joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52d7c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.004f8080
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x52d928
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x52d83c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x52d8a1
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x52d860
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x52d8cd
mov eax, dword [esi + 4]
push 1
push 0x6019dc
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6019dd
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x52d8a6
push dword [esp + 0x28]
call fcn.004f8080
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x52d8f8
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x6c7004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x52f6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1001c
call fcn.005933d0
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x62d8e0
push eax
call fcn.0052ff40
add esp, 8
mov dword [ebp - 0x10018], eax
test eax, eax
jne 0x52f6e7
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005926d8
mov esp, ebp
pop ebp
ret
push ebx
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.005bc14b
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x52f8a3
push edi
nop word [eax + eax]
test esi, esi
je 0x52f87c
mov edx, dword [esi + 0x14]
mov eax, edx
mov edi, dword [esi + 0x10]
sub eax, edi
mov dword [ebp - 0x1001c], edi
mov dword [ebp - 0x1000c], edx
cmp ebx, eax
ja 0x52f75d
lea eax, [edi + ebx]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x52f741
mov eax, dword [esi]
add edi, eax
lea eax, [ebp - 0x10004]
push ebx
push eax
push edi
call fcn.005aaab0
add esp, 0xc
mov byte [edi + ebx], 0
jmp 0x52f87c
mov eax, accept
sub eax, edi
cmp eax, ebx
jb 0x52f8c3
lea ecx, [edi + ebx]
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x52f781
mov ecx, accept
jmp 0x52f7ae
mov eax, edx
shr eax, 1
mov dword [ebp - 0x10008], eax
mov eax, accept
sub eax, dword [ebp - 0x10008]
cmp edx, eax
jbe 0x52f7a1
mov ecx, accept
jmp 0x52f7ae
mov eax, dword [ebp - 0x10008]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x10008], ecx
push eax
mov ecx, esi
call fcn.004047a1
lea ecx, [edi + ebx]
mov dword [ebp - 0x10014], eax
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp - 0x10008]
mov dword [esi + 0x14], ecx
lea ecx, [eax + edi]
mov dword [ebp - 0x10008], ecx
add ecx, ebx
cmp dword [ebp - 0x1000c], 0x10
mov dword [ebp - 0x10010], ecx
jb 0x52f84d
push dword [ebp - 0x1001c]
mov edi, dword [esi]
push edi
push eax
call fcn.005aa530
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005aa530
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov ecx, dword [ebp - 0x1000c]
inc ecx
mov byte [eax], 0
cmp ecx, 0x1000
jb 0x52f841
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x52f8c8
mov edi, edx
push ecx
push edi
call fcn.005926e9
add esp, 8
jmp 0x52f874
push edi
push esi
push eax
call fcn.005aa530
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005aa530
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov byte [eax], 0
mov eax, dword [ebp - 0x10014]
mov dword [esi], eax
push dword [ebp - 0x10018]
lea eax, [ebp - 0x10004]
push 0x10000
push 1
push eax
call fcn.005bc14b
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x52f710
pop edi
push dword [ebp - 0x10018]
call fcn.005babb0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop ebx
pop esi
call fcn.005926d8
mov esp, ebp
pop ebp
ret
call fcn.0040470b
call fcn.005ae858
int3
Function at 0x530080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef458
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c75ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x5300b0
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor esi, esi
mov dword [ebp + 8], esi
test edi, edi
je 0x5300ed
lea ecx, [ebp + 8]
call fcn.0052fac0
cmp edi, 0xffffffff
je 0x5300ea
mov esi, edi
mov dword [ebp + 8], esi
call fcn.00537280
jmp 0x5300ed
mov esi, dword [ebp + 8]
test esi, esi
je 0x530110
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x530110
mov esi, dword [ebp - 0x10]
cmp esi, edi
je 0x530113
or esi, 0xffffffff
lea ecx, [ebp + 8]
mov dword [ebp - 4], 6
call fcn.0052fac0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x531a30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef6ef
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x6cd5ac], 0
je 0x531a6a
xor al, al
jmp 0x531b29
push 0x18
call fcn.005926f7
mov edi, eax
add esp, 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x531aba
lea eax, [ebp - 0x29]
mov ecx, edi
push eax
push 1
call fcn.00530d40
lea esi, [edi + 0xc]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x34], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040c38a
mov dword [esi], eax
mov dword [edi + 0x14], 1
jmp 0x531abc
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x6cd5ac], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x531af0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b566
mov ecx, dword [0x6cd5ac]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 2
call fcn.00532160
lea ecx, [ebp - 0x28]
call fcn.0040b6ac
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005926d8
mov esp, ebp
pop ebp
ret
Function at 0x532160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push ecx
push 3
push eax
call fcn.00530880
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5321f3
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 4], 0
push esi
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00531c70
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x532229
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x53221f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x532246
push edx
push ecx
call fcn.005926e9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005926d8
mov esp, ebp
pop ebp
ret 4
call fcn.005ae858
int3
Function at 0x537c50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efdac
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x6c75ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [0x6cd5e4], 1
mov esi, dword [ebp + 0xc]
jne 0x537ccf
call fcn.00532dd0
cmp eax, 3
jg 0x537ccf
test esi, esi
jne 0x537ccf
push 3
push 0x96
push str.c:usersqishaodesktop360pic_basewin_registry.cc
lea ecx, [ebp - 0xc8]
call fcn.00532250
add eax, 8
mov dword [ebp - 4], esi
push str.Check_failed:_out_value.
mov ebx, 1
push eax
mov dword [ebp - 0x18], ebx
call fcn.0040923f
add esp, 8
test bl, 1
je 0x537cdf
lea ecx, [ebp - 0xc8]
call fcn.00532500
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], 4
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x537d2b
mov ecx, dword [ebp + 0xc]
cmp ecx, 4
je 0x537d20
cmp ecx, 3
jne 0x537d41
cmp dword [ebp - 0x10], 4
jne 0x537d41
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5384c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efe5a
mov eax, dword fs:[0]
push eax
sub esp, 0x148
push esi
mov eax, dword [0x6c75ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x5385bb
push 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.00407699
push 0x65e30c
push 0xffffffffffffffff
push str._vs.
push dword [esi]
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0
push 0x601ce8
push str.slot_____DWORD_0xFFFFFFFF_
push eax
call fcn.0040923f
add esp, 8
push eax
call fcn.0040923f
add esp, 8
mov ecx, eax
call fcn.005329b0
push eax
call fcn.0040923f
add esp, 8
mov ecx, eax
call fcn.005329b0
push eax
call fcn.0040923f
push 0x18
call fcn.005926f7
add esp, 0xc
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x538585
push eax
lea ecx, [ebp - 0xa4]
call fcn.00407641
mov esi, eax
jmp 0x538587
xor esi, esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.00406a8f
test esi, esi
je 0x5385bb
push esi
push 0x12
push str.c:usersqishaodesktop360pic_base_threading_thread_local_win.cc
lea ecx, [ebp - 0x154]
call fcn.005323f0
lea ecx, [ebp - 0x154]
call fcn.00532500
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x538680
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efea2
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], 0
cmp eax, 3
je 0x5386c8
test eax, eax
jne 0x5387dc
mov eax, dword [0x6c71f4]
cmp eax, 0xffffffff
je 0x5387dc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x5387dc
lea eax, [ebp - 0x110]
mov ecx, 0x40
push eax
push dword [0x6c71f4]
mov esi, ebx
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00592945
add esp, 4
mov edi, 0x40
nop word [eax + eax]
mov esi, dword [0x6ce190]
xor dl, dl
test esi, esi
jle 0x53875e
nop dword [eax]
mov ecx, dword [ebp + esi*4 - 0x110]
test ecx, ecx
je 0x538759
mov eax, dword [esi*4 + 0x6ce198]
test eax, eax
je 0x538759
push ecx
mov dword [ebp + esi*4 - 0x110], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x538730
dec edi
test edi, edi
jle 0x538769
test dl, dl
jne 0x538720
jmp 0x5387ce
cmp dword [0x6cd5e4], 1
jne 0x5387b8
call fcn.00532dd0
cmp eax, 3
jg 0x5387b8
push 3
push 0x8d
push str.c:usersqishaodesktop360pic_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0x1c4]
call fcn.00532250
add eax, 8
mov dword [ebp - 4], 0
push str.Check_failed:_false.
mov ebx, 1
push eax
mov dword [ebp - 0x114], ebx
call fcn.0040923f
add esp, 8
jmp 0x5387be
mov ebx, dword [ebp - 0x114]
test bl, 1
je 0x5387ce
lea ecx, [ebp - 0x1c4]
call fcn.00532500
push 0
push dword [0x6c71f4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005926d8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53b119
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
mov eax, dword [esi + 8]
mov byte [esi + 0x13], cl
test eax, eax
je 0x53b192
test cl, cl
je 0x53b13b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x53b192
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
mov edx, 0x10000000
test edx, ecx
jne 0x53b15c
mov byte [esi + 0x10], 1
jmp 0x53b16c
and eax, 0x21000000
neg eax
sbb al, al
and al, 0xfe
add al, 7
mov byte [esi + 0x10], al
and ecx, 0x31000000
cmp ecx, edx
jne 0x53b192
push 4
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, esi
call sym.360huabao.exe_protected:_void___thiscall_DuiLib::CShadowUI::Update_struct_HWND____
pop esi
pop ebp
ret 4
Function at 0x53d3d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
mov ecx, eax
mov dword [ebp - 0x214], edx
push esi
mov esi, dword [ebp + 0xc]
shr ecx, 0x10
push edi
test cx, cx
je 0x53d43c
cmp word [eax], 0x3c
lea ebx, [edx + 0x28]
mov ecx, ebx
jne 0x53d42e
push eax
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CMarkup::Load_wchar_t_const__
test al, al
jne 0x53d4a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005926d8
leave
ret 8
push 0
push eax
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CMarkup::LoadFromFile_wchar_t_const___int_
test al, al
je 0x53d41b
jmp 0x53d4a0
push esi
push eax
call sym.360huabao.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x53d41b
push edi
call sym.360huabao.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push edi
test ebx, ebx
jne 0x53d46c
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x53d41b
call sym.360huabao.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [ebp - 0x214]
push 0
push esi
add ebx, 0x28
push eax
mov ecx, ebx
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CMarkup::LoadFromMem_unsigned_char___unsigned_long_int__int_
test al, al
je 0x53d41b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call sym.360huabao.exe_public:_class_DuiLib::CMarkupNode___thiscall_DuiLib::CMarkup::GetRoot_void_
sub esp, 0x20c
mov esi, eax
mov edi, esp
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x214]
call sym.360huabao.exe_public:_int___thiscall_DuiLib::CResourceManager::LoadResource_class_DuiLib::CMarkupNode_
jmp 0x53d41d
Function at 0x53eeaa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.005aa3d0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005926d8
leave
ret

Function at 0x54022e
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x540251
or esi, 1
push 2
call edi
test ax, ax
jns 0x54025d
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x540269
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x540275
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x544fa5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x544fd1
cmp esi, dword [edi + 0x108]
je 0x544fd1
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x5450b7
test eax, eax
je 0x545038
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x17
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x14c]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x108]
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
and dword [edi + 0x108], 0
test esi, esi
je 0x5450b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x5450b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x5450b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x118]
test al, al
je 0x5450b7
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x14c]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x108]
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
leave
ret 4
Function at 0x54d2e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x54d393
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x54d397
cmp dword [ebp - 0x1c], 0x10
jne 0x54d362
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x54d362
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call sym.360huabao.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
pop ecx
test al, al
jne 0x54d384
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x54d397
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x54d32f
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x54d3b5
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x54d3ba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x54d3ec
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8