joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4532d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x4532ee
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4532fa
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4

Function at 0x458bc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4

Function at 0x458c60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4ac], 0
jle 0x458ccd
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4b0], 0
jle 0x458ccd
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4b0]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4ac]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x448]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x444]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x469910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
movsx eax, dx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0xffffffff
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x469ba0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4
Function at 0x469e00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x18], 0xffffffff
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x14]
call fcn.0041b7e0
jmp 0x469e32
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.00465fd0
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x14]
call fcn.00447aa0
push eax
lea ecx, [ebp - 0x18]
call fcn.00447a30
movzx eax, al
test eax, eax
je 0x469eb6
lea ecx, [ebp - 0x18]
call fcn.00485bf0
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x30], 0
je 0x469e69
jmp 0x469e24
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x469eb1
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x18], ecx
jmp 0x469eb6
jmp 0x469e24
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x18], 0xffffffff
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x30]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x484520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0x10], ax
movsx eax, word [ebp - 0x10]
shr eax, 8
mov byte [ebp - 6], al
movsx ecx, word [ebp - 0x10]
and ecx, 0xff
mov byte [ebp - 5], cl
movzx edx, byte [ebp - 5]
cmp edx, 1
jne 0x48456c
push 0x551ce4
push 0x551cfc
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
jmp 0x484604
push 2
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 0x18], eax
push 0x1f
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7d0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 1
jne 0x4845c6
push 0x551d14
push 0x551d2c
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
push 0x551d44
push 0x551d5c
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
jmp 0x484604
push 0x551d74
push 0x551d8c
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
cmp dword [ebp - 0x14], 0
je 0x4845f2
push 0x551da4
push 0x551dbc
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
jmp 0x484604
push 0x551dd4
push 0x551dec
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
push 4
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x484633
push 0x551e04
push 0x551e18
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
push 3
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x484664
push 0x551e2c
push 0x551e3c
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
jmp 0x484692
cmp dword [ebp - 4], 2
jne 0x484692
push 0x551e4c
push 0x551e5c
mov ecx, dword [ebp - 0x1c]
call fcn.00484000
push 2
push 0x28
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c9e0
mov esp, ebp
pop ebp
ret

Function at 0x4846a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 8], ax
movsx eax, word [ebp - 8]
shr eax, 8
mov byte [ebp - 2], al
movsx ecx, word [ebp - 8]
and ecx, 0xff
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
cmp edx, 1
jne 0x4846ec
push str.QieHuan_An
push 0x551e84
mov ecx, dword [ebp - 0x14]
call fcn.00484000
jmp 0x484784
push 0x1f
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7d0
mov dword [ebp - 0x10], eax
push 0x2a
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c8b0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x484746
push 0x551e9c
push 0x551eb4
mov ecx, dword [ebp - 0x14]
call fcn.00484000
push 0x551ecc
push 0x551ee4
mov ecx, dword [ebp - 0x14]
call fcn.00484000
jmp 0x484784
push str.QieHuan_Cn
push str.QieHuan_En
mov ecx, dword [ebp - 0x14]
call fcn.00484000
cmp dword [ebp - 0x10], 0
je 0x484772
push 0x551f2c
push 0x551f44
mov ecx, dword [ebp - 0x14]
call fcn.00484000
jmp 0x484784
push 0x551f5c
push 0x551f74
mov ecx, dword [ebp - 0x14]
call fcn.00484000
mov esp, ebp
pop ebp
ret
Function at 0x485130
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov esp, ebp
pop ebp
ret 8

Function at 0x4859e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x485a03
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x7d0
push 1
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x485a32
xor eax, eax
jmp 0x485a71
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00485400
push 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x14

Function at 0x485a80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x485a9b
xor eax, eax
jmp 0x485aae
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x493150
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x250], ecx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 4], 0
push 0x41
mov ecx, dword [ebp - 0x250]
call fcn.00490c90
mov dword [ebp - 0x24c], eax
mov word [ebp - 0x248], 0
push 0x206
push 0
lea ecx, [ebp - 0x246]
push ecx
call fcn.004caa30
add esp, 0xc
mov word [ebp - 0x40], 0
xor edx, edx
mov dword [ebp - 0x3e], edx
mov dword [ebp - 0x3a], edx
mov dword [ebp - 0x36], edx
mov dword [ebp - 0x32], edx
mov word [ebp - 0x2e], dx
mov word [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov ecx, dword [ebp - 0x24c]
push ecx
push 0x55437c
lea edx, [ebp - 0x40]
push edx
call fcn.004cb62b
add esp, 0xc
movzx eax, word [ebp - 0x26]
push eax
push 0x554384
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004cb62b
add esp, 0xc
mov edx, dword [ebp - 0x250]
add edx, 0x438
push edx
push 0
push 0x55438c
push 0x5543a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
movzx eax, word [ebp - 0x26]
cmp dword [ebp - 4], eax
je 0x49331e
mov ecx, dword [ebp - 0x250]
add ecx, 0x438
push ecx
lea edx, [ebp - 0x1c]
push edx
push str.LastUseDay
push 0x5543cc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x5543dc
lea eax, [ebp - 0x248]
push eax
call fcn.004caa10
add esp, 8
cmp dword [ebp - 0x24c], 0
jle 0x49328a
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x248]
push edx
call fcn.004ca9e6
add esp, 8
mov eax, dword [ebp - 0x250]
add eax, 0x438
push eax
push 0
lea ecx, [ebp - 0x248]
push ecx
push 0x5543f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x554404
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004cb62b
add esp, 0xc
push str.UseDayTotal
lea edx, [ebp - 0x248]
push edx
call fcn.004caa10
add esp, 8
cmp dword [ebp - 0x24c], 0
jle 0x4932fb
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.004ca9e6
add esp, 8
mov edx, dword [ebp - 0x250]
add edx, 0x438
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x248]
push ecx
push 0x554424
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x498540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x30c]
cmp dword [ecx + 0x4e4], 0
jne 0x4985bc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x310]
cmp dword [eax + 0x4e4], 0
jne 0x4985bc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x318]
cmp dword [edx + 0x4e4], 0
jne 0x4985bc
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x314]
cmp dword [ecx + 0x4e4], 0
jne 0x4985bc
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x320]
cmp dword [eax + 0x4e4], 0
jne 0x4985bc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x31c]
cmp dword [edx + 0x4e4], 0
je 0x4985c3
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x30c]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x30c]
add eax, 0x4e0
mov edx, dword [ecx + 0x4e0]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x310]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x310]
add ecx, 0x4e0
mov edx, dword [edx + 0x4e0]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x318]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x318]
add ecx, 0x4e0
mov edx, dword [edx + 0x4e0]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x314]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x314]
add ecx, 0x4e0
mov edx, dword [edx + 0x4e0]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x320]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x320]
add ecx, 0x4e0
mov edx, dword [edx + 0x4e0]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x31c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x31c]
add ecx, 0x4e0
mov edx, dword [edx + 0x4e0]
mov eax, dword [edx + 0x18]
call eax
cmp dword [ebp - 8], 0
jne 0x49869e
jmp 0x498711
push 0x41
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x498711
mov ecx, dword [0x594280]
call fcn.0042bca0
mov ecx, eax
call fcn.0042b260
mov dword [ebp - 0xc], eax
push 0x65
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7d0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x498711
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0x498720
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x498750
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f1bd
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5925f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
push 0x41
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x70]
call fcn.0043b530
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [0x594280]
call fcn.0042bca0
mov ecx, eax
call fcn.0042b180
push eax
push 0x5557f8
lea edx, [ebp - 0x70]
push edx
call fcn.004084e0
add esp, 0x14
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004caa30
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.0040aa60
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.0043b550
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x498cd0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0x8e8
jne 0x498d49
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x320]
call fcn.0049b430
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x30c]
call fcn.0049efe0
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x318]
call fcn.0049c790
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x320]
call fcn.00499f70
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x31c]
call fcn.0049bca0
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x310]
call fcn.0049cf60
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x314]
call fcn.004a0c90
jmp 0x498e1a
cmp dword [ebp + 8], 0x113
jne 0x498d63
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00498e30
jmp 0x498e1a
cmp dword [ebp + 8], 0x465
jne 0x498dd8
push 1
push 1
mov ecx, dword [ebp - 0x14]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CWindowWnd::ShowWindow_bool__bool_]
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 8], eax
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 0x14]
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 0x14]
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x498e1a
cmp dword [ebp + 8], 0x466
jne 0x498e1a
mov ecx, dword [0x590b5c]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x2c
call dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov dword [ebp - 0x10], eax
push 3
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x2ec]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CTabLayoutUI::SelectItem_int_]
push 1
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x134]
call eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49a5e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xe4], ecx
mov word [ebp - 0xe0], 0
push 0xc6
push 0
lea eax, [ebp - 0xde]
push eax
call fcn.004caa30
add esp, 0xc
push 0x41
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49a63f
mov eax, 1
jmp 0x49a78e
mov ecx, dword [0x594280]
call fcn.0042bca0
mov ecx, eax
call fcn.0042b260
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0x64
lea edx, [ebp - 0xe0]
push edx
push 0x555d48
push str.LoginType
push 0x555d60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x10], 0
push 0x555d74
lea eax, [ebp - 0xe0]
push eax
call fcn.004cbc4a
add esp, 8
test eax, eax
jne 0x49a69e
mov dword [ebp - 0x10], 0x555d7c
jmp 0x49a6f7
push str.renren
lea ecx, [ebp - 0xe0]
push ecx
call fcn.004cbc4a
add esp, 8
test eax, eax
jne 0x49a6bf
mov dword [ebp - 0x10], 0x555d98
jmp 0x49a6f7
push str.sina
lea edx, [ebp - 0xe0]
push edx
call fcn.004cbc4a
add esp, 8
test eax, eax
jne 0x49a6e0
mov dword [ebp - 0x10], 0x555dac
jmp 0x49a6f7
push 0x16
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c810
mov dword [ebp - 0x10], eax
push 0x14
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c810
mov dword [ebp - 8], eax
push 0x555db8
mov eax, dword [ebp - 8]
push eax
call fcn.004cbc4a
add esp, 8
test eax, eax
jne 0x49a72a
mov dword [ebp - 8], 0x555dc8
push 0x555dcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004cbc4a
add esp, 8
test eax, eax
jne 0x49a74d
mov dword [ebp - 0x10], 0x555dd0
mov dword [ebp - 8], 0x555ddc
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0xe4]
mov eax, dword [edx + 0x34]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xe4]
mov eax, dword [edx + 0x38]
mov ecx, dword [ebp - 0xe4]
mov ecx, dword [ecx + 0x38]
mov edx, dword [eax]
mov eax, dword [edx + 0x2c]
call eax
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x49ad70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
push 0x41
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 8], eax
mov ecx, dword [0x594280]
call fcn.0042bca0
mov ecx, eax
call fcn.0042b260
push eax
push 0
push str.LoginWnd
push str.UserLogin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49ae09
cmp dword [ebp - 8], 0
jne 0x49adf1
push 0
push 0
push 0x40b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49ae04
push 0
push 0
push 0x40c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49ae89
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.004caa30
add esp, 0xc
mov ecx, dword [0x594280]
call fcn.0042bca0
mov ecx, eax
call fcn.0042b180
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.004caa10
add esp, 8
push str.UserPage.exe
lea edx, [ebp - 0x218]
push edx
call fcn.004ca9e6
add esp, 8
mov ecx, dword [0x594280]
call fcn.0042bcc0
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x220]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x49af10
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f4ec
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5925f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
push 0x41
mov ecx, dword [0x594280]
call fcn.0042bd00
mov ecx, eax
call fcn.0048c7f0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x70]
call fcn.0043b530
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [0x594280]
call fcn.0042bca0
mov ecx, eax
call fcn.0042b180
push eax
push str.__sMutual.exe___s__d
lea edx, [ebp - 0x70]
push edx
call fcn.004084e0
add esp, 0x14
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004caa30
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.0040aa60
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x74], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.0043b550
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4