joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100316f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1003178e
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp byte [ebp - 1], 0
jne 0x10031743
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
jmp 0x10031790
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100324f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1019742c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.10023620
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032626
mov eax, dword [ebp - 0x30]
add eax, 2
push eax
call fcn.100fa6f6
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100e0740
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0
push 0
lea ecx, [ebp + 8]
call fcn.10023620
push eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100325fd
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.10019320
mov edx, dword [ebp - 0x30]
add edx, 1
shr edx, 1
push edx
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.10032370
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.10019340
lea ecx, [ebp - 0x28]
call fcn.10023ac0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100fa701
add esp, 4
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10023ac0
mov eax, dword [ebp - 0x3c]
jmp 0x10032650
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100fa701
add esp, 4
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10023ac0
mov eax, dword [ebp - 0x40]
jmp 0x10032650
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10023ac0
mov eax, dword [ebp - 0x44]
jmp 0x10032650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3069
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10032bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2e0
je 0x10032be5
cmp dword [ebp - 0x10], 0x4d2
je 0x10032bd6
jmp 0x10032cb9
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10032cb9
cmp dword [0x1019d95c], 0xffffffff
je 0x10032c29
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x1019d95c]
cmp ecx, 0x64
jae 0x10032c1e
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x10032ccd
mov edx, dword [ebp - 0x14]
mov dword [0x1019d95c], edx
jmp 0x10032c34
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019d95c], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push 0x14
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10032cb9
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10033050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x113
je 0x1003308e
cmp dword [ebp - 0x10], 0x2e0
je 0x100330b8
cmp dword [ebp - 0x10], 0x4d2
je 0x1003307f
jmp 0x1003318d
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1003318d
push 0x463
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp + 0xc], 0x463
jne 0x100330b3
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1003318d
cmp dword [0x1019d960], 0xffffffff
je 0x100330fc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [0x1019d960]
cmp eax, 0x64
jae 0x100330f1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x100331a1
mov ecx, dword [ebp - 0x14]
mov dword [0x1019d960], ecx
jmp 0x10033107
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019d960], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x1003318d
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003a840
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120946
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x1019742c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], ecx
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], 0
push 0x1014d0b0
mov ecx, dword [ebp - 0x128]
call sym.UserAndPayClient.dll_public:_bool___thiscall_xx_DuiLib::CDuiString::operator_wchar_t_const__const
mov byte [ebp - 0x119], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
movzx edx, byte [ebp - 0x119]
test edx, edx
je 0x1003a8ef
push 0
mov ecx, dword [ebp - 0x120]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1003a97a
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 4], 1
push str.buyVip
mov ecx, dword [ebp - 0x130]
call sym.UserAndPayClient.dll_public:_bool___thiscall_xx_DuiLib::CDuiString::operator_wchar_t_const__const
mov byte [ebp - 0x11a], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
movzx edx, byte [ebp - 0x11a]
test edx, edx
je 0x1003a97a
push 0
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov ecx, dword [ebp - 0x120]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3069
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b120
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2e0
je 0x1003b13d
jmp 0x1003b211
cmp dword [0x1019d97c], 0xffffffff
je 0x1003b181
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x1019d97c]
cmp ecx, 0x64
jae 0x1003b176
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x1003b225
mov edx, dword [ebp - 0x10]
mov dword [0x1019d97c], edx
jmp 0x1003b18c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019d97c], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push 0x14
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x1003b211
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003c680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x1003c76b
cmp dword [0x1019d980], 0xffffffff
je 0x1003c6da
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x1019d980]
cmp eax, 0x64
jae 0x1003c6cf
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x1003c77f
mov ecx, dword [ebp - 0x10]
mov dword [0x1019d980], ecx
jmp 0x1003c6e5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019d980], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x1003c76b
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100402e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1019742c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.mshtml.dll]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x1014ee64]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x1014ee68]
mov dword [ebp - 0x14], edx
mov eax, dword [0x1014ee6c]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1014ee70]
mov dword [ebp - 0xc], ecx
mov dx, word [0x1014ee74]
mov word [ebp - 8], dx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1004041e
mov edx, dword [ebp - 0x28]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1004041e
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10040414
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x1014ee78
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10040414
cmp dword [ebp - 0x30], 0
je 0x10040414
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e3069
mov esp, ebp
pop ebp
ret
Function at 0x10046bc0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.UserAndPayClient.dll_public:_static_void___cdecl_Talk2Svr::CTalk2Svr::CopyTwoTag_struct_tag_Check_Vip_Info___struct_tag_Check_Vip_Info__
add esp, 8
mov edx, dword [ebp - 4]
add edx, 0xd0
push edx
mov eax, dword [ebp - 4]
add eax, 0xb8
push eax
call fcn.1001a8f0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10046c27
mov edx, dword [ebp - 4]
add edx, 0xb8
push edx
mov eax, dword [ebp - 4]
add eax, 0xa0
push eax
call fcn.1001a930
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10046c27
mov edx, dword [ebp - 4]
mov byte [edx + 0x3f5], 1
jmp 0x10046c31
mov eax, dword [ebp - 4]
mov byte [eax + 0x3f5], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3c0], 0
jne 0x10046c4f
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0xc8
jne 0x10046cb8
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3ec], 0
jne 0x10046c7d
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3ec], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x10042f10
push 0
push 0
call fcn.10100991
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c0], eax
push 0
push 0
push 0x5f4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esp, ebp
pop ebp
ret 4
Function at 0x10047570
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x10046ee0
push 0
push 0
call fcn.10100991
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3e8], eax
mov esp, ebp
pop ebp
ret

Function at 0x100478a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122620
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x1019742c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], 0
mov dword [ebp - 4], 1
mov al, byte [0x1014617b]
mov byte [ebp - 0x810], al
push 0x7ff
push 0
lea ecx, [ebp - 0x80f]
push ecx
call fcn.100e0740
add esp, 0xc
mov ecx, dword [ebp - 0x830]
add ecx, 0x428
call fcn.10023550
push eax
push 0x800
lea edx, [ebp - 0x810]
push edx
push 0x1014618d
lea ecx, [ebp + 0x24]
call fcn.10023550
push eax
lea ecx, [ebp + 0xc]
call fcn.10023550
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.10022500
lea ecx, [ebp - 0x828]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1001e4f0
mov edx, dword [ebp - 0x82c]
or edx, 1
mov dword [ebp - 0x82c], edx
lea ecx, [ebp - 0x828]
call fcn.100238b0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.100238b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.100238b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3069
mov esp, ebp
pop ebp
ret 0x34
Function at 0x10048ab0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x370
call fcn.10023550
push eax
push str.m_strQQ:_s
call fcn.10020a00
add esp, 8
mov ecx, dword [ebp - 4]
add ecx, 0x370
call fcn.100192c0
movzx eax, al
test eax, eax
jne 0x10048b0c
push 1
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x370
call fcn.10023550
push eax
push 0x10150484
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x10048b3a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3c4], 0
je 0x10048b3a
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x10048a60
push 0
push 0
call fcn.10100991
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c4], eax
mov esp, ebp
pop ebp
ret