joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426880
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push esi
lea esi, [esp + 0xc]
call fcn.0047fd60
cmp dword [eax + 0x18], 8
jb 0x42689d
mov eax, dword [eax + 4]
jmp 0x4268a0
add eax, 4
push eax
push 0
push 0x5048a4
push str.wallpaper
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esp + 0x24], 8
mov esi, eax
jb 0x4268c9
mov eax, dword [esp + 0x10]
push eax
call fcn.004c8f17
add esp, 4
test esi, esi
jne 0x426930
mov eax, dword [ebx + 4]
test eax, eax
je 0x4268d9
mov eax, dword [eax + 4]
jmp 0x4268db
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x426930
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0
push 0xa0
push 0xe6
add edx, 0xffffff5b
push edx
add eax, 0xffffff15
push eax
push 0x90c00000
push 0x5048c8
push 0x80088
push ebx
mov ecx, str.DTLWallPaper_UpdateTips
call fcn.00488ef0
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x4276c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0x114
call fcn.004d1df0
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42771f
cmp dword [esp + 4], 6
jb 0x42771f
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004c8f08
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.004c8f08
add esp, 0x118
ret
Function at 0x42a1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f0d28
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, ecx
mov eax, dword [ebx + 0xe0]
mov dword [esp + 0x1c], esi
test eax, eax
je 0x42a20f
mov eax, dword [eax + 0xc]
jmp 0x42a214
mov eax, 1
test eax, eax
mov eax, dword [0x5324a8]
setne byte [esp + 0x17]
test eax, eax
jne 0x42a238
push 0x532ba8
mov edx, str.wallpaperlistlistitemcollect.png
call fcn.00405f10
mov dword [0x5324a8], eax
mov edi, eax
mov eax, dword [ebx + 0xe4]
test eax, eax
je 0x42a3b2
cmp dword [eax + 8], 0
je 0x42a3b2
test edi, edi
je 0x42a3b2
mov eax, dword [ebx + 0x34]
sub eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
sub ecx, dword [ebx + 0x28]
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_SetRect]
fild dword [esp + 0x24]
mov eax, dword [ebx + 0xe4]
mov ecx, dword [eax + 8]
fstp dword [esp + 0x20]
mov esi, dword [esi]
fild dword [esp + 0x28]
xor eax, eax
sub esp, 0x10
cmp byte [ecx + 0x14c], al
fstp dword [esp + 0x28]
fld dword [esp + 0x30]
setne al
fstp dword [esp + 0x54]
xor ecx, ecx
fld dword [esp + 0x28]
fstp dword [esp + 0x58]
fld dword [0x512698]
fst dword [esp + 0x5c]
fst dword [esp + 0x60]
fst dword [esp + 0xc]
mov edx, eax
fstp dword [esp + 8]
shl edx, 4
fldz
sub edx, eax
fstp dword [esp + 4]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
lea eax, [esp + 0x54]
fstp dword [esp]
call fcn.00405550
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
add eax, 0x11
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], eax
mov word [esp + 0x58], dx
mov dword [esp + 0x80], eax
movzx eax, byte [esp + 0x17]
mov ecx, dword [ebx + 0xe4]
neg eax
sbb eax, eax
and eax, 0x7d7d7d
add eax, 0x828282
mov dword [ebx + 0xcc], eax
mov eax, dword [ecx + 8]
mov esi, 8
cmp dword [eax + 0x128], esi
jb 0x42a363
mov ecx, dword [eax + 0x114]
jmp 0x42a369
lea ecx, [eax + 0x114]
movzx edx, byte [eax + 0x14c]
push edx
lea eax, [esp + 0x58]
push eax
push ecx
call fcn.00429da0
mov eax, dword [esp + 0x64]
add esp, 0xc
cmp dword [esp + 0x6c], esi
jae 0x42a38d
lea eax, [esp + 0x58]
mov edx, dword [ebx + 0xac]
mov edx, dword [edx + 8]
push eax
lea eax, [esp + 0x38]
lea ecx, [ebx + 0xac]
push eax
mov eax, dword [esp + 0x24]
push eax
call edx
lea ecx, [esp + 0x54]
call fcn.004016f0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004c8f08
mov esp, ebp
pop ebp
ret 4
Function at 0x42c3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f5bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x34]
sub eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
sub ecx, dword [edi + 0x28]
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetRect]
push 0xdc
call fcn.004c8f3d
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x42c432
lea ecx, [edi + 0xa0]
push ecx
push eax
call fcn.00432760
mov esi, eax
jmp 0x42c434
xor esi, esi
mov dword [esp + 0x28], 0xffffffff
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
sub edx, eax
push edx
mov edx, dword [esp + 0x1c]
sub edx, ecx
push edx
call fcn.00410b30
xor ecx, ecx
push ecx
mov eax, 0x42c6d0
push eax
push edi
push esi
mov edx, 0x2712
call fcn.00410010
add esp, 0x10
mov ecx, esi
call fcn.00432d10
call fcn.00410cb0
mov dword [edi + 0x9c], esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x42eef0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
call fcn.0042ee80
mov esi, eax
mov al, byte [esi]
test al, al
je 0x42ef2c
lea ecx, [esp + 8]
push ecx
push 0
push esi
push 0x46bc10
push 0
push 0
mov byte [esi], 0
mov dword [esp + 0x20], 0
call fcn.004cb271
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push esi
call fcn.0042ef40
pop esi
add esp, 8
ret

Function at 0x431fe0
Capabilities:
Delete file

Disassembly:
sub esp, 0x1c
push str.Trush
push 0x552
push 8
call fcn.004845b0
mov ecx, eax
mov eax, str..MainWndUIWallPaperListWallPaperListItemView.cpp
call fcn.00484890
mov eax, dword [esi + 0x9c]
add esp, 0xc
test eax, eax
je 0x4320a5
cmp dword [eax + 8], 0
je 0x4320a5
mov ecx, dword [eax + 8]
mov byte [ecx + 0x1d0], 0
mov edx, dword [esi + 0x9c]
mov eax, dword [edx + 8]
mov byte [eax + 0x14d], 0
mov ecx, dword [esi + 0x9c]
mov eax, dword [ecx + 8]
mov edx, dword [eax + 0x12c]
mov edx, dword [edx + 0x10]
lea ecx, [eax + 0x12c]
push 3
lea eax, [esp + 4]
push eax
call edx
cmp dword [eax + 0x18], 8
jb 0x432061
mov eax, dword [eax + 4]
jmp 0x432064
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x18], 8
jb 0x43207f
mov eax, dword [esp + 4]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esi + 0x9c]
mov eax, dword [ecx + 8]
test eax, eax
je 0x4320a5
cmp byte [0x532eb8], 0
je 0x4320a5
push 6
push eax
call fcn.00474630
add esp, 0x24
jmp fcn.00476ac0
add esp, 0x1c
ret
Function at 0x433dd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4f0c8b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
xor eax, eax
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], edi
mov word [esi + 0x20], ax
lea ecx, [esi + 0x38]
push ecx
mov dword [esp + 0x18], edi
call fcn.00403c40
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x439900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f5bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x532ba8
mov edx, 0x5068d4
call fcn.00405f10
mov ecx, dword [edi + 0x30]
sub ecx, dword [edi + 0x28]
mov dword [edi + 0xc4], eax
mov eax, dword [edi + 0x34]
sub eax, dword [edi + 0x2c]
lea edx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetRect]
push 0xb8
call fcn.004c8f3d
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 0x28], 0
test esi, esi
je 0x43998c
call fcn.0042ae00
mov dword [esi], vtable.CWallPaperLocalPaperListScrollView.0
mov dword [esi + 8], vtable.CWallPaperLocalPaperListScrollView.1.0
jmp 0x43998e
xor esi, esi
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x14]
sub edx, ecx
push edx
call fcn.00410b30
mov ecx, esi
call fcn.0042b1e0
call fcn.00410cb0
mov dword [edi + 0xbc], esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x43a320
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f4da8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xe0]
cmp dword [eax + 0xc], 0
je 0x43a45f
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [eax + 0xc]
call fcn.0046f5a0
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x43a37a
mov eax, dword [eax + 4]
jmp 0x43a37d
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp dword [esp + 0x48], edi
jb 0x43a39c
mov edx, dword [esp + 0x34]
push edx
call fcn.004c8f17
add esp, 4
test bl, bl
je 0x43a3e3
mov eax, dword [esi + 0xe0]
cmp dword [eax + 8], 0
mov eax, dword [eax + 0xc]
jne 0x43a3c7
call fcn.00473f40
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.004740d0
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0xe0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 0xc]
call fcn.0046f5a0
xor esi, esi
mov dword [esp + 0x58], esi
cmp dword [eax + 0x18], edi
jb 0x43a406
mov eax, dword [eax + 4]
jmp 0x43a409
add eax, 4
push esi
call fcn.0046a290
add esp, 4
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x43a42d
mov eax, dword [esp + 0x18]
push eax
call fcn.004c8f17
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], cx
call fcn.00418d60
test eax, eax
je 0x43a45f
call fcn.00418d60
mov esi, eax
call fcn.0047ee70
test al, al
je 0x43a45f
push esi
call fcn.0041c340
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ae10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f4d76
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x34]
sub eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
sub ecx, dword [edi + 0x28]
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.USER32.dll_SetRect]
push 0xc8
call fcn.004c8f3d
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], 0
test eax, eax
je 0x43ae7c
push eax
call fcn.00439590
mov esi, eax
jmp 0x43ae7e
xor esi, esi
or ebx, 0xffffffff
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
mov dword [edi + 0xa8], esi
call fcn.00410b30
mov ecx, dword [edi + 0xa8]
call fcn.00439900
mov eax, dword [edi + 0xa8]
push 0
push eax
call fcn.00410a60
mov esi, dword [edi + 0xa8]
call fcn.00410cb0
push 0xbc
call fcn.004c8f3d
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], 1
test eax, eax
je 0x43aef0
mov esi, eax
call fcn.00438fe0
jmp 0x43aef2
xor eax, eax
mov dword [esp + 0x38], ebx
mov dword [edi + 0xb0], eax
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 0x64]
push 0x64
call eax
mov ecx, dword [edi + 0xb0]
mov edx, dword [ecx]
mov edx, dword [edx + 0x70]
lea eax, [esp + 0x18]
push eax
call edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x18]
sub eax, ecx
sub eax, dword [esp + 0x24]
push ecx
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [esp + 0x2c]
sub eax, esi
sub eax, dword [esp + 0x24]
push esi
mov esi, dword [edi + 0xb0]
cdq
sub eax, edx
mov ecx, eax
sar ebx, 1
sar ecx, 1
mov eax, ebx
call fcn.00410b30
mov eax, dword [edi + 0xb0]
push 0
push eax
call fcn.00410a60
mov esi, dword [edi + 0xb0]
call fcn.00410cb0
mov ecx, dword [edi + 0xb0]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x43af95
xor edx, edx
push edx
mov ecx, 0x43b6a0
push ecx
push edi
push eax
mov edx, 0x2711
call fcn.00410010
add esp, 0x10
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x43b6b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x43b82f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43b82f
push ebx
push ebp
push edi
push 0
push eax
call fcn.00410a60
mov eax, dword [esi + 0x1c]
push 1
push eax
call fcn.00410a60
mov edi, dword [esi + 0x30]
sub edi, dword [esi + 0x2c]
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx]
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebx + 0x6c]
push eax
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov ebp, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x43b7da
xor ebx, ebx
lea ecx, [ecx]
cmp byte [esi + 0xd], 0
jne 0x43b7da
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x43b75c
call fcn.004c96d9
mov eax, dword [esi + 0x2c]
add eax, ebx
cmp dword [eax + 0x18], 8
jb 0x43b76c
mov eax, dword [eax + 4]
jmp 0x43b76f
add eax, 4
lea edx, [esi - 0x94]
push edx
mov ecx, eax
call fcn.0043b120
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x64
jbe 0x43b7ad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x1c], 0
mov ebp, eax
je 0x43b7ad
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x68]
push edi
call edx
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x30]
sub ecx, dword [esi + 0x2c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebx, 0x1c
cmp eax, edi
ja 0x43b730
mov ecx, dword [esi + 0x1c]
push 0
push ecx
call fcn.00410a60
mov esi, dword [esi + 0x14]
mov al, byte [esi + 0x38]
pop edi
shr al, 1
and al, 1
pop ebp
pop ebx
jne 0x43b82f
test al, al
je 0x43b801
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
or byte [esi + 0x38], 2
test byte [esi + 0x38], 2
mov edx, dword [esi]
mov ecx, esi
je 0x43b821
mov eax, dword [edx + 0x24]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
xor eax, eax
pop esi
ret
mov eax, dword [edx + 0x28]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
xor eax, eax
pop esi
ret
Function at 0x43ba30
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x34
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x30], eax
cmp dword [0x535634], 0
jne 0x43bb9c
push edi
mov edi, 0x506c40
lea ecx, [esp + 0x18]
call fcn.00460ea0
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
jae 0x43ba6d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x535634], eax
test eax, eax
je 0x43bb88
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitUserLgn
push eax
call esi
mov dword [0x532c14], eax
mov eax, dword [0x535634]
push str.CloseUserLgn
push eax
call esi
mov ecx, dword [0x535634]
push str.RemoteLogin
push ecx
mov dword [0x532c18], eax
call esi
mov edx, dword [0x535634]
push str.EndLogin
push edx
mov dword [0x532c1c], eax
call esi
mov dword [0x532c20], eax
mov eax, dword [0x535634]
push str.EndLoginEx
push eax
call esi
mov ecx, dword [0x535634]
push str.AddMonitorWnd
push ecx
mov dword [0x532c24], eax
call esi
mov edx, dword [0x535634]
push str.DeleteMonitorWnd
push edx
mov dword [0x532c28], eax
call esi
mov dword [0x532c2c], eax
mov eax, dword [0x535634]
push str.GetUserInfo
push eax
call esi
mov ecx, dword [0x535634]
push str.RegisterUser
push ecx
mov dword [0x532c30], eax
call esi
mov edx, dword [0x535634]
push str.BeginRegister
push edx
mov dword [0x532c34], eax
call esi
mov dword [0x532c38], eax
mov eax, dword [0x535634]
push str.EndRegister
push eax
call esi
mov ecx, dword [0x535634]
push str.GetRegisterResult
push ecx
mov dword [0x532c3c], eax
call esi
mov edx, dword [0x535634]
push str.IsRegistering
push edx
mov dword [0x532c40], eax
call esi
mov dword [0x532c44], eax
mov eax, dword [0x535634]
push str.GetLocalUser
push eax
call esi
mov dword [0x532c48], eax
pop esi
cmp dword [esp + 0x30], edi
pop edi
jb 0x43bb9c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c8f17
add esp, 4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp], 0x14
call fcn.00418d60
mov eax, dword [eax + 4]
test eax, eax
je 0x43bbc9
mov eax, dword [eax + 4]
jmp 0x43bbcb
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x807c
call fcn.00480c70
mov dword [esp + 8], eax
mov eax, dword [0x532c14]
mov dword [esp + 0x10], 0
test eax, eax
je 0x43bbf7
lea edx, [esp]
push edx
call eax
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004c8f08
add esp, 0x34
ret
Function at 0x43f560
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4ed98b
mov eax, dword fs:[0]
push eax
sub esp, 0x580
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x57c], eax
push ebp
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x590]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5a0]
push str.DtlWallPaperUserIcon.bmp
lea ecx, [esp + 0x14]
call fcn.00460d90
add esp, 4
mov dword [esp + 0x598], 0
mov eax, dword [esp + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x43f5d0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f62b
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x43f5e9
lea edi, [esp + 0x14]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x43f611
lea eax, [esi + 4]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromFile
mov dword [esi + 8], eax
jmp 0x43f613
xor esi, esi
mov ecx, dword [ebp + 0x98]
test ecx, ecx
je 0x43f625
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [ebp + 0x98], esi
mov eax, dword [0x532c30]
test eax, eax
je 0x43f75a
lea ecx, [esp + 0x2c]
push ecx
call eax
cmp eax, 1
jne 0x43f75a
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x38e]
push eax
mov word [esp + 0x390], dx
call fcn.004d1df0
add esp, 0xc
xor ecx, ecx
push 0x40
push ecx
lea edx, [esp + 0x346]
push edx
mov word [esp + 0x348], cx
call fcn.004d1df0
add esp, 0xc
push 0x40
lea eax, [esp + 0x39]
push eax
lea ecx, [esp + 0x344]
push 0x42
push ecx
call fcn.004c9253
lea edx, [esp + 0x34c]
push edx
push str.http:__u.160.com_managecenter_userinfo.aspx_sid_s
lea eax, [esp + 0x39c]
push 0x104
push eax
call fcn.004ca693
mov edi, dword [ebp + 0xa0]
add esp, 0x20
test edi, edi
je 0x43f72d
lea eax, [esp + 0x135]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43f6d1
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x139]
push ecx
lea esi, [edi + 0x3c]
call fcn.00401760
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
lea eax, [esp + 0x384]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43f704
mov esi, dword [ebp + 0xa0]
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x388]
push ecx
add esi, 0xe8
call fcn.00401760
lea eax, [esp + 0x384]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43f737
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x388]
push edx
lea esi, [ebp + 0x104]
call fcn.00401760
mov eax, dword [esp + 0x5a4]
push eax
push ebp
call fcn.00410a60
cmp byte [esp + 0x5a4], 0
jne 0x43f78e
mov ecx, dword [ebp + 0x98]
test ecx, ecx
je 0x43f784
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [ebp + 0x98], 0
cmp dword [esp + 0x28], 8
jb 0x43f7a2
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x590]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x57c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x58c
ret 8
Function at 0x4407f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f5bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x34]
sub eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
sub ecx, dword [edi + 0x28]
push eax
push ecx
xor esi, esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetRect]
push 0x108
call fcn.004c8f3d
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], esi
cmp eax, esi
je 0x440858
push 7
push esi
push eax
call fcn.0042bd70
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x14]
sub edx, ecx
push edx
mov dword [edi + 0x98], esi
call fcn.00410b30
mov ecx, dword [edi + 0x98]
call fcn.0042c3c0
mov esi, dword [edi + 0x98]
call fcn.00410cb0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret