joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1188ccc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x1188cdf
xor eax, eax
jmp 0x1188e63
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x1188d1d
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x1188d36
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x1188d36
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x1188d43
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x1188d7c
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1188d3c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x1188e1c
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x1188dac
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x1188e0b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x1188dc4
jmp 0x1188da5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x1188dfc
jmp 0x1188e09
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1188da5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x1188d7c
and dword [ebp - 0x14], 0
jmp 0x1188e29
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x1188e61
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1188e22
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x118900a
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x6c
mov eax, dword [esp + 0x70]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.01188fcd
push esi
call fcn.011891bb
push dword [esp + 0x84]
mov esi, eax
call fcn.011891bb
push 0x58
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.01181142
lea eax, [esp + 0x34]
push eax
push 5
push esi
call fcn.01188ee7
mov ebx, eax
add esp, 0x20
cmp ebx, 5
jb 0x11891a2
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.011891f0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x11891a2
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x14], 0
mov ebp, eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push esi
push ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1189185
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x118916a
xor edx, edx
lea ecx, [edi + 0x2c]
test ebx, ebx
je 0x11890eb
mov ebp, esi
sub ebp, ecx
mov al, byte [ecx + ebp]
mov byte [ecx], al
mov byte [edi + edx + 0x4c], al
inc edx
inc ecx
cmp edx, ebx
jb 0x11890d5
mov ebp, dword [esp + 0x20]
lea ecx, [edi + 0x2c]
lea eax, [ebx + esi]
push eax
lea eax, [ecx + ebx]
push eax
call fcn.01188f88
mov edx, dword [esp + 0x20]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1189134
lea eax, [edi + 0xc]
push edx
push eax
call fcn.01188f88
pop ecx
sub eax, edi
pop ecx
sub eax, 0xc
push eax
lea eax, [edi + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi + 0xc]
jmp 0x1189136
mov eax, edx
push eax
push esi
call fcn.01188f88
mov eax, dword [esp + 0x20]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push ebx
push eax
push ebp
mov dword [edi + 4], ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6c
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
pop ebp
je 0x1189196
mov ecx, dword [esp + 0x7c]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x11891a2
push 1
push edi
call fcn.011892e4
pop ecx
pop ecx
xor edi, edi
push 0x118dd40
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0x6c
ret
Function at 0x11891f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
push ebx
xor ebx, ebx
cmp dword [0x118dd34], 0x40
jae 0x11892dd
mov ecx, dword [esp + 0x48]
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebp, 0xfff80000
add esi, ecx
add ecx, dword [esp + 0x5c]
push edi
cmp ecx, 0x80000000
lea edi, [esp + 0x2c]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb ebp, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
cmovb edi, eax
cmp edi, ebp
jae 0x11892da
push 0x1c
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x11892b5
cmp dword [esp + 0x20], 0x10000
jne 0x11892a7
mov eax, dword [esp + 0x1c]
cmp eax, 0x6c
jb 0x11892ab
mov ecx, dword [esp + 0x48]
cmp eax, ecx
jb 0x11892ab
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x11892b9
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
add edi, eax
cmp edi, ebp
jb 0x1189258
test ebx, ebx
je 0x11892da
xor eax, eax
cmp dword [eax*4 + 0x118dd58], 0
je 0x11892cd
inc eax
cmp eax, 0x40
jb 0x11892bb
jmp 0x11892da
inc dword [0x118dd34]
mov dword [eax*4 + 0x118dd58], ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret
Function at 0x118a94c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x118]
push edi
lea edi, [eax + ebp]
cmp eax, 8
ja 0x118a96f
push 0xffffffffffffffe2
pop eax
jmp 0x118ab04
push ebx
mov ebx, dword [esp + 0x11c]
push esi
push 0x800
lea esi, [ebp + 8]
lea eax, [ebx + 0x5410]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + 0x140c]
push esi
push eax
call fcn.0118cc43
add esp, 0x14
cmp eax, 0xffffff88
ja 0x118aaff
add esi, eax
mov dword [esp + 0x18], 0x1c
mov eax, edi
sub eax, esi
push eax
push esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0118ab6e
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x118aaff
cmp dword [esp + 0x14], 8
ja 0x118aaff
push dword [esp + 0x14]
lea eax, [esp + 0x30]
push dword [esp + 0x1c]
push eax
lea eax, [ebx + 0x804]
push eax
call fcn.0118b029
add esp, 0x10
cmp eax, 0xffffff88
ja 0x118aaff
add esi, dword [esp + 0x10]
mov eax, edi
sub eax, esi
mov dword [esp + 0x20], 0x34
push eax
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0118ab6e
add esp, 0x14
mov dword [esp + 0x10], eax
cmp eax, 0xffffff88
ja 0x118aaff
cmp dword [esp + 0x1c], 9
ja 0x118aaff
push dword [esp + 0x1c]
lea eax, [esp + 0xb4]
push dword [esp + 0x24]
push eax
lea eax, [ebx + 0xc08]
push eax
call fcn.0118b029
add esp, 0x10
cmp eax, 0xffffff88
ja 0x118aaff
add esi, dword [esp + 0x10]
mov eax, edi
sub eax, esi
mov dword [esp + 0x10], 0x23
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.0118ab6e
add esp, 0x14
mov dword [esp + 0x28], eax
cmp eax, 0xffffff88
ja 0x118aaff
cmp dword [esp + 0x24], 9
ja 0x118aaff
push dword [esp + 0x24]
lea eax, [esp + 0x6c]
push dword [esp + 0x14]
push eax
push ebx
call fcn.0118b029
add esp, 0x10
cmp eax, 0xffffff88
ja 0x118aaff
add esi, dword [esp + 0x28]
lea eax, [esi + 0xc]
cmp eax, edi
ja 0x118aaff
sub edi, esi
xor edx, edx
sub edi, 0xc
add ebx, 0x5c10
mov ecx, dword [esi]
add esi, 4
test ecx, ecx
je 0x118aaff
cmp ecx, edi
jae 0x118aaff
mov dword [ebx], ecx
inc edx
add ebx, 4
cmp edx, 3
jl 0x118aae1
sub esi, ebp
mov eax, esi
jmp 0x118ab02
push 0xffffffffffffffe2
pop eax
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x10c
ret
Function at 0x401718
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401722
repz ret
jmp fcn.004021dc

Function at 0x40a908
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405bde
and dword [ebp - 4], 0
cmp dword [0x411a78], 0
mov ebx, eax
jne 0x40a9b9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40aa6a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40aa6a
push eax
call fcn.00405b6c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411a78], eax
call esi
push eax
call fcn.00405b6c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411a7c], eax
call esi
push eax
call fcn.00405b6c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411a80], eax
call esi
push eax
call fcn.00405b6c
pop ecx
mov dword [0x411a88], eax
test eax, eax
je 0x40a9b9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405b6c
pop ecx
mov dword [0x411a84], eax
mov eax, dword [0x411a84]
cmp eax, ebx
je 0x40aa11
cmp dword [0x411a88], ebx
je 0x40aa11
push eax
call fcn.00405be7
push dword [0x411a88]
mov esi, eax
call fcn.00405be7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40aa11
test edi, edi
je 0x40aa11
call esi
test eax, eax
je 0x40aa08
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40aa08
test byte [ebp - 0xc], 1
jne 0x40aa11
or dword [ebp + 0x10], 0x200000
jmp 0x40aa4a
mov eax, dword [0x411a7c]
cmp eax, ebx
je 0x40aa4a
push eax
call fcn.00405be7
pop ecx
test eax, eax
je 0x40aa4a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40aa4a
mov eax, dword [0x411a80]
cmp eax, ebx
je 0x40aa4a
push eax
call fcn.00405be7
pop ecx
test eax, eax
je 0x40aa4a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411a78]
call fcn.00405be7
pop ecx
test eax, eax
je 0x40aa6a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40aa6c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401a00
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x436818
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x449030]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], vtable.CMD5Checksum.0
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], 0x67452301
mov dword [esp + 0x5c], 0xefcdab89
mov dword [esp + 0x60], 0x98badcfe
mov dword [esp + 0x64], 0x10325476
mov eax, dword [esp + 0x7c]
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x78], ebx
call fcn.00401960
push esi
lea ecx, [esp + 0x10]
call fcn.004017d0
mov eax, esi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004322b8
add esp, 0x70
ret

Function at 0x401d10
Capabilities:
Create process on windows

Disassembly:
push 0x41
push 0x43951c
push 0x439530
mov ecx, esi
call sub.MFC80U.DLL_Ordinal_4098
cmp eax, 1
jne 0x401d56
push 5
push 0
push 0
push str.http:__g.iciba.com_powerword_lite_zh_cn_getflashplayer
push 0x439984
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0x20]
push 0
push 0x1f4
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_SetTimer]
ret
Function at 0x402500
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x437384
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x74], 0
jne 0x402573
push 0x41
push 0x43951c
push 0x439530
call sub.MFC80U.DLL_Ordinal_4098
cmp eax, 1
jne 0x402573
push 5
push 0
push 0
push str.http:__g.iciba.com_powerword_lite_zh_cn_getflashplayer
push 0x439984
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0x20]
push 0
push 0x1f4
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0x74]
test eax, eax
je 0x40268e
mov ecx, dword [eax + 0x20]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call ebp
test eax, eax
je 0x4025ec
mov eax, dword [esi + 0x74]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00401030
push 0x43947c
mov ecx, eax
mov dword [esp + 0x30], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_1472]
test eax, eax
lea ecx, [esp + 0x18]
setne bl
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
test bl, bl
je 0x4025f1
mov eax, dword [esi + 0x74]
push 0x4396ac
push 0x44910c
push 0
push 0
push 4
push 0x66
push eax
call sub.MFC80U.DLL_Ordinal_3902
add esp, 0x1c
jmp 0x4025f1
call fcn.00401d10
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
push eax
lea edi, [esp + 0x24]
mov ecx, esi
call fcn.00402210
mov ebx, eax
lea edx, [esi + 0x88]
push edx
lea eax, [esp + 0x20]
push eax
mov edi, str._name_mp3
mov dword [esp + 0x34], 1
call fcn.004027a0
lea ecx, [esp + 0x1c]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x3c], 2
call fcn.00402720
add esp, 0x10
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 5
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov edx, dword [esi + 0x74]
mov eax, dword [edx + 0x20]
push eax
call ebp
test eax, eax
je 0x40267c
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x74]
push ecx
push 0x44910c
push 0
push 0
push 4
push 0x66
push eax
call sub.MFC80U.DLL_Ordinal_3902
add esp, 0x1c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov edx, dword [esp + 0x34]
push edx
lea ecx, [esi + 0x78]
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x4036a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x433d28
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
mov dword [esi], vtable.CAdapter_WordDataDictionary_Sqlite.0
mov eax, dword [edi]
mov dword [esi + 8], eax
mov ecx, dword [edi + 4]
lea edx, [edi + 8]
mov dword [esi + 0xc], ecx
push edx
lea ecx, [esi + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, dword [edi + 0x24]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x34], edx
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4075f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437576
mov eax, dword fs:[0]
push eax
sub esp, 0x230
push ebx
push esi
push edi
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov edi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0x449160
push 0x44a328
call sub.gdiplus.dll_GdiplusStartup
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_3824
push 0
call sub.MFC80U.DLL_Ordinal_1049
add esp, 4
push str.kingsoft_new_CoolWord
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [edi + 0x178], eax
je 0x4076ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4076d5
push 0x43a498
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_5971
cmp dword [edi + 0x158], 0
jne 0x407703
push 0x48
call sub.MFC80U.DLL_Ordinal_762
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x248], 0
je 0x4076f0
mov esi, eax
call fcn.00409b10
jmp 0x4076f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40768f
mov eax, 1
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esp + 0x248], 0xffffffff
mov dword [edi + 0x158], eax
cmp dword [edi + 0x15c], 0
jne 0x40776e
push 0x94
call sub.MFC80U.DLL_Ordinal_762
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x248], 1
je 0x407736
push eax
call fcn.00401ac0
mov esi, eax
jmp 0x407738
xor esi, esi
test esi, esi
mov dword [esp + 0x248], 0xffffffff
mov dword [edi + 0x15c], esi
je 0x407769
mov edx, dword [esi]
mov eax, dword [edx + 0x13c]
push 0
push 0x88
mov ecx, esi
call eax
push 0
mov ecx, esi
call sub.MFC80U.DLL_Ordinal_6086
call fcn.004026c0
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040d660
lea edx, [esp + 0x3c]
push 0
mov dword [esp + 0x24c], 2
push 0x66
mov ecx, edx
mov dword [edi + 0x20], edx
call sub.MFC80U.DLL_Ordinal_1542
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call esi
test eax, eax
je 0x4077de
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x24], 0x12
je 0x4077de
lea ecx, [esp + 0x20]
push ecx
call edi
lea edx, [esp + 0x20]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call esi
test eax, eax
jne 0x4077b8
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x24c], 0xffffffff
call fcn.00407810
xor eax, eax
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408c00
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x433189
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [0x44a32c]
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408c59
test al, 0x10
jne 0x408c59
mov eax, dword [edi]
mov edx, dword [eax + 4]
push 0x43a664
push esi
mov ecx, edi
call edx
jmp 0x408d6d
push 0x43a648
push esi
call dword [sym.imp.MSVCR80.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x408d6d
push 0x43a650
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push 0x43a664
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
push 0x43a658
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea ebp, [ebx + 1]
push ebp
call sub.MFC80U.DLL_Ordinal_265
push ebp
mov edi, eax
push 0
push edi
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x28]
add esp, 0x10
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, dword [sym.imp.MSVCR80.dll_fwrite]
push esi
push 1
lea edx, [esp + 0x1f]
push 1
push edx
mov byte [esp + 0x27], 0xef
call ebp
push esi
push 1
lea eax, [esp + 0x2f]
push 1
push eax
mov byte [esp + 0x37], 0xbb
call ebp
push esi
push 1
lea ecx, [esp + 0x3f]
push 1
push ecx
mov byte [esp + 0x47], 0xbf
call ebp
push esi
push 1
push ebx
push edi
call ebp
add esp, 0x40
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
push edi
call dword [sym.imp.MSVCR80.dll_free]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov eax, dword [esp + 0x38]
mov edx, dword [edx + 4]
add esp, 8
push 0x43a664
push eax
call edx
lea ecx, [esp + 0x18]
mov esi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4099b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4370db
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
push 0xc
call sub.MFC80U.DLL_Ordinal_762
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
xor edi, edi
cmp esi, edi
mov dword [esp + 0x30], edi
je 0x409a1c
call fcn.0040b9c0
mov dword [esi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], edi
jmp 0x409a1e
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
push eax
mov dword [ebx], esi
call fcn.00402e10
mov ecx, dword [esp + 0x14]
push eax
add ecx, 0x14
mov dword [esp + 0x34], 1
call fcn.0040a520
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040a3f0
mov byte [esp + 0x30], 3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409aa7
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x409a9f
test esi, esi
je 0x409a9f
mov eax, dword [esi]
test eax, eax
je 0x409a86
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x409a96
push eax
call sub.MFC80U.DLL_Ordinal_266
add esp, 4
push esi
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
push eax
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
push ecx
mov esi, ecx
push edx
push esi
call fcn.0040c710
mov eax, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.0040ac20
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8