joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x488b54
push 0
call fcn.00465ed2
mov edi, eax
mov esi, 1
test edi, edi
je 0x408248
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 4
mov dword [ebp - 4], eax
inc eax
movzx eax, ax
mov dword [ebp + 8], eax
nop dword [eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x408141
push ebx
mov edx, eax
mov ecx, edi
call fcn.00408070
add esp, 4
test eax, eax
jne 0x40815c
push esi
mov ecx, 0x488b54
call fcn.00465ed2
mov edi, eax
inc esi
test edi, edi
je 0x408248
mov eax, dword [ebp + 8]
jmp 0x408120
test edi, edi
je 0x408248
mov eax, dword [ebp - 4]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x408248
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408248
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408248
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x4081c9
cmp esi, ecx
jae 0x408248
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x4081b3
cmp esi, ecx
jae 0x408248
cmp word [esi], 0
je 0x408248
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x408253
mov ebx, dword [ebp - 8]
mov edx, 1
mov ecx, dword [ebx]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or edx, ecx
jge 0x408211
push edi
mov ecx, ebx
call fcn.00402f60
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x408253
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004030d0
int3
Function at 0x4083b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468068
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 4], 0
call fcn.0042f1d9
lea esi, [edi + 0x10]
lea ecx, [esi + 4]
mov dword [esi], vtable.DuiLib::CNotifyPump.0
push 0x53
mov dword [ebp - 0xac], esi
call fcn.0042e53c
mov byte [ebp - 4], 1
lea ecx, [edi + 0x2c]
mov dword [edi + 0x20], vtable.DuiLib::INotifyUI.0
mov dword [edi + 0x24], vtable.DuiLib::IMessageFilterUI.0
mov dword [edi + 0x28], vtable.DuiLib::IDialogBuilderCallback.0
mov dword [edi], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi], vtable.DuiLib::WindowImplBase.2.0
mov dword [edi + 0x20], vtable.DuiLib::WindowImplBase.3.0
mov dword [edi + 0x24], vtable.DuiLib::WindowImplBase.4.0
mov dword [edi + 0x28], vtable.DuiLib::WindowImplBase.0
call fcn.0042f95b
mov dword [edi + method.DuiLib::CTxtWinHost.virtual_64], vtable.DuiLib::CWebBrowserEventHandler.0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x2e4]
mov dword [edi], vtable.CDlgBrowser.5.0
mov dword [esi], vtable.CDlgBrowser.4.0
mov dword [edi + 0x20], vtable.CDlgBrowser.3.0
mov dword [edi + 0x24], vtable.CDlgBrowser.2.0
mov dword [edi + 0x28], vtable.CDlgBrowser.1.0
mov dword [edi + method.DuiLib::CTxtWinHost.virtual_64], vtable.CDlgBrowser.0
mov dword [edi + 0x2dc], 0
mov dword [edi + 0x2e0], 0
call fcn.0042e48f
mov byte [ebp - 4], 4
lea eax, [ebp - 0xa8]
push eax
mov dword [edi + 0x328], 0
mov dword [edi + 0x334], 0
mov byte [edi + 0x338], 0
mov dword [ebp - 0xa8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x408507
cmp dword [ebp - 0x98], 2
jne 0x408507
cmp dword [ebp - 0xa4], 6
jne 0x408507
cmp dword [ebp - 0xa0], 1
jb 0x408507
call fcn.0042e180
jmp 0x408584
call fcn.00404960
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.00404e50
sub esp, 0xc
mov edx, 0x42d5b0
mov ecx, 0x489098
call fcn.00404ec0
call fcn.004049e0
test eax, eax
jne 0x408584
call fcn.00404960
call esi
mov ecx, eax
call fcn.00404e50
sub esp, 0xc
mov edx, 0x42d5f0
mov ecx, 0x489094
call fcn.00404ec0
call fcn.004049e0
test eax, eax
jne 0x408584
call fcn.00404960
call esi
mov ecx, eax
call fcn.00404e50
sub esp, 0xc
mov edx, 0x42d630
mov ecx, 0x48733c
call fcn.00404ec0
call fcn.004049e0
lea ecx, [edi + 0x2e4]
call fcn.0042e96b
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x2e4]
call fcn.0042e5fe
mov ecx, dword [ebp + 0x4c]
mov dword [edi + 0x328], ecx
mov ecx, dword [ebp + 0x50]
mov dword [edi + 0x32c], ecx
mov cl, byte [ebp + 0x54]
mov byte [edi + 0x330], cl
lea ecx, [ebp + 8]
mov dword [0x488f5c], edi
call fcn.0042e585
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret 0x50
Function at 0x408620
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4680a0
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x334]
mov dword [esi], vtable.CDlgBrowser.5.0
mov dword [esi + 0x10], vtable.CDlgBrowser.4.0
mov dword [esi + 0x20], vtable.CDlgBrowser.3.0
mov dword [esi + 0x24], vtable.CDlgBrowser.2.0
mov dword [esi + 0x28], vtable.CDlgBrowser.1.0
mov dword [esi + method.DuiLib::CTxtWinHost.virtual_64], vtable.CDlgBrowser.0
mov dword [0x488f5c], 0
test eax, eax
je 0x4086aa
push 8
push eax
mov dword [eax], vtable.CClientCall.0
call fcn.004662e6
add esp, 8
mov dword [esi + 0x334], 0
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40872e
cmp dword [ebp - 0x94], 2
jne 0x40872e
cmp dword [ebp - 0xa0], 6
jne 0x40872e
cmp dword [ebp - 0x9c], 1
jb 0x40872e
mov ecx, dword [0x488fb8]
test ecx, ecx
je 0x4086fa
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x488fb8], 0
mov ecx, dword [0x488fbc]
test ecx, ecx
je 0x408714
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x488fbc], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x48909c]
cmp eax, dword [0x4890a0]
je 0x40879e
mov dword [0x4890a0], eax
jmp 0x40879e
call fcn.00404960
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
mov ecx, eax
call fcn.00404e50
call fcn.00405250
call fcn.004049e0
test eax, eax
jne 0x40879e
call fcn.00404960
call edi
mov ecx, eax
call fcn.00404e50
sub esp, 0xc
mov edx, 0x42d5f0
mov ecx, 0x489094
call fcn.00404ec0
call fcn.004049e0
test eax, eax
jne 0x40879e
call fcn.00404960
call edi
mov ecx, eax
call fcn.00404e50
sub esp, 0xc
mov edx, 0x42d630
mov ecx, 0x48733c
call fcn.00404ec0
call fcn.004049e0
lea ecx, [esi + 0x2e4]
call fcn.0042e585
lea ecx, [esi + 0x2c]
mov dword [esi + method.DuiLib::CTxtWinHost.virtual_64], vtable.DuiLib::CWebBrowserEventHandler.0
mov dword [esi], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x10], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x24], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x28], vtable.DuiLib::WindowImplBase.0
call fcn.0042fccc
lea ecx, [esi + 0x14]
call fcn.0042e5a5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret
Function at 0x4089b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468120
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xac], esi
mov esi, dword [ebp + 8]
cmp esi, 0x4a
jne case.0x408a0e.7
test ebx, ebx
je case.0x408a0e.7
mov eax, dword [ebx]
add eax, 0xfffffffc
cmp eax, 7
ja case.0x408a0e.7
jmp dword [eax*4 + 0x408b48]
mov ecx, dword [edi + 0x2dc]
test ecx, ecx
je case.0x408a0e.7
call fcn.004413d0
jmp case.0x408a0e.7
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x408a78
cmp dword [ebp - 0x94], 2
jne 0x408a78
cmp dword [ebp - 0xa0], 6
jne 0x408a78
cmp dword [ebp - 0x9c], 1
jb 0x408a78
xor ecx, ecx
cmp dword [0x488fb0], ecx
sete cl
call fcn.0042e0d0
jmp case.0x408a0e.7
cmp byte [0x488fac], 0
sete byte [0x488fac]
jmp case.0x408a0e.7
mov byte [edi + 0x338], 1
jmp case.0x408a0e.7
call fcn.00403300
mov ecx, eax
test ecx, ecx
je 0x408b3d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa8]
push dword [ebx + 8]
push 0x477754
push eax
call fcn.00409320
mov ecx, dword [edi + 0x2dc]
add esp, 0xc
mov esi, dword [ebp - 0xa8]
test ecx, ecx
je 0x408aeb
cmp dword [esi - 0xc], 0
je 0x408aeb
push esi
call fcn.0044114a
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408b0a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
push dword [ebp - 0xac]
mov ecx, edi
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0043fdbd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004030d0
nop
adc eax, 0x2d00408a
mov al, byte [eax]
mov ecx, dword [edx - 0x74f2ffc0]
inc eax
add byte [0xd00408b], cl
mov eax, dword [eax]
or eax, 0x9400408b
mov al, byte [eax]
int3
Function at 0x408a2d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468120
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xac], esi
mov esi, dword [ebp + 8]
cmp esi, 0x4a
jne case.0x408a0e.7
test ebx, ebx
je case.0x408a0e.7
mov eax, dword [ebx]
add eax, 0xfffffffc
cmp eax, 7
ja case.0x408a0e.7
jmp dword [eax*4 + 0x408b48]
mov ecx, dword [edi + 0x2dc]
test ecx, ecx
je case.0x408a0e.7
call fcn.004413d0
jmp case.0x408a0e.7
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x408a78
cmp dword [ebp - 0x94], 2
jne 0x408a78
cmp dword [ebp - 0xa0], 6
jne 0x408a78
cmp dword [ebp - 0x9c], 1
jb 0x408a78
xor ecx, ecx
cmp dword [0x488fb0], ecx
sete cl
call fcn.0042e0d0
jmp case.0x408a0e.7
cmp byte [0x488fac], 0
sete byte [0x488fac]
jmp case.0x408a0e.7
mov byte [edi + 0x338], 1
jmp case.0x408a0e.7
call fcn.00403300
mov ecx, eax
test ecx, ecx
je 0x408b3d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa8]
push dword [ebx + 8]
push 0x477754
push eax
call fcn.00409320
mov ecx, dword [edi + 0x2dc]
add esp, 0xc
mov esi, dword [ebp - 0xa8]
test ecx, ecx
je 0x408aeb
cmp dword [esi - 0xc], 0
je 0x408aeb
push esi
call fcn.0044114a
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408b0a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
push dword [ebp - 0xac]
mov ecx, edi
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0043fdbd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004030d0
nop
adc eax, 0x2d00408a
mov al, byte [eax]
mov ecx, dword [edx - 0x74f2ffc0]
inc eax
add byte [0xd00408b], cl
mov eax, dword [eax]
or eax, 0x9400408b
mov al, byte [eax]
int3
Function at 0x409bf0
Capabilities:
Delete file
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46828d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x2c8]
push 0x477c80
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebx + 0x2c0]
call fcn.00435d02
test al, al
je 0x409d67
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0
push eax
push 0
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x409c6a
call edi
cmp eax, 0x7a
jne 0x409d3f
push dword [ebp - 0x5c]
call fcn.004667d0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
push esi
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 0x60], eax
test eax, eax
je 0x409d34
nop
push 0xffffffffffffffff
push dword [esi + 4]
lea ecx, [ebp - 0x58]
call fcn.0042e46f
push 0
push 0x477cf4
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0
call fcn.0042e9e0
cmp eax, 0xffffffff
jne 0x409cd2
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
test eax, eax
jne 0x409cd2
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call edi
push 0x50
push esi
call fcn.004662e6
add esp, 8
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x5c]
push eax
push 0
push dword [ebp - 0x60]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x409d02
call edi
cmp eax, 0x7a
jne 0x409dbc
push dword [ebp - 0x5c]
call fcn.004667d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
mov esi, eax
call fcn.0042e585
lea eax, [ebp - 0x5c]
push eax
push esi
push dword [ebp - 0x60]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x409c90
push 0x50
push esi
call fcn.004662e6
add esp, 8
mov ecx, dword [ebx + 0x2c0]
push 0
mov eax, dword [ecx]
call dword [eax + 0x13c]
mov ecx, dword [ebx + 0x2c4]
push 0
mov eax, dword [ecx]
call dword [eax + 0x13c]
push ecx
mov ecx, ebx
call fcn.00409dd0
mov ecx, ebx
mov ecx, dword [ecx + 0x2c4]
call fcn.00435d02
test al, al
je 0x409d90
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov ecx, ebx
call fcn.0040a0a0
mov ecx, dword [ebx + 0x2c8]
push 0x477c90
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.0042e585
jmp 0x409d3f
Function at 0x40a0a0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468320
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x48745c
push 0x487fb8
lea eax, [ecx + 0x14]
push 0
push str.mem_usable
mov ecx, eax
mov dword [ebp - 0x9c], eax
call fcn.0043043c
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x40a23d
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
sbb edx, dword [ebp - 0x3c]
call fcn.00466f30
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
movsd qword [ebp - 0xa8], xmm0
call fcn.00466f30
movsd xmm1, qword [ebp - 0xa8]
lea ecx, [ebp - 0x98]
divsd xmm1, xmm0
mulsd xmm1, qword [0x47a388]
movsd qword [ebp - 0xa8], xmm1
call fcn.0042e48f
movsd xmm0, qword [ebp - 0xa8]
lea eax, [ebp - 0x98]
sub esp, 8
mov dword [ebp - 4], 0
movsd qword [esp], xmm0
push str._.0lf
push eax
call fcn.0042eb1f
add esp, 0x10
lea ecx, [ebp - 0x98]
call fcn.0042e701
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
cmp eax, 0x50
jle 0x40a20f
mov ecx, dword [ebp - 0x9c]
push 0
push 0x48745c
push 0x487fb8
push 0
push str.mem_enough
call fcn.0043043c
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov ecx, dword [ebp - 0x9c]
add esp, 0x14
mov edi, eax
push 0
push 0x48745c
push 0x487fb8
push 0
push str.mem_notenough
call fcn.0043043c
push eax
call sub.VCRUNTIME140.dll___RTDynamicCast
mov edx, dword [edi]
add esp, 0x14
mov ecx, edi
mov esi, eax
push 0
call dword [edx + 0xcc]
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx + 0xcc]
push 0x477d2c
lea ecx, [ebp - 0x98]
call fcn.0042e7d9
mov esi, dword [ebx]
lea ecx, [ebp - 0x98]
call fcn.0042e701
push eax
mov ecx, ebx
call dword [esi + 0x2c]
lea ecx, [ebp - 0x98]
call fcn.0042e585
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret
Function at 0x40c240
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4687e2
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov esi, dword [0x488f68]
test esi, esi
jne 0x40c32e
push 0x2c4
call fcn.00466317
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0042f1d9
mov dword [esi + 0x10], vtable.DuiLib::INotifyUI.0
lea ecx, [esi + 0x14]
mov dword [esi], vtable.CDlgClockTip.1.0
mov dword [esi + 0x10], vtable.CDlgClockTip.0
call fcn.0042f95b
push 0
push 0
push 0
push 0
push 0
push 0
push 0x90000000
push 0x47744c
push 0
mov ecx, esi
mov dword [esi + 0x2c0], 0
mov dword [0x488f68], esi
mov byte [ebp - 4], 2
call fcn.0042f366
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0x14]
mov ecx, esi
push 0
push 0xd7
push 0x14a
add eax, 0xffffff29
push eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffeb6
push eax
push 0xffffffffffffffff
call fcn.00403480
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [0x488f68]
push dword [ebp + 0xe4]
lea eax, [ebp + 0x9c]
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.0042e437
push dword [ebp + 0x98]
mov byte [ebp - 4], 4
lea eax, [ebp + 0x54]
sub esp, 0x44
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.0042e437
push dword [ebp + 0x50]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 5
sub esp, 0x44
mov ecx, esp
push eax
call fcn.0042e437
push ecx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040e1c0
lea ecx, [ebp + 0xc]
call fcn.0042e585
lea ecx, [ebp + 0x54]
call fcn.0042e585
lea ecx, [ebp + 0x9c]
call fcn.0042e585
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
ret 0xe0
Function at 0x411be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4693f4
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x180
mov eax, dword [0x487304]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 0x14]
push esi
mov dword [ebp - 0x188], esi
mov dword [ebp - 0x184], eax
call fcn.00412380
push eax
push dword [edi + 4]
mov dword [ebp - 0x18c], eax
call dword [sym.imp.USER32.dll_UnregisterHotKey]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push dword [ebp - 0x18c]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_RegisterHotKey]
mov ecx, dword [ebp - 0x184]
mov esi, dword [esi]
call fcn.0042e701
mov ecx, dword [ebp - 0x188]
push eax
call dword [esi + 0x2c]
mov esi, dword [ebp - 0x184]
lea eax, [ebp - 0x18c]
push esi
push eax
lea ecx, [edi + 0x2c0]
call fcn.00412880
mov ecx, eax
call fcn.0042e5fe
lea ecx, [ebp - 0x60]
call fcn.0042e48f
mov dword [ebp - 4], 0
sub esp, 0x44
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x40]
mov ecx, esp
push dword [ebx + 0x10]
push dword [ebx + 0xc]
movups xmmword [ecx], xmm0
push str._u__u__s
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [ecx + 0x30], xmm0
mov dword [ecx + 0x40], eax
lea eax, [ebp - 0x60]
push eax
call fcn.0042eb1f
add esp, 0x54
lea ecx, [ebp - 0xf0]
push 0xffffffffffffffff
push str.HOTKEY
call fcn.0042e46f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x180]
mov edi, dword [ebp - 0x188]
push ecx
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
call eax
mov esi, eax
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 2
push eax
call fcn.004307de
add esp, 4
push str.config.xml
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.0042e729
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 5
call fcn.0042e585
lea ecx, [ebp - 0xa8]
call fcn.0042e701
push eax
lea ecx, [ebp - 0x60]
call fcn.0042e701
push eax
mov ecx, esi
call fcn.0042e701
push eax
lea ecx, [ebp - 0xf0]
call fcn.0042e701
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0xa8]
call fcn.0042e585
lea ecx, [ebp - 0x180]
call fcn.0042e585
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0
call fcn.0042e585
sub esp, 0x44
mov ecx, esp
mov dword [ebp - 0x188], esp
push dword [ebp - 0x184]
call fcn.0042e437
mov byte [ebp - 4], 6
sub esp, 0x44
mov eax, dword [edi]
mov ecx, edi
push esp
mov eax, dword [eax + 4]
call eax
mov byte [ebp - 4], 0
call fcn.00412600
lea ecx, [ebp - 0x60]
call fcn.0042e585
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004662d8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10