joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52bcd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.004f6590
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x52be38
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x52bd4c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x52bdb1
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x52bd70
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x52bddd
mov eax, dword [esi + 4]
push 1
push 0x5ff9dc
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5ff9dd
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x52bdb6
push dword [esp + 0x28]
call fcn.004f6590
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x52be08
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x6c4004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x52dbb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1001c
call fcn.005918e0
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x62b8e8
push eax
call fcn.0052e450
add esp, 8
mov dword [ebp - 0x10018], eax
test eax, eax
jne 0x52dbf7
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590be8
mov esp, ebp
pop ebp
ret
push ebx
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.005ba65b
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x52ddb3
push edi
nop word [eax + eax]
test esi, esi
je 0x52dd8c
mov edx, dword [esi + 0x14]
mov eax, edx
mov edi, dword [esi + 0x10]
sub eax, edi
mov dword [ebp - 0x1001c], edi
mov dword [ebp - 0x1000c], edx
cmp ebx, eax
ja 0x52dc6d
lea eax, [edi + ebx]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x52dc51
mov eax, dword [esi]
add edi, eax
lea eax, [ebp - 0x10004]
push ebx
push eax
push edi
call fcn.005a8fc0
add esp, 0xc
mov byte [edi + ebx], 0
jmp 0x52dd8c
mov eax, accept
sub eax, edi
cmp eax, ebx
jb 0x52ddd3
lea ecx, [edi + ebx]
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x52dc91
mov ecx, accept
jmp 0x52dcbe
mov eax, edx
shr eax, 1
mov dword [ebp - 0x10008], eax
mov eax, accept
sub eax, dword [ebp - 0x10008]
cmp edx, eax
jbe 0x52dcb1
mov ecx, accept
jmp 0x52dcbe
mov eax, dword [ebp - 0x10008]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x10008], ecx
push eax
mov ecx, esi
call fcn.004047a1
lea ecx, [edi + ebx]
mov dword [ebp - 0x10014], eax
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp - 0x10008]
mov dword [esi + 0x14], ecx
lea ecx, [eax + edi]
mov dword [ebp - 0x10008], ecx
add ecx, ebx
cmp dword [ebp - 0x1000c], 0x10
mov dword [ebp - 0x10010], ecx
jb 0x52dd5d
push dword [ebp - 0x1001c]
mov edi, dword [esi]
push edi
push eax
call fcn.005a8a40
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005a8a40
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov ecx, dword [ebp - 0x1000c]
inc ecx
mov byte [eax], 0
cmp ecx, 0x1000
jb 0x52dd51
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x52ddd8
mov edi, edx
push ecx
push edi
call fcn.00590bf9
add esp, 8
jmp 0x52dd84
push edi
push esi
push eax
call fcn.005a8a40
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005a8a40
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov byte [eax], 0
mov eax, dword [ebp - 0x10014]
mov dword [esi], eax
push dword [ebp - 0x10018]
lea eax, [ebp - 0x10004]
push 0x10000
push 1
push eax
call fcn.005ba65b
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x52dc20
pop edi
push dword [ebp - 0x10018]
call fcn.005b90c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop ebx
pop esi
call fcn.00590be8
mov esp, ebp
pop ebp
ret
call fcn.0040470b
call fcn.005acd68
int3
Function at 0x52e590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed628
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6c45ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x52e5c0
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor esi, esi
mov dword [ebp + 8], esi
test edi, edi
je 0x52e5fd
lea ecx, [ebp + 8]
call fcn.0052dfd0
cmp edi, 0xffffffff
je 0x52e5fa
mov esi, edi
mov dword [ebp + 8], esi
call fcn.00535790
jmp 0x52e5fd
mov esi, dword [ebp + 8]
test esi, esi
je 0x52e620
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x52e620
mov esi, dword [ebp - 0x10]
cmp esi, edi
je 0x52e623
or esi, 0xffffffff
lea ecx, [ebp + 8]
mov dword [ebp - 4], 6
call fcn.0052dfd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x52ff40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed8bf
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x6ca55c], 0
je 0x52ff7a
xor al, al
jmp 0x530039
push 0x18
call fcn.00590c07
mov edi, eax
add esp, 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x52ffca
lea eax, [ebp - 0x29]
mov ecx, edi
push eax
push 1
call fcn.0052f250
lea esi, [edi + 0xc]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x34], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040c387
mov dword [esi], eax
mov dword [edi + 0x14], 1
jmp 0x52ffcc
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x6ca55c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x530000
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b566
mov ecx, dword [0x6ca55c]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 2
call fcn.00530670
lea ecx, [ebp - 0x28]
call fcn.0040b6a9
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00590be8
mov esp, ebp
pop ebp
ret
Function at 0x530670
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push ecx
push 3
push eax
call fcn.0052ed90
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x530703
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 4], 0
push esi
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00530180
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x530739
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x53072f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x530756
push edx
push ecx
call fcn.00590bf9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00590be8
mov esp, ebp
pop ebp
ret 4
call fcn.005acd68
int3
Function at 0x536160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5edf7c
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x6c45ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [0x6ca594], 1
mov esi, dword [ebp + 0xc]
jne 0x5361df
call fcn.005312e0
cmp eax, 3
jg 0x5361df
test esi, esi
jne 0x5361df
push 3
push 0x96
push str.c:usersqishaodesktop360pic_basewin_registry.cc
lea ecx, [ebp - 0xc8]
call fcn.00530760
add eax, 8
mov dword [ebp - 4], esi
push str.Check_failed:_out_value.
mov ebx, 1
push eax
mov dword [ebp - 0x18], ebx
call fcn.0040923f
add esp, 8
test bl, 1
je 0x5361ef
lea ecx, [ebp - 0xc8]
call fcn.00530a10
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], 4
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x53623b
mov ecx, dword [ebp + 0xc]
cmp ecx, 4
je 0x536230
cmp ecx, 3
jne 0x536251
cmp dword [ebp - 0x10], 4
jne 0x536251
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5369d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee02a
mov eax, dword fs:[0]
push eax
sub esp, 0x148
push esi
mov eax, dword [0x6c45ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x536acb
push 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.00407699
push 0x65bd3c
push 0xffffffffffffffff
push str._vs.
push dword [esi]
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0
push 0x5ffce8
push str.slot_____DWORD_0xFFFFFFFF_
push eax
call fcn.0040923f
add esp, 8
push eax
call fcn.0040923f
add esp, 8
mov ecx, eax
call fcn.00530ec0
push eax
call fcn.0040923f
add esp, 8
mov ecx, eax
call fcn.00530ec0
push eax
call fcn.0040923f
push 0x18
call fcn.00590c07
add esp, 0xc
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x536a95
push eax
lea ecx, [ebp - 0xa4]
call fcn.00407641
mov esi, eax
jmp 0x536a97
xor esi, esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.00406a8f
test esi, esi
je 0x536acb
push esi
push 0x12
push str.c:usersqishaodesktop360pic_base_threading_thread_local_win.cc
lea ecx, [ebp - 0x154]
call fcn.00530900
lea ecx, [ebp - 0x154]
call fcn.00530a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x536b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ee072
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], 0
cmp eax, 3
je 0x536bd8
test eax, eax
jne 0x536cec
mov eax, dword [0x6c41f4]
cmp eax, 0xffffffff
je 0x536cec
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x536cec
lea eax, [ebp - 0x110]
mov ecx, 0x40
push eax
push dword [0x6c41f4]
mov esi, ebx
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00590e55
add esp, 4
mov edi, 0x40
nop word [eax + eax]
mov esi, dword [0x6cb140]
xor dl, dl
test esi, esi
jle 0x536c6e
nop dword [eax]
mov ecx, dword [ebp + esi*4 - 0x110]
test ecx, ecx
je 0x536c69
mov eax, dword [esi*4 + 0x6cb148]
test eax, eax
je 0x536c69
push ecx
mov dword [ebp + esi*4 - 0x110], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x536c40
dec edi
test edi, edi
jle 0x536c79
test dl, dl
jne 0x536c30
jmp 0x536cde
cmp dword [0x6ca594], 1
jne 0x536cc8
call fcn.005312e0
cmp eax, 3
jg 0x536cc8
push 3
push 0x8d
push str.c:usersqishaodesktop360pic_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0x1c4]
call fcn.00530760
add eax, 8
mov dword [ebp - 4], 0
push str.Check_failed:_false.
mov ebx, 1
push eax
mov dword [ebp - 0x114], ebx
call fcn.0040923f
add esp, 8
jmp 0x536cce
mov ebx, dword [ebp - 0x114]
test bl, 1
je 0x536cde
lea ecx, [ebp - 0x1c4]
call fcn.00530a10
push 0
push dword [0x6c41f4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00590be8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x539629
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
mov eax, dword [esi + 8]
mov byte [esi + 0x13], cl
test eax, eax
je 0x5396a2
test cl, cl
je 0x53964b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5396a2
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
mov edx, 0x10000000
test edx, ecx
jne 0x53966c
mov byte [esi + 0x10], 1
jmp 0x53967c
and eax, 0x21000000
neg eax
sbb al, al
and al, 0xfe
add al, 7
mov byte [esi + 0x10], al
and ecx, 0x31000000
cmp ecx, edx
jne 0x5396a2
push 4
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, esi
call sym.360huabao.exe_protected:_void___thiscall_DuiLib::CShadowUI::Update_struct_HWND____
pop esi
pop ebp
ret 4
Function at 0x53b8e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
mov ecx, eax
mov dword [ebp - 0x214], edx
push esi
mov esi, dword [ebp + 0xc]
shr ecx, 0x10
push edi
test cx, cx
je 0x53b94c
cmp word [eax], 0x3c
lea ebx, [edx + 0x28]
mov ecx, ebx
jne 0x53b93e
push eax
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CMarkup::Load_wchar_t_const__
test al, al
jne 0x53b9b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00590be8
leave
ret 8
push 0
push eax
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CMarkup::LoadFromFile_wchar_t_const___int_
test al, al
je 0x53b92b
jmp 0x53b9b0
push esi
push eax
call sym.360huabao.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x53b92b
push edi
call sym.360huabao.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push edi
test ebx, ebx
jne 0x53b97c
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x53b92b
call sym.360huabao.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [ebp - 0x214]
push 0
push esi
add ebx, 0x28
push eax
mov ecx, ebx
call sym.360huabao.exe_public:_bool___thiscall_DuiLib::CMarkup::LoadFromMem_unsigned_char___unsigned_long_int__int_
test al, al
je 0x53b92b
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call sym.360huabao.exe_public:_class_DuiLib::CMarkupNode___thiscall_DuiLib::CMarkup::GetRoot_void_
sub esp, 0x20c
mov esi, eax
mov edi, esp
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x214]
call sym.360huabao.exe_public:_int___thiscall_DuiLib::CResourceManager::LoadResource_class_DuiLib::CMarkupNode_
jmp 0x53b92d
Function at 0x53d3ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6c45ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.005a88e0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00590be8
leave
ret

Function at 0x53e73e
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x53e761
or esi, 1
push 2
call edi
test ax, ax
jns 0x53e76d
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x53e779
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x53e785
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x5434b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x5434e1
cmp esi, dword [edi + 0x108]
je 0x5434e1
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x5435c7
test eax, eax
je 0x543548
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x17
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x14c]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x108]
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
and dword [edi + 0x108], 0
test esi, esi
je 0x5435c7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x5435c7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10c]
test al, al
je 0x5435c7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x118]
test al, al
je 0x5435c7
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x14c]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x108]
call sym.360huabao.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
leave
ret 4
Function at 0x54b7f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x54b8a3
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x54b8a7
cmp dword [ebp - 0x1c], 0x10
jne 0x54b872
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x54b872
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call sym.360huabao.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
pop ecx
test al, al
jne 0x54b894
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x54b8a7
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x54b83f
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x54b8c5
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x54b8ca
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x54b8fc
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8