joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4205b0
Capabilities:
Check for peb beingdebugged flag
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5e39e8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00409730
mov ecx, eax
call fcn.004a3a70
xor ebx, ebx
xor ecx, ecx
mov word [esp + 0x20], cx
mov ecx, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x420610
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00401c70
mov eax, dword [esp + 0x20]
mov esi, 8
mov dword [esp + 0x50], ebx
cmp dword [esp + 0x34], esi
jae 0x420641
lea eax, [esp + 0x20]
push eax
push ebx
push str.OldNoteLoaded
push str.Note
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
cmp ebp, ebx
jne 0x420734
mov eax, dword [edi + 0x8287c]
mov ecx, dword [eax]
mov esi, dword [edi + 0x82864]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
jmp 0x420680
mov ebx, dword [edi + 0x8287c]
mov eax, dword [edi + 0x82864]
test esi, esi
je 0x420694
cmp esi, eax
je 0x420699
call fcn.004ea132
cmp dword [esp + 0x18], ebx
je 0x4206e7
cmp dword [edi + 0x82670], 0
je 0x4206d4
test esi, esi
jne 0x4206e3
call fcn.004ea132
mov edx, dword [esp + 0x18]
cmp edx, dword [esi + 0x18]
jne 0x4206bf
call fcn.004ea132
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x28]
push ecx
mov ecx, dword [edi + 0x82670]
call fcn.00465670
mov ebp, eax
lea ecx, [esp + 0x14]
call fcn.0040ade0
mov esi, dword [esp + 0x14]
jmp 0x420680
mov esi, dword [esi]
jmp 0x4206b1
xor eax, eax
push ebp
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
lea eax, [esp + 0x3c]
xor edx, edx
push 0x5fd170
push eax
mov word [esp + 0x44], dx
call fcn.00403b80
mov eax, dword [esp + 0x2c]
mov esi, 8
add esp, 0xc
cmp dword [esp + 0x34], esi
jae 0x42071e
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str.OldNoteLoaded
push str.Note
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [esp + 0x34], esi
jb 0x420747
mov edx, dword [esp + 0x20]
push edx
call fcn.004ca5d9
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004e8c89
add esp, 0x40
ret
Function at 0x427190
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x425ea0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x82848], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x4288c0
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5e452b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
call fcn.00409730
mov ecx, eax
call fcn.004a3a60
mov esi, eax
call fcn.00409730
mov ecx, eax
call fcn.004a3a70
mov ebp, eax
test esi, esi
je 0x42891f
push esi
push edi
push str.ShowedNewFunc
push 0x5ff194
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
test ebp, ebp
je 0x428955
test edi, edi
jne 0x428a34
push ebp
push edi
push str.ShowedNewFunc
push 0x5ff194
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x42895e
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp edi, 1
je 0x428a34
lea ecx, [esp + 0x18]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebx + 0x82684], 0
jne 0x428a34
push 0x378
call fcn.004ca5aa
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], 0
test esi, esi
je 0x4289d2
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.004058e0
push eax
mov ecx, esi
call fcn.004634c0
jmp 0x4289d4
xor eax, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [ebx + 0x82684], eax
test eax, eax
je 0x428a34
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push str.CSmallNewFuncRemindBar
push 0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [ebx + 0x82684]
call fcn.00463180
mov ecx, dword [ebx + 0x82684]
call fcn.00463260
mov ecx, dword [ebx + 0x82684]
push 5
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x428a50
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5e455b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
lea edx, [esp + 0x2c]
push edx
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [esi + 0x82680], 0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
jne 0x428b62
push 0x408
call fcn.004ca5aa
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
xor eax, eax
mov dword [esp + 0x40], eax
cmp edi, eax
je 0x428b06
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.004058e0
push eax
mov ecx, edi
call fcn.00447a60
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + 0x82680], eax
test eax, eax
je 0x428c48
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push str.CSmallBackCountWarningBar
push 0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [esi + 0x82680]
call fcn.00447bc0
mov ecx, dword [esi + 0x82680]
push 0
call ebp
push eax
call ebx
mov ecx, dword [esi + 0x82680]
call fcn.00446250
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.004a7360
add esp, 4
test eax, eax
jne 0x428c48
mov ecx, dword [esi + 0x82680]
call fcn.004465e0
test al, al
jne 0x428c48
mov eax, dword [esi + 0x82860]
mov ecx, dword [esi + 0x8285c]
mov edx, dword [esi + 0x82858]
push eax
push ecx
mov ecx, dword [esi + 0x82680]
push edx
call fcn.00446600
mov ecx, dword [esi + 0x82680]
call fcn.004464c0
test al, al
je 0x428c48
mov ecx, dword [esi + 0x82680]
call fcn.004474f0
mov ecx, dword [esi + 0x82680]
call fcn.004464d0
test al, al
je 0x428c30
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x44]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0x82680]
mov dword [eax + 0xc], edx
call fcn.00446500
mov ecx, dword [esi + 0x82680]
call fcn.00446240
mov ecx, dword [esi + 0x82680]
push 5
call ebp
push eax
call ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, dword [esi + 0x82680]
push 0
call ebp
push eax
call ebx
mov ecx, dword [esi + 0x82680]
call fcn.00446250
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x428c60
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5e45eb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [esi + 0x82674], 0
jne 0x428d5b
push 0x45c
call fcn.004ca5aa
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x28], 0
test edi, edi
je 0x428d09
mov edx, dword [esi + 0x827e8]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esi + 0x82764]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.004058e0
push eax
mov ecx, edi
call fcn.00445f30
jmp 0x428d0b
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esi + 0x82674], eax
test eax, eax
je 0x428d7b
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push str.CSmallBackCountBar
call fcn.004058e0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov ecx, dword [esi + 0x82674]
push eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [esi + 0x82674]
call fcn.00442640
mov ecx, dword [esi + 0x82674]
push 0
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x82674]
call fcn.00442550
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x428d90
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5e458b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push 0x11
call fcn.0041b0b0
lea ecx, [esp + 0x14]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
cmp dword [esi + 0x82674], 0
jne 0x428eac
push 0x45c
call fcn.004ca5aa
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 0
test edi, edi
je 0x428e32
mov eax, dword [esi + 0x827e8]
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esi + 0x82764]
push ecx
mov ecx, dword [esp + 0x20]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.004058e0
push eax
mov ecx, edi
call fcn.00445f30
jmp 0x428e34
xor eax, eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esi + 0x82674], eax
test eax, eax
je 0x428f1c
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push str.CSmallBackCountBar
call fcn.004058e0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov ecx, dword [esi + 0x82674]
push eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [esi + 0x82674]
call fcn.00442640
mov eax, dword [esi + 0x82674]
test eax, eax
je 0x428e99
add eax, 0x2d8
jmp 0x428e9b
xor eax, eax
mov edx, dword [esi + 0x82640]
lea ecx, [esi + 0x82640]
push eax
mov eax, dword [edx]
call eax
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esi + 0x82674]
call fcn.004424d0
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
sub esp, 0x10
mov dword [esp + 0x44], esp
mov eax, esp
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esi + 0x82674]
call fcn.00442570
mov ecx, dword [esi + 0x82674]
mov edi, dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x82674]
push 5
call edi
push eax
call ebx
mov ecx, dword [esi + 0x82674]
call fcn.00442540
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x428f40
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5e45eb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [esi + 0x82670], 0
jne 0x429063
push 0x6b0
call fcn.004ca5aa
mov edi, eax
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x28], 0
test edi, edi
je 0x428fe9
mov edx, dword [esi + 0x827e8]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esi + 0x82764]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.004058e0
push eax
mov ecx, edi
call fcn.00470910
jmp 0x428feb
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esi + 0x82670], eax
test eax, eax
je 0x429083
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push str.CSmallNodeBar
call fcn.004058e0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov ecx, dword [esi + 0x82670]
push eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [esi + 0x82670]
call fcn.0046bfd0
mov eax, dword [esi + 0x82670]
test eax, eax
je 0x429050
add eax, 0x2d8
jmp 0x429052
xor eax, eax
mov edx, dword [esi + 0x82640]
lea ecx, [esi + 0x82640]
push eax
mov eax, dword [edx]
call eax
mov ecx, dword [esi + 0x82670]
push 0
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x82670]
call fcn.00463890
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x4290a0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5e458b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
call fcn.0041b0b0
lea ecx, [esp + 0x14]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
cmp dword [esi + 0x82670], 0
jne 0x4291bc
push 0x6b0
call fcn.004ca5aa
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 0
test edi, edi
je 0x429142
mov eax, dword [esi + 0x827e8]
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esi + 0x82764]
push ecx
mov ecx, dword [esp + 0x20]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.004058e0
push eax
mov ecx, edi
call fcn.00470910
jmp 0x429144
xor eax, eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esi + 0x82670], eax
test eax, eax
je 0x42922c
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push str.CSmallNodeBar
call fcn.004058e0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov ecx, dword [esi + 0x82670]
push eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [esi + 0x82670]
call fcn.0046bfd0
mov eax, dword [esi + 0x82670]
test eax, eax
je 0x4291a9
add eax, 0x2d8
jmp 0x4291ab
xor eax, eax
mov edx, dword [esi + 0x82640]
lea ecx, [esi + 0x82640]
push eax
mov eax, dword [edx]
call eax
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esi + 0x82670]
call fcn.00463710
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
sub esp, 0x10
mov dword [esp + 0x44], esp
mov eax, esp
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esi + 0x82670]
call fcn.004638b0
mov ecx, dword [esi + 0x82670]
mov edi, dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x82670]
push 5
call edi
push eax
call ebx
mov ecx, dword [esi + 0x82670]
call fcn.00463870
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x436140
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 0x2d8], 0
je 0x4361ed
mov eax, dword [esi + 4]
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x15e
push 0xe1
push ebx
mov edi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x2d8]
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0053aeb0
mov ecx, dword [esi + 0x2dc]
test ecx, ecx
je 0x4361cc
push 0
push 0
push 0
lea edx, [esp + 0x18]
push edx
push edi
mov dword [esp + 0x20], 1
call fcn.0053aeb0
push 0xcc0020
push 0
push 0
push edi
push 0x15e
push 0xe1
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x43f3a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x1a0], eax
push esi
push edi
mov edi, dword [esp + 0x1b0]
lea eax, [esp + 0x18]
push eax
push 0x202
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x43f47e
mov eax, dword [esp + 0x18]
cmp al, 2
jne 0x43f478
shr eax, 8
cmp al, 2
jne 0x43f478
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x43f47e
xor eax, eax
mov ecx, 2
mov dword [esp + 8], eax
push 0x19
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0xc], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
mov eax, dword [esi + 0x1440]
cmp eax, 0x6015b5
jne 0x43f44a
mov edx, dword [esi + 0x143c]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0xc], eax
jmp 0x43f460
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x43f47e
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov ecx, dword [edi]
push 0x10
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
setne al
jmp 0x43f480
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
xor ecx, esp
call fcn.004e8c89
add esp, 0x1a4
ret 4
Function at 0x43f8a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x1000
lea esi, [edi + 0x1c]
push 0
push esi
call fcn.004e9ba0
mov eax, dword [edi + 0x142c]
push eax
push str.MAIL_FROM:__s__r_n
push esi
call fcn.0043f4a0
mov eax, esi
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43f8d0
mov ebx, dword [esp + 0x14]
push 0
sub eax, ecx
mov ecx, dword [ebx]
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, esi
lea ebp, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43f8f0
sub ecx, ebp
cmp eax, ecx
je 0x43f906
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
mov edx, dword [ebx]
push 0
push 0x400
lea eax, [edi + 0x101c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
push 0x1000
push 0
push esi
call fcn.004e9ba0
mov eax, dword [edi + 0x1430]
push eax
push str.RCPT_TO:__s__r_n
push esi
call fcn.0043f4a0
mov eax, esi
add esp, 0x18
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f944
mov ecx, dword [ebx]
push 0
sub eax, ebp
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, esi
lea ebp, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43f960
sub ecx, ebp
cmp eax, ecx
jne 0x43f8fd
mov edx, dword [ebx]
push 0
push 0x400
lea eax, [edi + 0x101c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
push 0x1000
push 0
push esi
call fcn.004e9ba0
mov eax, dword [str.DATA_r_n]
mov dword [esi], eax
mov cx, word [0x605008]
mov eax, esi
add esp, 0xc
mov word [esi + 4], cx
lea ebp, [eax + 1]
jmp 0x43f9b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f9b0
mov edx, dword [ebx]
push 0
sub eax, ebp
push eax
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, esi
lea ebp, [ecx + 1]
jmp 0x43f9d0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43f9d0
sub ecx, ebp
cmp eax, ecx
jne 0x43f8fd
push 0
push 0x400
lea eax, [edi + 0x101c]
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
push 0x1000
push 0
push esi
call fcn.004e9ba0
mov ecx, dword [edi + 0x142c]
mov edx, dword [edi + 0x1428]
push ecx
push edx
push str.From:__s___s__r_n
push esi
call fcn.0043f4a0
mov eax, esi
add esp, 0x1c
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43fa26
mov ecx, dword [edi + 0x1430]
push ecx
sub eax, ebp
push str.To:_INVT.COM.CN___s__r_n
lea edx, [eax + edi + 0x1c]
push 0x96
push edx
call fcn.004ea1f6
mov eax, esi
add esp, 0x10
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43fa52
mov ecx, dword [edi + 0x1434]
push ecx
sub eax, ebp
push str.Subject:_s_r_nMime_Version:_1.0_r_nContent_Type:_multipart_mixed____boundary_INVT__r_n_r_n
lea edx, [eax + edi + 0x1c]
push 0x96
push edx
call fcn.004ea1f6
mov eax, esi
add esp, 0x10
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43fa80
push 0
sub eax, edi
push eax
mov eax, dword [ebx]
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
lea edx, [esi + 1]
lea esp, [esp]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x43faa0
sub esi, edx
pop edi
cmp eax, esi
pop esi
pop ebp
sete al
pop ebx
ret 4
Function at 0x43fac0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, ecx
push 0x1000
lea esi, [edi + 0x1c]
push 0
push esi
call fcn.004e9ba0
mov eax, dword [edi + 0x1438]
push eax
push str.__INVT_r_nContent_Type:_text_plain__r_n__charset_gb2312__r_n_r_n_s_r_n_r_n
push esi
call fcn.0043f4a0
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43faf0
mov ecx, dword [esp + 0xc]
push 0
sub eax, edx
mov edx, dword [ecx]
push eax
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, esi
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43fb10
sub ecx, esi
cmp eax, ecx
pop edi
sete al
pop esi
ret 4