joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9208ea
Capabilities:
Encode data using base64

Disassembly:
pop ebx
mov ebx, dword [esp + 8]
jmp 0x926fd5

Function at 0x922d37
Capabilities:
Encode data using base64

Disassembly:
push ecx
mov ecx, 0x8b12e5a1
test ecx, 0x7e85398d
mov dword [esp + 8], 0xd90261d3
mov ecx, dword [esp + ecx + 0x74ed1a5f]
js 0x922d46
call fcn.00922d37
jbe 0x90acfc
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.00d0bd52

Function at 0x96dd31
Capabilities:
Encode data using base64

Disassembly:
sub ebp, 2
push 0xe30bb02
push 0x960bb28d
mov word [ebp], dx
lea esp, [esp + 0xc]
jmp fcn.008924f9

Function at 0x96fcf4
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], dx
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0x971151
Capabilities:
Encode data using base64

Disassembly:
mov ebx, dword [esp + ebx - 0x49605c25]
lea esp, [esp + 0xc]
jmp fcn.008924f9

Function at 0x972705
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 8]
jmp fcn.009715e0
mov ax, word [edx + eax - 0x6031c0]
sbb ebp, 2
mov word [ebp], ax
jmp 0x8ce33d
jmp fcn.008924f9
mov edx, 0x7201ce2e
lea edi, [edi + edx - 0x7201ce2f]
movzx edx, byte [edx + edi - 0x7201ce2e]
pop eax
xor dl, bl
mov eax, 0x1f96098b
sal eax, 0xd
ror dl, 1
bswap eax
sub dl, 0xd
neg dl
ror al, 5
not dl
adc al, al
shl al, 0xa1
and al, ah
xor bl, dl
add edx, esp
and eax, eax
sal al, 0x82
jae 0x8cdf40
jmp 0x87ae1c

Function at 0x99e2c1
Capabilities:
Encode data using base64

Disassembly:
not dl
rol dl, 1
not byte [esp + eax - 0x71363ff9]
rol ax, 0x41
rol eax, 0x75
sbb dl, 0x16
xor bl, dl
call fcn.00d41025
cmp cx, 0x5521
Function at 0x9b60ca
Capabilities:
Encode data using xor

Disassembly:
call fcn.007fda46
mov eax, 0x1aa90b8c
or al, al
mov edx, dword [ebp + eax - 0x1aa90b8c]
rol eax, 3
mov al, byte [ebp + 4]
call fcn.00d480f6
call fcn.00895e04
mov edx, dword [edi]
mov cl, byte [edi + 4]
dec dword [ebx + 0x44f8a17]
add edi, 6
call fcn.00d527d5
mov dword [esp], 0x2fbac693
lea esp, [esp + 4]
je 0x99c531
movzx ecx, byte [edi]
jmp 0x85f616
popfd
lea esp, [esp + 0x10]
call fcn.00806e59
mov dword [0x9035a824], eax
test al, 0x46
xchg ebx, eax
xchg edi, eax
stosb byte es:[edi], al
loope 0x8c7ed6
mov ch, 0x56
push esi
psubusw mm1, qword [edx - 0x2bc94310]
jo 0x8c7f68
pop ds
retf
wait
jmp 0x8c7eda
loope 0x8c7f57
sbb al, 0xb2
jge 0x8c7f90
jge 0x8c7f30
xchg ebx, eax
shl dword [ecx], 1
lodsd eax, dword [esi]
xor eax, ebp
loope 0x8c7fc4
pop ds
mov es, word [ebx]
jmp 0x7e9c42b
salc
dec ebp
add eax, 0x1eedb3da
out dx, eax
push esp
inc edx
adc byte [ebx], ch
xchg edx, eax
adc al, 7
insb byte es:[edi], dx
insd dword es:[edi], dx
sub al, 0xe9
xor eax, 0x969b9a8d
invalid
scasb al, byte es:[edi]
mov ebx, 0xd445511
out 0xa4, eax
push 0x63
or dword [ecx + 0x78fb91e8], edi
xchg esi, eax
invalid
jmp 0x9af094
push 0xef3e9694
not edx
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.00889a15
push edx
pushfd
mov edx, 0x95a7e416
lea edx, [edx*4 - 0x75e2e877]
shl dl, 0x56
mov dword [esp + 8], 0x3f1303ef
mov edx, dword [esp + edx*2 + 0x3e86b204]
jne 0x8c7f19
call fcn.00cb45e5
sbb dword [ebp - 0x66], ebp
mov bh, 0xb7
shr dword [ebx - 0x4a683b74], 1
cld
jecxz 0x9b60d1
out dx, al
mov byte [edx], ah
add eax, 0xfdb44e1d
ljmp 0x8cd4

Function at 0xcbd73e
Capabilities:
Encode data using base64

Disassembly:
mov byte [esp + 2], 0xc
lea esp, [esp + 0x10]
jmp fcn.008924f9
sub ebp, 2
push 0xf5348000
mov word [ebp], ax
jmp 0x992f96

Function at 0xcd3131
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0xcd89d8
Capabilities:
Encode data using base64

Disassembly:
mov edx, ebp
sbb ebp, 4
mov dword [ebp], edx
lea esp, [esp + 4]
jmp fcn.008924f9

Function at 0xce9b3d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0xcfa461
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0x80
xor bl, dl
jmp 0x815e5c

Function at 0xd00cb9
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], esi
lea esp, [esp + 0x10]
jmp fcn.008924f9

Function at 0xd018b1
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jmp fcn.008924f9
mov bp, word [ebp]
jmp 0x903ed2

Function at 0xd1db25
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0xd1dcfb
Capabilities:
Encode data using base64

Disassembly:
xor cl, bl
not cl
sub cl, 0xb
not cl
xor cl, 0x80
xor bl, cl
sub ebp, 2
mov word [ebp], cx
push 0xb4ad3413
lea esp, [esp + 8]
jmp fcn.008924f9
Function at 0xd27592
Capabilities:
Link function at runtime on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x89c140
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x87686b
push ebp
dec dh
add bp, sp
mov ebp, esp
xor dx, si
mov edx, dword [ebp + 8]
stc
sub esp, 0x114
push esi
cmp dh, 5
test edx, edx
jmp 0xd1fe89

Function at 0xd2aa16
Capabilities:
Encode data using base64

Disassembly:
sub ebp, 4
mov dword [ebp], eax
lea esp, [esp + 8]
jmp fcn.008924f9

Function at 0xd42593
Capabilities:
Encode data using base64

Disassembly:
inc esi
mov esi, dword [eax]
sal dword [esp + 1], 0x8a
sbb ebp, 4
mov dword [ebp], esi
lea esp, [esp + 8]
jmp fcn.008924f9
add al, 0x1e
rol al, 1
lea esi, [esi + esi*2 + 0x5d26fe10]
mov dword [esp], esi
not al
mov dword [esp + 4], esi
sub dword [esp], esi
not byte [esp + 5]
xor bl, al
lea eax, [esp + eax + 8]
jmp 0x96d3f0

Function at 0xd4ae2d
Capabilities:
Encode data using xor

Disassembly:
mov word [esi], dx
lea esp, [esp + 8]
jmp 0xcaf4b8
neg dword [esp]
sub esi, 2
push 0x43be3bc
jmp 0x972684
dec esi
test al, 0xda
mov esi, 0x89977937
invalid
xchg esp, eax
xchg esp, eax
test al, 0x13
mov dword [esp + edx*4 - 0x4c74ec58], edx
rol al, 1
not al
mov esi, dword [ebx - 0x2f093f30]
xchg dword [esp + edx*2 - 0x263a762c], edx
xor bl, al
xadd dl, dh
not edx
lea eax, [esp + eax + 4]
mov dx, word [eax]
jno 0xcf83e6
push ebx
test al, ah
loop 0xd4ae26
jnp 0xd4ae58
sar dword [eax + 0x61], 1
xchg ebp, eax
shr dword [edi + 0x211fc331], cl
fild qword [esi + edx*8 + 0x12e6549a]
or al, 0x33
nop
fnsave dword [edi]
adc al, 0x25
adc ebx, dword [eax - 0x7b]
cwde
sbb eax, 0xf0149f59
xchg byte [ebx - 0x12a6d21e], al
loopne 0xd4ae7d
test byte [ebx - 0x1e], ah
sub eax, 0xf8e0ed59
adc byte [edx - 0x5d], al
cli
les ebp, [edi]
fsubr st(1), st(0)
jecxz 0xd4ae32
xchg edx, ebp
mov al, 0x18
outsb dx, byte [esi]
adc eax, 0x89eddcff
xchg esi, ebx
push ebp
lds ecx, [esi - 0x21]
invalid

Function at 0xd4afae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor ebx, ebp
sub dword [esp], 0x7809331
and ebx, 0xff
mov ebx, dword [ebx*4 + 0xcc90d0]
shr ebp, 8
xor ebp, ebx
inc edx
add byte [esp + 2], 0x31
shr word [esp + 2], 0x47
xor ebp, 0xb714c6b4
ror dword [esp], 0xd5
dec ecx
lea esp, [esp + 4]
jne 0xd4afc5
pop ebx
call fcn.008ab9e2
mov edi, 0xfd85bfb2
inc sp
mov esi, dword [ebx]
dec eax
add ebx, 2
jmp 0xcd5ed8
xor ebp, ebp
test ecx, ecx
mov dword [esp + 4], 0x89250585
lea esp, [esp + 8]
je 0xcf1604
push ebx
mov ebx, 0x4a0fec86
movzx ebx, byte [ebx + edx - 0x4a0fec86]
push 0x3f2f4f1e
jmp 0xcf15c7

Function at 0xd550ec
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], ax
push 0x7a13b9b0
lea esp, [esp + 0x10]
jmp fcn.008924f9
Function at 0x43be11
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43be3f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43be5d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043bd7b
jmp 0x43be5d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43be5d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043bd7b
test edi, edi
mov eax, edi
jne 0x43be47
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x465aec]
test ecx, ecx
je 0x43bf10
jmp 0x43be10
ret 8

Function at 0x404292
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404de1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x408460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
mov cl, byte [ebp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], edi
test cl, cl
jne 0x404365
mov dword [ebp + 0x28], edi
test eax, eax
je 0x404332
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x40431c
mov edi, eax
add ecx, 0x10
dec edx
jne 0x404314
mov dword [ebp + 0x28], edi
mov eax, 0x406784
cmp edi, 0x100000
ja 0x404335
lea eax, [ebp + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00404a32
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x40435b
push eax
call fcn.00404ac8
add esp, 4
mov dword [esi + 0x24], edi
push 0
call fcn.00404ac8
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00404a32
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4043b1
push 0x402640
push 0x402600
push ebx
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebx
call fcn.00404b8f
jmp 0x4043b3
xor edi, edi
mov eax, dword [esi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x4043e2
test eax, eax
je 0x4043df
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402640
push ecx
push 0x44
push eax
call fcn.00404b2c
push ebx
call fcn.00404ac8
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.00403ed2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x40c113
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40c157
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40c126
jmp 0x40c157
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40c147
pop esi
pop ebp
ret

Function at 0x40ceaf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40cee4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40cf0e
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40cf0e
test edi, edi
je 0x40cedb
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40cedb
test edi, edi
je 0x40cf16
mov eax, edi
jmp 0x40cedd
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40cedd
mov esi, 0xc7
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040fc18
add esp, 0xc
int3
Function at 0x40fc4c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestLinkedList.exe_gMozillaPoisonSize], eax
call fcn.0040ceaf
pop ecx
mov ecx, dword [sym.TestLinkedList.exe_gMozillaPoisonSize]
mov dword [sym.TestLinkedList.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40fc84
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestLinkedList.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x10021590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100215b4
xor eax, eax
jmp 0x10021634
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100215cb
xor eax, eax
jmp 0x10021634
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10021617
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10021617
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100215ee
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10021623
xor eax, eax
jmp 0x10021634
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10021631
xor eax, eax
jmp 0x10021634
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10023320
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120026
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1019742c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10022bf0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x20], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x24], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x28], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.10023290
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x4c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.10023290
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x64]
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x68]
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x6c]
mov dword [eax + 0x6c], edx
mov eax, dword [ebp + 8]
add eax, 0x70
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.10023290
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
add ecx, 0x88
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x88
call fcn.10023290
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa0]
mov dword [edx + 0xa0], ecx
mov edx, dword [ebp + 8]
add edx, 0xa4
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.10023290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbc]
mov dword [eax + 0xbc], edx
mov eax, dword [ebp + 8]
add eax, 0xc0
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc0
call fcn.10023290
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
add ecx, 0xd8
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xd8
call fcn.10023290
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf0]
mov dword [edx + 0xf0], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf4]
mov dword [edx + 0xf4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf8]
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xfc]
mov dword [edx + 0xfc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100248d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x100249bb
cmp dword [0x1019d3c4], 0xffffffff
je 0x1002492a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x1019d3c4]
cmp eax, 0x64
jae 0x1002491f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x100249cf
mov ecx, dword [ebp - 0x10]
mov dword [0x1019d3c4], ecx
jmp 0x10024935
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019d3c4], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x100249bb
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100253b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x1002549b
cmp dword [0x1019d3c8], 0xffffffff
je 0x1002540a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x1019d3c8]
cmp eax, 0x64
jae 0x100253ff
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x100254af
mov ecx, dword [ebp - 0x10]
mov dword [0x1019d3c8], ecx
jmp 0x10025415
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019d3c8], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x1002549b
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002d150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120ad3
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x1019742c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c0], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp + 0xc]
call fcn.10023550
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0xffffffff
jne 0x1002d1ef
push str.001233
mov ecx, dword [ebp + 8]
call fcn.10022500
mov eax, dword [ebp - 0x4c0]
or eax, 1
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.100238b0
mov eax, dword [ebp + 8]
jmp 0x1002d2a8
lea ecx, [ebp - 0x4bc]
call fcn.1002b990
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x4c8]
push ecx
push 0x400
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x4c4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d24a
cmp dword [ebp - 0x4c8], 0
jne 0x1002d22f
jmp 0x1002d24a
mov ecx, dword [ebp - 0x4c8]
push ecx
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x4bc]
call fcn.1002bab0
jmp 0x1002d1fe
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.1002bc00
mov ecx, dword [ebp - 0x4c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1002cf90
add esp, 0xc
mov ecx, dword [ebp - 0x4c0]
or ecx, 1
mov dword [ebp - 0x4c0], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4bc]
call fcn.1002b9f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.100238b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3069
mov esp, ebp
pop ebp
ret