joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100290e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x1002918d
push ebx
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push edi
push eax
call fcn.10077c30
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp + 0x10]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp + 0x10]
call fcn.10028d96
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1002918b
mov ecx, esi
call fcn.100057b0
mov ebx, dword [ebp - 4]
mov ecx, esi
mov dword [ebx], eax
call fcn.100057e0
mov ecx, ebx
mov dword [ebx + 4], eax
mov dword [ebx + 0x10], esi
call fcn.10028e16
mov byte [ebx + 8], al
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002a4f6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor ebx, ebx
mov esi, ecx
push 0x208
push ebx
push eax
mov dword [ebp - 0x210], ebx
call fcn.10078730
add esp, 0xc
cmp dword [esi + 0x116c], ebx
je 0x1002a58e
cmp dword [esi + 0x11e4], ebx
jbe 0x1002a554
add esi, 0x11d4
cmp dword [esi + 0x14], 8
jb 0x1002a54c
mov esi, dword [esi]
push esi
push str._sTempSkin_
jmp 0x1002a5a2
add esi, 0x1174
cmp dword [esi + 0x14], 8
jb 0x1002a564
mov eax, dword [esi]
jmp 0x1002a566
mov eax, esi
push eax
lea eax, [ebp - 0x20c]
push str._sTempSkin_
push eax
call fcn.10021c56
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002a5b1
jmp 0x1002a594
add esi, 0x1174
cmp dword [esi + 0x14], 8
jb 0x1002a59c
mov esi, dword [esi]
push esi
push str._sSkin_
lea eax, [ebp - 0x20c]
push eax
call fcn.10021c56
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.10002590
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a5d4
Capabilities:
Check if file exists

Disassembly:
push 0x54
mov eax, 0x101da98a
call fcn.1005d8df
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
push eax
call fcn.1002a4f6
mov byte [ebp - 4], 1
call fcn.10021d81
movss xmm0, dword [0x101e34dc]
fstp dword [ebp - 0x5c]
movss xmm1, dword [ebp - 0x5c]
comiss xmm1, dword [0x101e34d8]
jb 0x1002a66f
comiss xmm0, xmm1
jbe 0x1002a66f
push 0x101e3434
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10029243
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.10004080
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
movss xmm0, dword [ebp - 0x5c]
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x101e34e0]
cvtpd2ps xmm0, xmm0
jmp 0x1002a732
comiss xmm1, xmm0
movsd xmm2, qword [0x101e34f0]
jb 0x1002a6c0
cvtps2pd xmm0, xmm1
comisd xmm2, xmm0
jbe 0x1002a6c0
push 0x101e3450
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10029243
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.10004080
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
movss xmm0, dword [ebp - 0x5c]
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x101e34e8]
jmp 0x1002a666
cvtps2pd xmm0, xmm1
lea eax, [ebp - 0x58]
comisd xmm0, xmm2
jb 0x1002a707
push 0x101e346c
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10029243
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.10004080
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
movss xmm0, dword [ebp - 0x5c]
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x101e34f0]
jmp 0x1002a666
push 0x101e3488
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10029243
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.10004080
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
movss xmm0, dword [ebp - 0x5c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
movss dword [esi + 0x1200], xmm0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002a786
push 0x101e3488
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10029243
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.10004080
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
movss xmm0, dword [ebp - 0x5c]
movss dword [esi + 0x1200], xmm0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10004690
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.10002630
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10002630
mov eax, edi
call fcn.1005d89a
ret 4
Function at 0x1002b6ab
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x101dac0f
call fcn.1005d8df
mov esi, ecx
cmp byte [esi + 0x1204], 0
mov edi, dword [ebp + 8]
jne 0x1002b6cf
xor eax, eax
jmp 0x1002b82b
xor ebx, ebx
mov dword [esi + 0x11fc], 1
cmp word [0x1026dd78], bx
jne 0x1002b6e8
mov eax, ebx
jmp 0x1002b6f3
push 0x1026dd78
call fcn.100802ff
pop ecx
push eax
push 0x1026dd78
lea ecx, [esi + 0x11a4]
call fcn.100026f0
lea ecx, [esi + 0x11bc]
cmp dword [ecx + 0x10], ebx
je 0x1002b71d
push 0x101e3658
call fcn.100218da
test eax, eax
jne 0x1002b729
mov dword [esi + 0x1160], 1
jmp 0x1002b72f
mov dword [esi + 0x1160], ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10078730
add esp, 0xc
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.1002a5d4
cmp dword [eax + 0x14], 8
jb 0x1002b75a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push 0x1026de28
push eax
call fcn.10021c56
add esp, 0xc
lea ecx, [ebp - 0x248]
push ebx
push 1
call fcn.10002630
cmp dword [esi + 0x1160], ebx
jne 0x1002b815
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002b815
mov dword [esi + 0x1160], 1
call fcn.100760de
push ebx
push 0x4f
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0x101e3658
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.100802ff
pop ecx
push eax
push 0x101e3658
lea ecx, [ebp - 0x230]
call fcn.100026f0
mov dword [ebp - 4], ebx
call fcn.100760de
lea ecx, [ebp - 0x230]
push ecx
push 0x91
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push ebx
push 1
call fcn.10002630
mov ecx, esi
call fcn.1002a4bb
mov ecx, esi
call fcn.1002a4ac
push edi
mov ecx, esi
call fcn.1002b833
call fcn.1005d89a
ret 4
Function at 0x1002cff7
Capabilities:
Read .ini file

Disassembly:
call fcn.1002cfb9
mov ecx, eax
jmp fcn.1002f7db
Function at 0x1002fb6c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x418], ebx
call fcn.10078730
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10078730
mov eax, dword [ebx + 0x24]
add esp, 0x18
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x41c], ecx
cmp ecx, eax
je 0x1002fcdc
mov esi, ebx
push edi
mov ebx, dword [ecx + 0x14]
lea edi, [ebx + 0xc]
push edi
call fcn.100802ff
pop ecx
test eax, eax
jle 0x1002fcbf
push edi
lea eax, [ebp - 0x414]
push str.Is_s
push eax
call fcn.10021c56
mov esi, dword [ebp - 0x418]
add esp, 0xc
add esi, 0x78
cmp dword [esi + 0x14], 8
jb 0x1002fc04
mov eax, dword [esi]
jmp 0x1002fc06
mov eax, esi
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x101e6f04
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push 0x101e6f04
push eax
call fcn.10086563
pop ecx
pop ecx
test eax, eax
je 0x1002fc53
lea eax, [ebp - 0x20c]
push eax
call fcn.10087806
pop ecx
mov ecx, dword [ebx + 4]
mov byte [ecx], al
push edi
lea eax, [ebp - 0x414]
push str.Use_s
push eax
call fcn.10021c56
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x1002fc70
mov esi, dword [esi]
push esi
push 0x104
lea eax, [ebp - 0x20c]
mov esi, str.nothing
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.10086563
pop ecx
pop ecx
test eax, eax
je 0x1002fcb9
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 8]
call fcn.100802dd
pop ecx
pop ecx
mov esi, dword [ebp - 0x418]
lea ecx, [ebp - 0x41c]
call fcn.100462a1
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [eax]
jne 0x1002fbc7
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret

Function at 0x10030ee1
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x328]
add ecx, 0x4b8
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esi + 0x358]
call fcn.1004de3f
mov ecx, esi
call fcn.100319d6
mov ecx, esi
pop esi
jmp fcn.10033478
Function at 0x10033dbc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x34
mov eax, 0x101db4d6
call fcn.1005d8df
mov esi, ecx
mov eax, dword [esi + 0x38c]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x10033de2
push 1
push eax
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov ecx, esi
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov esi, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1006fd0f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10021d0d
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.1001d28d
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10033eb9
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x10033e4c
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x10033e54
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10033eb9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x10033e4c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
inc eax
push eax
push ecx
push eax
push edx
call fcn.1003a548
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, 0xa2
push ebx
push ebx
push ebx
push edi
call esi
push ebx
push ebx
push ebx
push 0x56
call esi
push ebx
push 2
push ebx
push 0x56
call esi
push ebx
push 2
push ebx
push edi
call esi
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.1001d28d
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.10002630
call fcn.1005d89a
ret 0x18
Function at 0x10036abf
Capabilities:
Check if file exists

Disassembly:
push 0x50
mov eax, 0x101dba01
call fcn.1005d8df
mov edi, ecx
call fcn.10021605
mov ecx, eax
call fcn.1005ec4a
push eax
lea ecx, [ebp - 0x40]
call fcn.10002590
and dword [ebp - 4], 0
mov esi, str.LatelyCharFace.xml
push esi
call fcn.100802ff
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.100042e0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1006fd0f
pop ecx
pop ecx
xor ebx, ebx
lea esi, [edi + 0x338]
inc ebx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], bl
cmp esi, eax
je 0x10036b2a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.1001d44e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10036b73
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x58]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.1001c8a9
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.100382bd
push 0
push ebx
lea ecx, [ebp - 0x58]
call fcn.1001d28d
jmp 0x10036c24
push 0x48
call fcn.1005d503
pop ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x10036b9e
cmp dword [esi + 0x14], 0x10
jb 0x10036b90
mov ecx, dword [esi]
jmp 0x10036b92
mov ecx, esi
push ecx
mov ecx, eax
call fcn.10059360
mov edi, eax
jmp 0x10036ba0
xor edi, edi
push 0x38
mov byte [ebp - 4], bl
call fcn.1005d503
pop ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x10036bce
push 0x1026dfb3
push 0x101e69b4
push 0x101e69bc
mov ecx, eax
call fcn.10059250
jmp 0x10036bd0
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.1005a1c0
push 0x50
call fcn.1005d503
pop ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x10036bfc
push 0x101e9040
mov ecx, eax
call fcn.10059540
jmp 0x10036bfe
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.1005a1c0
cmp dword [esi + 0x14], 0x10
jb 0x10036c11
mov esi, dword [esi]
push esi
mov ecx, edi
call fcn.1005abe0
test edi, edi
je 0x10036c24
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax]
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.1001d28d
push 0
push ebx
lea ecx, [ebp - 0x40]
call fcn.10002630
mov eax, ebx
call fcn.1005d89a
ret
Function at 0x1003900e
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x101de212
call fcn.1005d8df
mov esi, ecx
mov eax, dword [ebp + 8]
push 0
push eax
call fcn.1005ee35
push str.WanNengWBInfo.ini
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.10029243
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [esi + 0x1b0]
push eax
push str.guanf
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esi + 0x2c]
cmp dword [eax + 0x14], 8
jb 0x10039087
mov eax, dword [eax]
push str.Config.ini
push str.Config
push eax
lea eax, [ebp - 0x218]
push 0x101e67c8
push eax
call fcn.10021c56
add esp, 0x14
cmp word [ebp - 0x218], 0
jne 0x100390b4
xor eax, eax
jmp 0x100390c1
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x198]
call fcn.100026f0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.10002630
xor eax, eax
inc eax
call fcn.1005d89a
ret 4

Function at 0x1003a31c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.10021605
mov ecx, eax
call fcn.1005ec3e
lea esi, [edi + 0x33c]
push eax
mov ecx, esi
call fcn.100026a0
mov ebx, str.ConfigConfig.ini
push ebx
call fcn.100802ff
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.100042e0
cmp dword [esi + 0x14], 8
jb 0x1003a36d
mov eax, dword [esi]
jmp 0x1003a36f
mov eax, esi
push eax
push 0
push str.DateTimeWndLeftPos
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esi + 0x14], 8
mov ebx, eax
jb 0x1003a38c
mov esi, dword [esi]
push esi
push 0
push str.DateTimeWndTopPos
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10078730
push 0x101e69d0
lea eax, [ebp - 0x20c]
push 0x101e9cac
push eax
call fcn.10021c56
add esp, 0x18
lea eax, [ebp - 0x20c]
xor ecx, ecx
push ecx
push 0x14a
push 0x1e0
push ecx
push ecx
push 0x8040108
push 0x10ce0000
push eax
push ecx
mov ecx, edi
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
test ebx, ebx
jne 0x1003a408
test esi, esi
jne 0x1003a408
mov ecx, edi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CWindowWnd::CenterWindow_void_]
jmp 0x1003a41b
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
push ebx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x80
mov ecx, edi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CWindowWnd::SetIcon_unsigned_int_]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x1003a444
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x34
mov eax, 0x101db4d6
call fcn.1005d8df
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov esi, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1006fd0f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10021d0d
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.1001d28d
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1003a52a
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1003a4bd
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x1003a4c5
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1003a52a
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x1003a4bd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
inc eax
push eax
push ecx
push eax
push edx
call fcn.1003a548
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, 0xa2
push ebx
push ebx
push ebx
push edi
call esi
push ebx
push ebx
push ebx
push 0x56
call esi
push ebx
push 2
push ebx
push 0x56
call esi
push ebx
push 2
push ebx
push edi
call esi
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.1001d28d
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.10002630
call fcn.1005d89a
ret 0x18

Function at 0x1003a89a
Capabilities:
Hide graphical window

Disassembly:
push 0x214
mov eax, 0x101dbfc1
call fcn.1005d8df
mov esi, ecx
mov ecx, dword [esi + 0x40]
push 0
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.10078730
add esp, 0xc
push 0x101ea3cc
push str.WnUserPage.exe
call fcn.10021605
mov ecx, eax
call fcn.100416a6
push eax
lea eax, [ebp - 0x218]
push str.__s_s___s
push eax
call fcn.10021c56
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10071ebf
add esp, 0x1c
test eax, eax
je 0x1003a945
lea ecx, [ebp - 0x219]
call fcn.1002c420
and dword [ebp - 4], 0
lea ecx, [ebp - 0x219]
call fcn.1002c9cf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x219]
call sym.Plugin.dll_CleanUpPluginSystemManager
mov ecx, dword [esi + 0x40]
push 5
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1005d89a
ret
Function at 0x1003acf2
Capabilities:
Read .ini file

Disassembly:
push 0x100
mov eax, 0x101dc12a
call fcn.1005d8df
mov edi, ecx
xor ebx, ebx
push ebx
push dword [edi + 0x530]
push ebx
push ebx
push ecx
mov eax, esp
lea ecx, [edi + 0x534]
mov dword [eax], 0x101e9f28
call dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CDialogBuilder::Create_class_DuiLib::STRINGorID__wchar_t_const___class_DuiLib::IDialogBuilderCallback___class_DuiLib::CPaintManagerUI___class_DuiLib::CControlUI__]
lea ecx, [edi + 0x4b8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov ecx, dword [edi + 0x530]
mov esi, dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
push str.question_title
call esi
mov ecx, dword [edi + 0x530]
push str.question_context
mov dword [edi + 0x680], eax
call esi
mov ecx, dword [edi + 0x530]
push str.contact_info
mov dword [edi + 0x67c], eax
call esi
mov ecx, dword [edi + 0x530]
push str.btn_question_feed
mov dword [edi + 0x684], eax
call esi
mov ecx, dword [edi + 0x530]
push str.btn_function_advice
mov dword [edi + 0x688], eax
call esi
mov ecx, dword [edi + 0x530]
push str.btn_add_img
mov dword [edi + 0x68c], eax
call esi
mov ecx, dword [edi + 0x530]
push str.btn_submit
mov dword [edi + 0x690], eax
call esi
mov ecx, dword [edi + 0x530]
push str.fjname
mov dword [edi + 0x694], eax
call esi
mov ecx, dword [edi + 0x694]
mov dword [edi + 0x698], eax
test ecx, ecx
je 0x1003ade0
mov eax, dword [ecx]
push ebx
call dword [eax + 0xe4]
mov ecx, dword [edi + 0x67c]
xor esi, esi
inc esi
test ecx, ecx
je 0x1003ae3b
push 0x1f4
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CRichEditUI::SetLimitText_int_]
push ebx
lea eax, [ebp - 0xf0]
mov ecx, edi
push eax
call fcn.1003a99d
mov ecx, dword [edi + 0x67c]
lea edx, [ebp - 0xf0]
cmp dword [ebp - 0xdc], 8
mov dword [ebp - 4], ebx
cmovae edx, dword [ebp - 0xf0]
mov eax, dword [ecx]
push edx
call dword [eax + 0x2c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
push ebx
push esi
call fcn.10002630
mov ecx, edi
lea eax, [edi + 0x51c]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, dword [edi + 0x530]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CPaintManagerUI::AddNotifier_class_DuiLib::INotifyUI__]
push 0xc8
lea eax, [ebp - 0xd8]
push ebx
push eax
call fcn.10078730
add esp, 0xc
call fcn.10021605
mov ecx, eax
call fcn.100416c5
push eax
push 0x64
lea eax, [ebp - 0xd8]
push eax
push 0x1026dd78
push str.LoginType
push str.UserLogin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.100760de
push ebx
push 0x9c
lea ecx, [ebp - 0x108]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x10]
lea eax, [ebp - 0xd8]
push str.guanfang
push eax
call fcn.10086563
pop ecx
pop ecx
test eax, eax
jne 0x1003aed4
cmp dword [ebp - 0xf8], eax
jbe 0x1003aed4
mov dword [edi + 0x6c0], esi
push ebx
push esi
lea ecx, [ebp - 0x108]
call fcn.10002630
call fcn.1005d89a
ret