
call fcn.004e2c0d
add esp, 0x14
lea esi, [edi + 4]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4e2db6
push ebx
push ebx
push dword [ebp + 8]
mov ecx, edi
call fcn.004a47d7
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ebx, 0x22
mov eax, ebx
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sar edx, 1
sub eax, edx
mov dword [ebp - 0x10], eax
add eax, ebx
mov dword [ebp - 0xc], ecx
add ecx, 0x1b
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ecx
push eax
mov ecx, esi
call fcn.004734e0
fldz
mov ebx, dword [sym.imp.USER32.dll_SetTimer]
push 0
fstp dword [edi + 0x3dc]
fld dword [0x5a3328]
push 0x14
push 0xb
fstp dword [edi + 0x3e0]
push dword [esi]
call ebx
mov ecx, edi
call fcn.004e1a75
push 0
push 0
push 0xf
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0x10]
lea ecx, [edi + 0x24]
push 0x64
call fcn.0049d615
push 0
push 0x7d0
push 0xa
push dword [esi]
call ebx
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x4e2fe6
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x4e3001
push 0
push ecx
jmp 0x4e300f
cmp eax, 2
jne 0x4e3025
push 0
mov dword [esi + 0x408], ecx
push eax
push 0x432
push dword [esi + 0x400]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4e3172
cmp eax, 3
jne 0x4e3155
call fcn.004267e6
cmp eax, 6
je 0x4e30e2
cmp eax, 7
je 0x4e30e2
lea eax, [ebp - 4]
push 0
push eax
call fcn.004114ce
push 0xa
call fcn.004763cd
add esp, 0xc
push eax
lea ecx, [ebp + 8]
call fcn.0040460b
lea ecx, [ebp - 0x24]
call fcn.004e1e92
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.00403cc2
push str._src:18
lea ecx, [ebp - 0x1c]
call fcn.004020d9
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], 2
call fcn.00403cc2
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403cc2
push 0x587f88
lea ecx, [ebp - 0x10]
call fcn.004020d9
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00403cc2
lea eax, [ebp - 0x24]
push eax
call fcn.0056ca24
pop ecx
lea ecx, [ebp - 0x24]
call fcn.004e1ed3
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401405
mov ecx, dword [ebp - 4]
jmp 0x4e3138
push 0x3ef
call fcn.004763cd
push eax
lea eax, [ebp + 8]
push eax
call fcn.0052e8c3
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e3135
push eax
lea eax, [ebp - 4]
push eax
call fcn.004114ce
push 0
push dword [ebp + 8]
push 0x587f88
push str._src:18
push dword [ebp - 4]
call fcn.0052ea2e
mov ecx, dword [ebp - 4]
add esp, 0x1c
add ecx, 0xfffffff0
call fcn.00401405
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401405
push 0x3ee
call fcn.004763cd
pop ecx
push eax
mov ecx, esi
call fcn.004e2ef6
jmp 0x4e3172
cmp eax, 4
jne 0x4e3172
push ecx
push 0
push 0
push str.http:__www.ijinshan.com_protocol_onlinePrivacy.shtml
push 0x58b168
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
leave
ret 4

Function at 0x4e31a7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 8]
lea ecx, [esi + 0x28]
push 0x3e8
call fcn.004e1d95
push eax
mov ecx, esi
call fcn.004e1b8a
test eax, eax
je 0x4e31da
push eax
mov ecx, esi
call fcn.004e2fe6
pop esi
ret 4
Function at 0x4e7d1f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 1
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x4e7d6d
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x110]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x4e7d6d
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1f8]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
cmp dword [esi + 0x2fc], 0
je 0x4e7de7
push ebx
lea ebx, [esi + 0x30c]
cmp dword [ebx], 0
je 0x4e7d8b
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx], 0
cmp dword [esi + 0x2fc], edi
pop ebx
jne 0x4e7de0
push edi
call fcn.004753f6
mov edi, eax
movzx eax, word [ebp + 0x10]
pop ecx
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x205
call fcn.00473c99
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 0x14], eax
mov ecx, dword [edi + 0x10]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x2fc], 0
pop edi
pop esi
leave
ret 0xc
Function at 0x4e8a40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x30c]
cmp dword [edi], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x4e8a71
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov edi, dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4e8ab5
push 1
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x110]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4e8ab5
push 1
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x1f8]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2f8]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x4e8be3
push eax
call fcn.004753f6
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4e8b62
mov eax, dword [ebx + 0x10]
push 2
push 0
push ebx
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.004e81cc
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.00473c99
mov eax, dword [ebp - 4]
cmp dword [esi + 0x2f8], eax
jne 0x4e8b3f
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x4e8b31
cmp word [ecx], ax
je 0x4e8b31
push 1
push eax
push eax
push ecx
push 0x58b168
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4e8b62
cmp dword [ebx + 0x10], eax
je 0x4e8b62
mov dword [ebp - 0xc], 1
jmp 0x4e8b62
push 1
push 0
push ebx
mov ecx, esi
call fcn.004e81cc
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.00473c99
mov dword [ebp - 0x10], 1
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [esi + 0x2f8], eax
je 0x4e8ba4
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 0x20], 1
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4e8be3
cmp dword [ebp - 0x10], eax
je 0x4e8be3
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x4e8be3
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
add esi, 0x2f4
cmp eax, dword [esi]
jne 0x4e8be3
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4ed7a5
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x388]
sub esp, 0x408
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp + 0x384], eax
and word [ebp - 0x7c], 0
push ebx
push esi
mov esi, dword [ebp + 0x390]
push edi
push 0x3fe
lea eax, [ebp - 0x7a]
push 0
push eax
mov edi, str.https:__t.zhhainiao.com_s_qqfb
mov ebx, str.MarketQQLink
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.004a5fa8
mov ecx, eax
call fcn.004ec134
test al, al
je 0x4ed805
mov edi, str.https:__t.zhhainiao.com_s_qqfbvip
mov ebx, str.VipMarketQQLink
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00411735
lea eax, [ebp - 0x80]
push eax
call fcn.004111d5
add esp, 0xc
push str.dataoperation_contact.dat
lea ecx, [ebp - 0x80]
call fcn.00403b27
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push 0x200
push eax
push edi
push ebx
push str.FeedBack
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x7c]
push eax
mov ecx, esi
call fcn.0040460b
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff0
call fcn.00401405
mov ecx, dword [ebp + 0x384]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056f17c
add ebp, 0x388
leave
ret 4

Function at 0x4eed20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 1
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x4eed6e
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x110]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x4eed6e
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1f8]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
cmp dword [esi + 0x2fc], 0
je 0x4eede8
push ebx
lea ebx, [esi + 0x30c]
cmp dword [ebx], 0
je 0x4eed8c
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx], 0
cmp dword [esi + 0x2fc], edi
pop ebx
jne 0x4eede1
push edi
call fcn.004753f6
mov edi, eax
movzx eax, word [ebp + 0x10]
pop ecx
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x205
call fcn.00473c99
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 0x14], eax
mov ecx, dword [edi + 0x10]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x2fc], 0
pop edi
pop esi
leave
ret 0xc
Function at 0x4efa97
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x30c]
cmp dword [edi], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x4efac8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov edi, dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4efb0c
push 1
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x110]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4efb0c
push 1
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0x1f8]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2f8]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x4efc3a
push eax
call fcn.004753f6
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4efbb9
mov eax, dword [ebx + 0x10]
push 2
push 0
push ebx
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.004ef1cd
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.00473c99
mov eax, dword [ebp - 4]
cmp dword [esi + 0x2f8], eax
jne 0x4efb96
mov ecx, dword [ebx + 0x40]
xor eax, eax
cmp ecx, eax
je 0x4efb88
cmp word [ecx], ax
je 0x4efb88
push 1
push eax
push eax
push ecx
push 0x58b168
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4efbb9
cmp dword [ebx + 0x10], eax
je 0x4efbb9
mov dword [ebp - 0xc], 1
jmp 0x4efbb9
push 1
push 0
push ebx
mov ecx, esi
call fcn.004ef1cd
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.00473c99
mov dword [ebp - 0x10], 1
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [esi + 0x2f8], eax
je 0x4efbfb
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 0x20], 1
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4efc3a
cmp dword [ebp - 0x10], eax
je 0x4efc3a
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x4efc3a
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
add esi, 0x2f4
cmp eax, dword [esi]
jne 0x4efc3a
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4f46cc
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x4f46e5
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 4
push 0x5e7310
lea ecx, [ebp - 4]
call fcn.00401c3d
lea eax, [ebp - 8]
push eax
call fcn.004f4580
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.00403cc2
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401405
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
jne 0x4f476c
push 0x104
push 0x10e
lea ecx, [ebp - 4]
call fcn.00401e99
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00403287
push 0x5c
lea ecx, [ebp - 4]
call fcn.00407762
inc eax
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00403a9d
push eax
lea ecx, [ebp - 4]
call fcn.00403cc2
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401405
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00407c58
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0xc
push dword [eax]
call edi
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
mov dword [esi + 4], eax
call fcn.00401405
cmp dword [esi + 4], ebx
jne 0x4f47b2
push dword [ebp + 8]
call edi
cmp eax, ebx
mov dword [esi + 4], eax
je 0x4f47fa
push str.KVipGetClassObject
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4f47fa
lea edi, [esi + 8]
push edi
push 0x5a60c8
mov dword [edi], ebx
call eax
test eax, eax
jl 0x4f47fa
cmp dword [edi], ebx
je 0x4f47fa
mov ecx, esi
call fcn.004f3e33
test eax, eax
je 0x4f47fa
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401405
mov eax, ebx
pop edi
jmp 0x4f46df
mov ecx, esi
call fcn.004f3f14
jmp 0x4f47e7