joyce8/EMBER2024-capa huggingface dataset:
Function at 0x628d05
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323e8
cmp edx, dword [eax]
je 0x628d27
add eax, 8
inc ecx
cmp eax, 0x632478
jl 0x628d18
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323e8]
jne 0x628e55
mov eax, dword [0x63ad88]
cmp eax, 1
je 0x628e2f
test eax, eax
jne 0x628d58
cmp dword [0x632310], 1
je 0x628e2f
cmp edx, 0xfc
je 0x628e55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628d8f
invalid
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006296f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629b80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628dd2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629b80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea54
push edi
call fcn.0062ba50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
bound eax, qword [eax]
lea eax, [ebp + 8]
lea esi, [esi + 0x6323ec]
push 0
push eax
push dword [esi]
call fcn.00629b80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4977b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x4977bb
xor eax, eax
pop esi
ret
cmp esi, 8
not eax
jb 0x4978aa
push ebx
push edi
mov edi, esi
shr edi, 3
lea ecx, [ecx]
xor edx, edx
mov dl, byte [ecx]
mov ebx, eax
shr ebx, 8
sub esi, 8
xor edx, eax
and edx, 0xff
mov eax, dword [edx*4 + 0x5363b0]
xor eax, ebx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5363b0]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x5363b0]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5363b0]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x5363b0]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5363b0]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x5363b0]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5363b0]
shr eax, 8
xor eax, edx
inc ecx
dec edi
jne 0x4977d0
pop edi
pop ebx
test esi, esi
je 0x4978cc
mov edi, edi
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x5363b0]
shr eax, 8
xor eax, edx
inc ecx
dec esi
jne 0x4978b0
not eax
pop esi
ret
Function at 0x10002ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x10002f9b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x10002f36
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10002b00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10002f04
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10003054
call fcn.10002f48
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x10002ff3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10002b00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10002fac
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10003054
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10002b00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1000304f
jmp 0x10003054
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10004ce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10004d02
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x10004d60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10004d82
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x10004de0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10004e0a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x10004e70
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10004e9a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x10004f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x10004f5f
Function at 0x10004f6e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10004f50
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x10004fe0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x1000503f

Function at 0x1000504e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10005030
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x100076c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x10007be0
test edx, edx
je 0x10007be0
call fcn.100076d7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10007c20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.100076c0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10007c91
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10007c56
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x100085a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x10008624
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x100085fc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x10008604
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.10008629
Function at 0x10043d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x10043e6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x10043dfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.10043540
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10043dc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x10043f33
call fcn.10043e0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x10043eca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.10043960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10043e7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x10043f33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.10043960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10043f2e
jmp 0x10043f33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1004cb20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x1004e7a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1004e7fd
cmp dword [ebp - 0x108], 2
jne 0x1004e7fd
cmp dword [ebp - 0x114], 6
jb 0x1004e7fd
cmp dword [ebp - 0x110], 0
jb 0x1004e7fd
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret

Function at 0x1004e950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call sym.nsDui.dll_public_virtual:_long_int___thiscall_DuiLib::WindowImplBase::OnCreate_unsigned_int__unsigned_int__long_int__int__
push 0xfffffffffffffff0
mov ecx, dword [ebp - 4]
call sym.nsDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0xff3fffff
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
or edx, 0x4000000
or edx, 0x2000000
push edx
push 0xfffffffffffffff0
mov ecx, dword [ebp - 4]
call sym.nsDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x4b8
call sym.nsDui.dll_public:_void___thiscall_CWndShadow::Create_struct_HWND____
push 6
mov ecx, dword [ebp - 4]
add ecx, 0x4b8
call sym.nsDui.dll_public:_bool___thiscall_CWndShadow::SetSize_int_
push 1
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x4b8
call sym.nsDui.dll_public:_bool___thiscall_CWndShadow::SetPosition_int__int_
push 0xa
mov ecx, dword [ebp - 4]
add ecx, 0x4b8
call sym.nsDui.dll_public:_bool___thiscall_CWndShadow::SetSharpness_unsigned_int_
call fcn.1004e7a0
test eax, eax
jne 0x1004ea20
push 0
push 0x1031b044
push 0x1031b050
push 0
call fcn.1004e820
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4e4], 0
je 0x1004ea76
push 0x1031b080
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call sym.nsDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xec]
call eax
push str.btn_changedir
mov ecx, dword [ebp - 4]
add ecx, 0x2c
call sym.nsDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0xec]
call eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004eb60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10298516
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], 0
push 0x104
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.1026c0f0
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp + 0xc]
call fcn.10050dd0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x154]
call fcn.1004ecc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10050dd0
push eax
lea ecx, [ebp - 0x154]
call fcn.10082b40
movzx ecx, al
test ecx, ecx
je 0x1004ec72
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x12c]
call fcn.10051590
mov byte [ebp - 4], 1
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1004ce80
add esp, 8
mov edx, dword [ebp - 0x130]
or edx, 1
mov dword [ebp - 0x130], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x12c]
call fcn.100513c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call sym.nsDui.dll_public_virtual:_void___thiscall_DuiLib::WindowImplBase::InitWindow_void_
mov eax, dword [ebp + 8]
jmp 0x1004eca3
push 0x1031b0b0
mov ecx, dword [ebp + 8]
call fcn.10050a20
mov eax, dword [ebp - 0x130]
or eax, 1
mov dword [ebp - 0x130], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call sym.nsDui.dll_public_virtual:_void___thiscall_DuiLib::WindowImplBase::InitWindow_void_
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret 8

Function at 0x1007f110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.100506d0
movzx eax, al
test eax, eax
jne 0x1007f17b
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x1007f15e
push 0x1031d584
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.10050dd0
push eax
call fcn.10278f27
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x1007f15e
xor eax, eax
jmp 0x1007f19c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1027926c
add esp, 0x10
jmp 0x1007f195
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xb4
call fcn.100511f0
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10083490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100834b4
xor eax, eax
jmp 0x10083534
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100834cb
xor eax, eax
jmp 0x10083534
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10083517
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10083517
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100834ee
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10083523
xor eax, eax
jmp 0x10083534
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10083531
xor eax, eax
jmp 0x10083534
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10083840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10083849
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1008388c
mov eax, dword [ebp - 8]
jmp 0x100838f2
cmp dword [ebp - 0xc], 1
je 0x1008389f
cmp dword [ebp - 0xc], 2
je 0x1008389f
mov eax, 0xd
jmp 0x100838f2
cmp dword [ebp + 0xc], 0
je 0x100838e6
cmp dword [ebp - 4], 0
je 0x100838d5
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x100838cc
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x100838d3
mov eax, 0xd
jmp 0x100838f2
jmp 0x100838e6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10084580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x100845aa
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x100845aa
mov dword [ebp - 8], 1
jmp 0x100845b1
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret