joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2386d1fc
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x2390a5e3
call fcn.2380155b
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.238d0b4f
xor esi, esi
push 0x44
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 4], esi
call sub.MSVCR100.dll_memset
push 5
pop eax
push 0x10
mov word [ebp - 0x38], ax
xor edi, edi
lea eax, [ebp - 0x24]
push esi
inc edi
push eax
mov dword [ebp - 0x60], 0x23927c78
mov dword [ebp - 0x3c], edi
call sub.MSVCR100.dll_memset
add esp, 0x28
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [0x23984114]
push esi
push esi
push 0x10
push edi
push esi
push esi
push dword [ebp - 0x14]
call dword [eax + 0x54]
pop ecx
push eax
push esi
call dword [sym.imp.kernel32.dll_CreateProcessW]
movzx edi, ax
cmp di, si
je 0x2386d285
push dword [ebp - 0x24]
call fcn.2382207a
pop ecx
movzx edi, ax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.23803ba1
mov ax, di
call fcn.238015dd
ret
Function at 0x43ad3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x43ad4e
pop dword [ebp - 0x48]
mov eax, 0x43ad4e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x6398e42c
add dword [ebp - 0x58], 0xeab9611f
mov dword [ebp - 0x54], 0x1d9be294
sub dword [ebp - 0x54], 0xeb68964f
mov dword [ebp - 0x50], 0xb8b1a622
sub dword [ebp - 0x50], 0x6c6561f4
mov dword [ebp - 0x4c], 0xfa7dde31
sub dword [ebp - 0x4c], 0xfa7dde31
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe50593d0
sub eax, 0xe4bfe36c
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x8ef0f7a5
add dword [ebp - 0x58], 0xe58171b1
mov dword [ebp - 0x54], 0xa21f792d
sub dword [ebp - 0x54], 0x60b317b8
mov dword [ebp - 0x50], 0xfa296779
sub dword [ebp - 0x50], 0x96b9fb0d
mov dword [ebp - 0x4c], 0x20198ad8
add dword [ebp - 0x4c], 0xdfe67528
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x1227d3ed
add eax, 0xee1ddc93
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4db48
push 0
call eax
mov ecx, 0xf5a22cac
sub ecx, 0xf5a1e390
mov ebx, eax
mov esi, 0x9218867d
add esi, 0x6e2ed983
add esi, dword [ebp - 0x48]
mov edi, 0xb6a0ecf7
sub edi, 0xe0e6826d
add dword [ebp - 0x18], edx
mov edx, dword [esi]
sub dword [ebp - 0x28], ebx
add edx, edi
sub dword [ebp - 4], 0x797f0b2f
mov dword [ebx], edx
xor dword [ebp - 4], 0x7574ad27
add ebx, 0xa8350d3c
add ebx, 0x57caf2c8
add esi, 0xe2107634
add esi, 0x1def89d0
loop 0x43ae6b
add eax, 0x43bcf00e
add eax, 0xbc442735
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100217f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10021814
xor eax, eax
jmp 0x10021894
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002182b
xor eax, eax
jmp 0x10021894
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10021877
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10021877
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1002184e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10021883
xor eax, eax
jmp 0x10021894
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10021891
xor eax, eax
jmp 0x10021894
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10023580
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10120846
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1019842c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10022e50
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x20], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x24], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x28], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.100234f0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x4c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.100234f0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x64]
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x68]
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x6c]
mov dword [eax + 0x6c], edx
mov eax, dword [ebp + 8]
add eax, 0x70
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.100234f0
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
add ecx, 0x88
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x88
call fcn.100234f0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa0]
mov dword [edx + 0xa0], ecx
mov edx, dword [ebp + 8]
add edx, 0xa4
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.100234f0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbc]
mov dword [eax + 0xbc], edx
mov eax, dword [ebp + 8]
add eax, 0xc0
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc0
call fcn.100234f0
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
add ecx, 0xd8
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xd8
call fcn.100234f0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf0]
mov dword [edx + 0xf0], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf4]
mov dword [edx + 0xf4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf8]
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xfc]
mov dword [edx + 0xfc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10024b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x10024c1b
cmp dword [0x1019e3c4], 0xffffffff
je 0x10024b8a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x1019e3c4]
cmp eax, 0x64
jae 0x10024b7f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x10024c2f
mov ecx, dword [ebp - 0x10]
mov dword [0x1019e3c4], ecx
jmp 0x10024b95
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019e3c4], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10024c1b
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10025610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x100256fb
cmp dword [0x1019e3c8], 0xffffffff
je 0x1002566a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x1019e3c8]
cmp eax, 0x64
jae 0x1002565f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x1002570f
mov ecx, dword [ebp - 0x10]
mov dword [0x1019e3c8], ecx
jmp 0x10025675
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019e3c8], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x100256fb
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002d3a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101212f3
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x1019842c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c0], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp + 0xc]
call fcn.100237b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0xffffffff
jne 0x1002d43f
push str.001233
mov ecx, dword [ebp + 8]
call fcn.10022760
mov eax, dword [ebp - 0x4c0]
or eax, 1
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10023b10
mov eax, dword [ebp + 8]
jmp 0x1002d4f8
lea ecx, [ebp - 0x4bc]
call fcn.1002bbf0
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x4c8]
push ecx
push 0x400
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x4c4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002d49a
cmp dword [ebp - 0x4c8], 0
jne 0x1002d47f
jmp 0x1002d49a
mov ecx, dword [ebp - 0x4c8]
push ecx
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x4bc]
call fcn.1002bd10
jmp 0x1002d44e
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.1002be60
mov ecx, dword [ebp - 0x4c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1002d1e0
add esp, 0xc
mov ecx, dword [ebp - 0x4c0]
or ecx, 1
mov dword [ebp - 0x4c0], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4bc]
call fcn.1002bc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10023b10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3849
mov esp, ebp
pop ebp
ret
Function at 0x10031940
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100319de
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp byte [ebp - 1], 0
jne 0x10031993
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
jmp 0x100319e0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10032740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101217d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1019842c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.10023880
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10032876
mov eax, dword [ebp - 0x30]
add eax, 2
push eax
call fcn.100faece
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100e0f10
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0
push 0
lea ecx, [ebp + 8]
call fcn.10023880
push eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003284d
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.10019580
mov edx, dword [ebp - 0x30]
add edx, 1
shr edx, 1
push edx
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.100325c0
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.100195a0
lea ecx, [ebp - 0x28]
call fcn.10023d20
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100faed9
add esp, 4
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10023d20
mov eax, dword [ebp - 0x3c]
jmp 0x100328a0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100faed9
add esp, 4
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10023d20
mov eax, dword [ebp - 0x40]
jmp 0x100328a0
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10023d20
mov eax, dword [ebp - 0x44]
jmp 0x100328a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3849
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10032e00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2e0
je 0x10032e35
cmp dword [ebp - 0x10], 0x4d2
je 0x10032e26
jmp 0x10032f09
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10032f09
cmp dword [0x1019e95c], 0xffffffff
je 0x10032e79
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x1019e95c]
cmp ecx, 0x64
jae 0x10032e6e
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x10032f1d
mov edx, dword [ebp - 0x14]
mov dword [0x1019e95c], edx
jmp 0x10032e84
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019e95c], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push 0x14
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10032f09
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100332a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x113
je 0x100332de
cmp dword [ebp - 0x10], 0x2e0
je 0x10033308
cmp dword [ebp - 0x10], 0x4d2
je 0x100332cf
jmp 0x100333dd
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x100333dd
push 0x463
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp + 0xc], 0x463
jne 0x10033303
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x100333dd
cmp dword [0x1019e960], 0xffffffff
je 0x1003334c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [0x1019e960]
cmp eax, 0x64
jae 0x10033341
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x100333f1
mov ecx, dword [ebp - 0x14]
mov dword [0x1019e960], ecx
jmp 0x10033357
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1019e960], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x100333dd
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc