joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491a4c
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, 0x6123dd
call fcn.0060b6e8
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 4], 0
push 0x66
push dword [0x6c3548]
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
mov dword [ebx + 0x648], 7
mov eax, dword [ebx + 4]
lea edi, [ebx + 0x63c]
push 0x69e898
lea edx, [ebx + 0x61c]
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov dword [ebx + 0x650], esi
mov dword [edi], 0x3bc
mov dword [ebx + 0x64c], 0x468
mov dword [ebx + 0x640], eax
mov dword [ebx + 0x95c], 3
mov dword [ebx + 0x644], 2
call fcn.0040aec1
push dword [eax]
lea eax, [ebx + 0x654]
push 0x80
push eax
call fcn.005f12ec
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
test esi, esi
je 0x491b08
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x492373
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
mov edx, dword [esi]
call fcn.0046f38f
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [esi]
push 3
pop edi
cmp dword [eax - 0xc], edi
jl 0x492435
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4923b7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x492435
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
cmp eax, edi
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x4923e4
push 2
pop eax
jmp 0x492438
mov ecx, esi
call fcn.004922fe
test eax, eax
je 0x4923f3
mov eax, edi
jmp 0x492438
push edi
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00490672
mov ecx, dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
add bl, 1
je 0x492420
push 4
jmp 0x4923e1
mov eax, dword [esi]
xor ecx, ecx
push 5
pop edx
cmp dword [eax - 0xc], 0x96
cmovg ecx, edx
mov eax, ecx
jmp 0x492438
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49243f
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x612444
call fcn.0060b6e8
sub esp, 0x448
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x454]
push esi
push eax
mov ebx, ecx
call fcn.005e1180
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push 0x11
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push 0x105
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0040682a
push esi
lea ecx, [ebp - 0x14]
call fcn.00406601
push 0x69ebbc
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
cmp dword [edi - 4], 1
jle 0x4924e6
push dword [edi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406af0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], edi
push eax
mov dword [ebp - 0x34], 0x69ebac
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x4925be
push 0x208
lea eax, [ebp - 0x24c]
push 0
push eax
call fcn.005e1180
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
lea edx, [ebp - 0x24c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0046f38f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00406668
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push str.kingsoft_antivirus_
lea ecx, [ebp - 0x18]
call fcn.004062d3
mov esi, dword [ebp - 0x18]
push esi
push dword [ebx + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x18]
call fcn.00492373
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [ebx + 0x5b8], 2
lea ecx, [esi - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [edi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x492781
Capabilities:
Get common file path
Get program files directory

Disassembly:
push esi
push edi
lea edi, [ecx + 0x5b0]
push 0x104
mov ecx, edi
call fcn.0040682a
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, edi
mov esi, eax
call fcn.00408f1c
test esi, esi
jne 0x4927bd
push str.c:program_files
mov ecx, edi
call fcn.004060f8
push str.kingsoftkingsoft_antivirus_
mov ecx, edi
call fcn.004062d3
pop edi
pop esi
ret
Function at 0x492df5
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x60c64a
call fcn.0060b6e8
push ecx
push ecx
push ebx
push esi
push edi
push 0x208
push 0x199
mov esi, ecx
call fcn.00492c6a
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x5d4], eax
sete al
push eax
call fcn.00493356
mov ecx, esi
call fcn.00492f5c
push str.soguo_mainbg_new
push str.skin
lea edi, [esi + 0x28]
push 3
mov ecx, edi
call fcn.0044a300
push str.0_0__0__0
mov ebx, 0x699e18
mov ecx, edi
push ebx
push 3
call fcn.0044a300
cmp dword [esi + 0x5d4], 0
jne 0x492f4b
push str.15__153__15__63
push ebx
push 0xc8
mov ecx, edi
call fcn.0044a300
push str.softtemprory.png
lea edx, [esi + 0x620]
lea ecx, [ebp - 0x10]
call fcn.0040aec1
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, edi
test eax, eax
je 0x492ebb
push dword [ebp - 0x10]
mov esi, 0x25c
push str.filepath
push esi
call fcn.00447590
push str._36_103_36_175
mov ecx, edi
jmp 0x492ec5
push str._30_103_30_163
mov esi, 0x25d
push ebx
push esi
call fcn.0044a300
push 1
push esi
mov ecx, edi
call fcn.0044754b
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
call fcn.00437393
add eax, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.00406123
mov esi, dword [ebp - 0x14]
mov ebx, 0x25e
push esi
push ebx
mov ecx, edi
call fcn.00447608
push str.30_190__30_234
push 0x699e18
push ebx
mov ecx, edi
call fcn.0044a300
push str.sogou_aladdin_titlt
push str.class
push ebx
mov ecx, edi
call fcn.00447590
push 1
push ebx
mov ecx, edi
call fcn.0044754b
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4930cb
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x61248b
call fcn.0060b6e8
sub esp, 0x90
push ebx
push esi
push edi
push 0x1b8
push 0x258
mov edi, ecx
call fcn.00492c6a
push 1
mov ecx, edi
call fcn.00493356
push str.scene5_logo
push str.skin
lea esi, [edi + 0x28]
mov ebx, 0x25a
push ebx
mov ecx, esi
call fcn.0044a300
push str.16_0
push 0x699e18
push ebx
mov ecx, esi
call fcn.0044a300
push 1
push ebx
mov ecx, esi
call fcn.0044754b
push str.scene5_bg
push str.skin
push 3
mov ecx, esi
call fcn.0044a300
push str.0_0__0__0
mov ebx, 0x699e18
mov ecx, esi
push ebx
push 3
call fcn.0044a300
push str.0__105__0__15
push ebx
push 0xc8
mov ecx, esi
call fcn.0044a300
push 1
push 0x262
mov ecx, esi
call fcn.0044754b
push str.softtemprory.png
lea edx, [edi + 0x624]
lea ecx, [ebp - 0x14]
call fcn.0040aec1
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, esi
test eax, eax
je 0x4931be
push dword [ebp - 0x14]
mov ebx, 0x264
push str.filepath
push ebx
call fcn.00447590
push 1
push ebx
mov ecx, esi
call fcn.0044754b
xor ebx, ebx
jmp 0x4931ca
push 1
push 0x265
call fcn.0044754b
push 1
push 0x263
mov ecx, esi
call fcn.0044754b
push 0x64
lea eax, [ebp - 0x10]
push eax
call fcn.004936f7
mov byte [ebp - 4], 1
mov ecx, esi
push dword [eax]
push 0x266
call fcn.00447608
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.004936f7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98]
push 0xfde9
push dword [eax]
mov dword [ebp - 0x9c], ecx
lea ecx, [ebp - 0x9c]
call fcn.00408f48
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
push dword [ebp - 0x9c]
call fcn.00413e4d
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x9c], eax
je 0x493260
push dword [ebp - 0x9c]
call fcn.005efad3
pop ecx
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00493daa
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404ea9
push ecx
push ecx
mov ecx, edi
call fcn.00493777
xor eax, eax
mov ecx, esi
cmp dword [edi + 0x5d4], ebx
sete al
push eax
push 0x267
call fcn.0044754b
cmp dword [edi + 0x5d4], ebx
jne 0x4932bd
push ebx
push 0x53
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4932d3
push str.0_268__0_300
push 0x699e18
push 0x1fb
mov ecx, esi
call fcn.0044a300
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493986
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x4939bd
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4939b0
push 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
xor eax, eax
inc eax
pop esi
pop ebp
ret 4
Function at 0x493bab
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x493c23
cmp dword [ebp + 0xc], esi
je 0x493c23
cmp dword [edi + 0x10], esi
je 0x493be2
push esi
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x493bdd
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
cmp dword [edi + 0x10], esi
jne 0x493c23
mov ebx, dword [edi]
push 0x18
call fcn.00430c2b
pop ecx
mov ecx, eax
test ecx, ecx
je 0x493c17
push esi
push esi
push ecx
mov dword [ecx], ebx
mov dword [ecx + 0x10], esi
mov eax, dword [ebp + 0xc]
push 0x48d589
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push esi
mov dword [ecx + 0xc], eax
call fcn.005f33c0
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 0x10], esi
test esi, esi
setne al
jmp 0x493c25
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x494175
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x4942c1
mov ebx, dword [ebp + 0xc]
xor esi, esi
inc esi
cmp ebx, 0x4e
jne 0x4941c6
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 4], 0xffffffff
jne 0x4942ca
push ecx
mov ecx, edi
mov dword [edi + 0x580], esi
call fcn.004940cf
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], 0
je 0x49429d
mov eax, esi
jmp 0x4942c3
cmp ebx, 0x113
jne 0x494215
mov eax, 0x2711
mov dword [edi + 0x580], esi
cmp dword [ebp + 0x10], eax
jne 0x49420d
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [edi + 0x58c]
push 0x3ed
push 0x476
push dword [edi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp + 0x18]
and dword [ecx], 0
jmp 0x4941b2
cmp ebx, 0x110
jne 0x494237
push 0
push 0
push 0x473
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49420d
cmp ebx, 0x473
jne 0x49425a
call fcn.004944ea
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x4942c3
cmp ebx, 0x477
jne 0x494277
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.0049434d
jmp 0x4941ad
cmp ebx, 0x478
jne 0x4942ca
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.004943af
mov esi, dword [ebp + 0x18]
mov dword [esi], eax
cmp dword [edi + 0x580], 0
jne 0x494255
mov ecx, esi
mov esi, dword [edi + 0x578]
push 0
push ecx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0044a37e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x494255
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
jmp 0x49429d
Function at 0x4945af
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x494618
cmp dword [ebp + 0x1c], 0x12d
jne 0x494782
cmp dword [ebp + 0xc], 0x100
jne 0x494782
xor ebx, ebx
push 0x11
mov dword [edi + 0x580], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp + 0x10], 0x61
movzx eax, ax
je 0x4945f6
cmp dword [ebp + 0x10], 0x41
jne 0x494608
test al, al
jns 0x494608
sub esp, 0xc
lea ecx, [edi + 0x588]
call fcn.00493b82
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
cmp dword [edi + 0x580], ebx
jmp 0x494780
mov eax, dword [ebp + 0xc]
xor esi, esi
inc esi
xor ebx, ebx
cmp eax, 0x4e
jne 0x49466f
mov edx, dword [ebp + 0x14]
cmp dword [edx + 4], 0xffffffff
jne 0x49475b
mov dword [edi + 0x580], esi
cmp dword [edx + 8], esi
jne 0x49464f
cmp dword [edx + 0xc], 0x12e
jne 0x49464f
call fcn.00494918
mov eax, esi
jmp 0x494657
mov dword [edi + 0x580], ebx
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp dword [edi + 0x580], ebx
je 0x49475b
mov eax, esi
jmp 0x494784
cmp eax, 0x110
jne 0x494692
mov dword [edi + 0x580], esi
call fcn.00494a87
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
jmp 0x49465c
cmp eax, 0x465
jne 0x4946ab
push ecx
push dword [ebp + 0x10]
mov dword [edi + 0x580], esi
push ecx
call fcn.00494868
jmp 0x494657
cmp eax, 0x466
jne 0x4946c2
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.004948be
jmp 0x494657
mov edx, 0x46c
cmp eax, edx
jne 0x4946de
sub esp, 0xc
mov dword [edi + 0x580], esi
call fcn.00494d34
jmp 0x494657
cmp eax, 0x46f
jne 0x4946ff
push dword [edi + 0x5b0]
mov dword [edi + 0x580], esi
push dword [edi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x49468b
cmp eax, 0x10
jne 0x494720
push ebx
push 2
push 0x111
push dword [edi + 4]
mov dword [edi + 0x580], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49468b
cmp eax, 0x111
jne 0x49475b
mov eax, dword [ebp + 0x10]
mov ecx, 0x300
shr eax, 0x10
mov dword [edi + 0x580], ebx
cmp cx, ax
jne 0x494749
push ebx
push ebx
push edx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], ebx
cmp dword [edi + 0x580], ebx
je 0x49475b
xor eax, eax
inc eax
jmp 0x494784
mov esi, dword [edi + 0x578]
mov ecx, edi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a37e
mov dword [edi + 0x578], esi
test eax, eax
jne 0x494756
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x494918
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x60cde5
call fcn.0060b6e8
sub esp, 0x43c
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x18], ebx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov edi, 0x208
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.005e1180
push edi
lea eax, [ebp - 0x448]
push ebx
push eax
call fcn.005e1180
add esp, 0x18
lea eax, [ebp - 0x448]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x69ebbc
lea ecx, [ebp - 0x14]
call fcn.004060f8
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
push 0x105
mov dword [ebp - 0x34], eax
call fcn.0040682a
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x2c], 0x69ebac
mov dword [ebp - 0x28], 0x8041
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00408f1c
test edi, edi
je 0x494a5e
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x240]
push eax
call fcn.005efad8
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x10]
call fcn.0046f38f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov dword [esp], str.kingsoft_antivirus_
call fcn.004062d3
push dword [ebp - 0x10]
push dword [esi + 0x588]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00494c59
push eax
push 0x46c
push dword [esi + 0x584]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x494a87
Capabilities:
Get common file path
Get program files directory
Hide graphical window

Disassembly:
mov eax, 0x60c405
call fcn.0060b6e8
sub esp, 0x20c
push ebx
push esi
push edi
push ecx
push ecx
mov eax, esp
mov ebx, ecx
sub esp, 0x10
xor esi, esi
mov dword [eax], 0x12d
lea edi, [ebx + 0x588]
mov eax, esp
mov ecx, edi
mov dword [eax], esi
push dword [ebx + 4]
call fcn.004939f5
push 0x69f118
push 0x20
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x64
push esi
push esi
push esi
push 0x12
call dword [sym.imp.GDI32.dll_CreateFontW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi]
call esi
push 0
push 0x96
push 0xc5
push dword [edi]
call esi
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
xor esi, esi
lea eax, [ebp - 0x218]
push 0x208
push esi
push eax
mov dword [ebp - 4], esi
call fcn.005e1180
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x494b59
push str.c:program_files
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005f12ec
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push str._skingsoftkingsoft_antivirus_
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x10]
add esp, 0xc
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x5b0]
call fcn.00406123
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x494c59
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], ecx
lea ecx, [ebp + 8]
mov edx, dword [edi]
call fcn.0046f38f
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov eax, dword [edi]
cmp dword [eax - 0xc], 3
jl 0x494d17
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x494ca1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x494d17
push 3
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp + 8]
cmp eax, 3
setne bl
lea ecx, [ecx - 0x10]
call fcn.00404ea9
test bl, bl
je 0x494cd0
push 2
pop esi
jmp 0x494d1a
push edi
call fcn.00494ba5
push 3
test eax, eax
jne 0x494ccd
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00405d36
mov ecx, dword [eax]
call fcn.00490672
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00404ea9
add bl, 1
je 0x494d08
push 4
jmp 0x494ccd
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x494d1a
push 5
jmp 0x494ccd
xor esi, esi
inc esi
mov eax, dword [ebp - 4]
push dword [eax + 0x584]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x498189
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x612582
call fcn.0060b6e8
sub esp, 0x26c
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x692da4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], edi
call fcn.00406173
mov dword [ebp - 4], edi
call fcn.00417aae
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov al, byte [eax + 0x20]
mov byte [ebp - 4], 1
test al, al
je 0x4981e7
cmp dword [esi + 0x14], edi
jne 0x4981e7
push 0x20119
push dword [esi + 8]
lea ecx, [ebp - 0x24]
push dword [esi + 4]
call fcn.00416598
test eax, eax
je 0x498218
push 0x20219
push dword [esi + 8]
lea ecx, [ebp - 0x24]
push dword [esi + 4]
call fcn.00416598
test eax, eax
je 0x498218
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004067cf
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov dword [esi], eax
jmp 0x498315
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
push 0x20a
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 2
push edi
push eax
mov dword [ebp - 0x18], edi
call fcn.005e1180
add esp, 0xc
mov dword [ebp - 0x28], 0x104
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [esi + 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4982ed
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x4982c2
cmp eax, 2
je 0x4982c2
cmp eax, 7
je 0x4982c2
cmp eax, 4
jne 0x49829f
push 0xa
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x278]
call fcn.005f504e
add esp, 0x10
lea eax, [ebp - 0x6c]
jmp 0x4982c8
cmp eax, 0xb
jne 0x4982d1
push 0xa
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x274]
push dword [ebp - 0x278]
call fcn.005f500d
add esp, 0x14
jmp 0x49829a
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x10]
call fcn.004060f8
lea ecx, [ebp - 0x10]
call fcn.0046e542
lea ecx, [ebp - 0x10]
call fcn.0046e632
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406123
lea ecx, [ebp - 0x24]
call fcn.004165ef
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
push eax
call fcn.004067cf
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.00404ea9
lea ecx, [ebp - 0x24]
call fcn.004165ef
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4