joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a85b
Capabilities:
Check if file exists

Disassembly:
push 0x98
mov eax, 0x5f183a
call fcn.0044ea40
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
lea eax, [edi + 0xc]
push eax
call fcn.004021d9
lea eax, [ebp - 0x88]
xor ebx, ebx
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
push eax
call fcn.0052bf7a
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.005400a1
lea ecx, [ebp - 0x58]
push ecx
push 0x9b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
call fcn.005400a1
lea ecx, [ebp - 0x58]
push ecx
push 0x9c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040222d
lea esi, [edi + 0x110]
mov byte [ebp - 4], 2
push esi
call fcn.00546050
pop ecx
test eax, eax
je 0x40a921
push esi
lea ecx, [ebp - 0x28]
call fcn.004021d9
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0052bf7a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.004044cb
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004037bf
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040376a
call fcn.005400a1
lea ecx, [ebp - 0x70]
push ecx
push 0x9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ecx, [ebp - 0xa4]
call fcn.00419613
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0040777b
mov esi, 0x5faf84
test al, al
mov ecx, esi
mov ebx, 0x5faf88
cmove ecx, ebx
push ecx
push str.is_vip
lea ecx, [ebp - 0xa4]
call fcn.0041b5c0
mov ecx, edi
call fcn.0040a79f
test al, al
lea ecx, [ebp - 0xa4]
cmove esi, ebx
push esi
push str.is_super_vip
call fcn.0041b5c0
lea eax, [edi + 0x41c]
push eax
lea ecx, [ebp - 0x28]
call fcn.004021d9
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0052bf7a
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 6
jb 0x40a9b9
mov eax, dword [eax]
push eax
push str.ex_time
lea ecx, [ebp - 0xa4]
call fcn.0041b5c0
xor ebx, ebx
lea ecx, [ebp - 0x40]
xor esi, esi
push ebx
inc esi
push esi
call fcn.004037bf
push ebx
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0040376a
add edi, 0x318
push edi
call fcn.00546050
pop ecx
test eax, eax
je 0x40aa70
push edi
lea ecx, [ebp - 0x40]
call fcn.004021d9
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0052bf7a
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 9
call fcn.0040376a
call fcn.00403028
mov ecx, eax
call fcn.005165e5
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov esi, eax
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40aa63
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
push str.UserFace
push str.UserLogin
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor esi, esi
lea ecx, [ebp - 0x28]
push ebx
inc esi
push esi
call fcn.004037bf
lea ecx, [ebp - 0xa4]
call fcn.00419696
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.004037bf
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.004037bf
push ebx
push esi
lea ecx, [ebp - 0x88]
call fcn.0040376a
call fcn.0044e9ea
ret
Function at 0x40c005
Capabilities:
Check if file exists
Move file

Disassembly:
push 0x3c
mov eax, 0x5f1a3f
call fcn.0044ea40
call fcn.00403028
mov ecx, eax
call fcn.0052f6f4
push eax
lea ecx, [ebp - 0x28]
call fcn.00404479
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push 8
pop esi
cmp dword [ebp - 0x14], esi
lea ecx, [ebp - 0x44]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040b24c
push 0x5c
push dword [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00544847
pop ecx
pop ecx
test eax, eax
jne 0x40c059
or eax, 0xffffffff
jmp 0x40c05e
sub eax, dword [ebp - 0x44]
sar eax, 1
inc eax
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040ba53
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0040b29f
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.0040bbcd
push str..temp
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040b146
add esp, 0xc
cmp dword [ebp - 0x2c], esi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c0d4
cmp dword [ebp - 0x14], esi
lea ecx, [ebp - 0x28]
push 1
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], esi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x8c
push esi
call fcn.0040ba15
mov ecx, eax
call fcn.0040f11d
inc eax
push eax
push esi
call fcn.0040ba15
mov ecx, eax
call fcn.0041146b
inc esi
push esi
call fcn.0040ba15
mov ecx, eax
call fcn.0040f11d
inc eax
push eax
push esi
call fcn.0040ba15
mov ecx, eax
call fcn.0041146b
mov esi, 0x8e
push esi
call fcn.0040ba15
mov ecx, eax
call fcn.0040f11d
inc eax
push eax
push esi
call fcn.0040ba15
mov ecx, eax
call fcn.0041146b
call fcn.0040ba15
mov ecx, eax
call fcn.004108c5
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.004037bf
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.0040bbcd
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004037bf
call fcn.0044e9ea
ret
Function at 0x40c252
Capabilities:
Move file

Disassembly:
push 0x80
mov eax, 0x5f1a8f
call fcn.0044ea40
mov edi, ecx
mov esi, dword [ebp + 8]
call fcn.00403028
mov ecx, eax
call fcn.0051648a
push eax
lea ecx, [ebp - 0x88]
call fcn.00404479
and dword [ebp - 4], 0
lea eax, [ebp - 0x88]
push str.User.zconf
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040b146
push str.ConfigTemp_
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040b146
add esp, 0x18
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
mov ecx, edi
push eax
push esi
call fcn.0040ca64
test al, al
jne 0x40c2d4
xor bl, bl
xor esi, esi
jmp 0x40c384
push str.Config.ini
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040b146
add esp, 0xc
mov byte [ebp - 4], 3
call fcn.00403028
mov ecx, eax
call fcn.0052f6f4
push eax
lea ecx, [ebp - 0x40]
call fcn.00404479
mov esi, str..temp
mov byte [ebp - 4], 4
push esi
call fcn.00546031
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.004049a5
push 8
pop esi
cmp dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x40]
push 1
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], esi
push ecx
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x44], esi
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.00527ffa
cmp dword [ebp - 0x14], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.00404479
call fcn.00526658
add esp, 0x18
lea ecx, [ebp - 0x40]
xor esi, esi
mov bl, 1
push esi
push 1
call fcn.004037bf
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.004037bf
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.004037bf
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.004037bf
push esi
push 1
lea ecx, [ebp - 0x88]
call fcn.004037bf
mov al, bl
call fcn.0044e9ea
ret 4
Function at 0x40c3b2
Capabilities:
Check if file exists

Disassembly:
push 0x460
mov eax, 0x5f1ad8
call fcn.0044ea40
mov edi, ecx
mov esi, dword [ebp + 8]
call fcn.00403028
mov ecx, eax
call fcn.0051648a
push eax
lea ecx, [ebp - 0x468]
call fcn.00404479
push str.User.zmb
lea eax, [ebp - 0x468]
xor ebx, ebx
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 4], ebx
push eax
call fcn.0040b146
push str.MBTemp_
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.0040b146
add esp, 0x18
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x450]
mov ecx, edi
push eax
push esi
call fcn.0040ca64
test al, al
je 0x40c525
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push ebx
push eax
call fcn.00543220
add esp, 0xc
call fcn.00403028
mov ecx, eax
call fcn.00516496
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0054f904
lea eax, [ebp - 0x218]
push str.WnDictManager.exe
push eax
call fcn.0054f904
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c4e2
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00543220
lea eax, [ebp - 0x420]
push 0x5fbdec
push eax
call fcn.0054f904
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0054f904
lea eax, [ebp - 0x420]
push 0x5fbdf0
push eax
call fcn.0054f904
lea eax, [ebp - 0x420]
push eax
call fcn.005302fc
add esp, 0x28
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push eax
call fcn.00527ffa
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.00404479
call fcn.00526658
add esp, 0x18
mov bl, 1
xor esi, esi
lea ecx, [ebp - 0x438]
push esi
push 1
call fcn.004037bf
push esi
push 1
lea ecx, [ebp - 0x450]
call fcn.004037bf
push esi
push 1
lea ecx, [ebp - 0x468]
call fcn.004037bf
mov al, bl
call fcn.0044e9ea
ret 4

Function at 0x40c55b
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x5f1b08
call fcn.0044ea0c
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x40c574
mov eax, dword [edi]
jmp 0x40c576
mov eax, edi
push eax
call fcn.00527ffa
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00532721
mov eax, dword [ebp - 0x14]
add esp, 0xc
sub eax, dword [ebp - 0x18]
cdq
push 0x18
pop ecx
idiv ecx
test eax, eax
je 0x40c5ee
xor ebx, ebx
lea ecx, [ebp + 0xf]
inc ebx
push ebx
push edi
push dword [ebp - 0x18]
call fcn.00534390
test eax, eax
je 0x40c5ee
mov esi, dword [ebp - 0x18]
jmp 0x40c5e4
cmp dword [esi + 0x14], 8
jb 0x40c5cc
mov eax, dword [esi]
jmp 0x40c5ce
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c5e4
push ebx
push edi
push esi
lea ecx, [ebp + 0xf]
call fcn.00533fb0
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x40c5c2
jmp 0x40c5f0
xor bl, bl
lea ecx, [ebp - 0x18]
call fcn.0040928e
mov al, bl
call fcn.0044e9d5
ret 8
Function at 0x40c602
Capabilities:
Copy file

Disassembly:
push 0x68
mov eax, 0x5f1b3b
call fcn.0044ea40
mov ebx, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x40c61d
mov eax, dword [esi]
jmp 0x40c61f
mov eax, esi
push eax
call fcn.00527ffa
pop ecx
call fcn.00403028
mov ecx, eax
call fcn.0051648a
push eax
lea ecx, [ebp - 0x28]
call fcn.00404479
xor eax, eax
mov edi, str.ConfigTemp_
push edi
mov dword [ebp - 4], eax
call fcn.00546031
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004049a5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00404479
call fcn.00526658
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00524cdd
and dword [ebp - 0x48], 0
add esp, 0x1c
xor eax, eax
mov word [ebp - 0x58], ax
push 7
pop ecx
mov dword [ebp - 0x44], ecx
and dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 2
call fcn.00403028
mov ecx, eax
call fcn.0052f6f4
mov edi, eax
xor eax, eax
cmp word [edi], ax
je 0x40c6bf
push edi
call fcn.00546031
pop ecx
push eax
push edi
lea ecx, [ebp - 0x58]
call fcn.00403bdf
push str.Config.ini
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040b146
add esp, 0xc
lea ecx, [ebp - 0x40]
push eax
call fcn.004044cb
xor edi, edi
lea ecx, [ebp - 0x70]
push edi
push 1
call fcn.004037bf
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push edi
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0040c55b
cmp byte [ebp + 0xc], 0
mov bl, al
je 0x40c739
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
call fcn.00524e0e
pop ecx
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.004037bf
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004037bf
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.004037bf
mov al, bl
call fcn.0044e9ea
ret 8
Function at 0x40c764
Capabilities:
Check if file exists

Disassembly:
push 0x430
mov eax, 0x5f1b6b
call fcn.0044ea40
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x40c782
mov eax, dword [esi]
jmp 0x40c784
mov eax, esi
push eax
call fcn.00527ffa
pop ecx
call fcn.00403028
mov ecx, eax
call fcn.0051648a
push eax
lea ecx, [ebp - 0x438]
call fcn.00404479
and dword [ebp - 4], 0
mov ebx, str.MBTemp_
push ebx
call fcn.00546031
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x438]
call fcn.004049a5
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00404479
call fcn.00526658
mov ebx, 0x208
lea eax, [ebp - 0x218]
push ebx
push 0
push eax
call fcn.00543220
add esp, 0x24
call fcn.00403028
mov ecx, eax
call fcn.00516496
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0054f904
lea eax, [ebp - 0x218]
push str.WnDictManager.exe
push eax
call fcn.0054f904
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c88c
push ebx
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00543220
lea eax, [ebp - 0x420]
push 0x5fbdec
push eax
call fcn.0054f904
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0054f904
lea eax, [ebp - 0x420]
push str.__ExportUserMb
push eax
call fcn.0054f904
lea eax, [ebp - 0x420]
push eax
call fcn.005302fc
add esp, 0x28
push esi
lea eax, [ebp - 0x438]
mov ecx, edi
push eax
call fcn.0040c55b
cmp byte [ebp + 0xc], 0
mov bl, al
je 0x40c8be
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
cmovae ecx, dword [ebp - 0x438]
push ecx
call fcn.00524e0e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.004037bf
mov al, bl
call fcn.0044e9ea
ret 8

Function at 0x40c8d7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x40c8e9
mov eax, dword [edi]
jmp 0x40c8eb
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c8fa
xor al, al
jmp 0x40c93e
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x40c907
mov eax, dword [esi]
jmp 0x40c909
mov eax, esi
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00404479
call fcn.00526658
add esp, 0x18
cmp dword [esi + 0x14], 8
jb 0x40c926
mov eax, dword [esi]
jmp 0x40c928
mov eax, esi
push eax
call fcn.00524cdd
pop ecx
push esi
push edi
lea ecx, [ebp + 0xb]
call fcn.005344a0
test eax, eax
setne al
pop edi
pop esi
pop ebp
ret 8

Function at 0x40e0b5
Capabilities:
Read .ini file

Disassembly:
call fcn.0040ba15
mov ecx, eax
jmp fcn.004108c5
Function at 0x410c56
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6a1564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x414]
push esi
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x418], ebx
call fcn.00543220
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00543220
mov eax, dword [ebx + 0x24]
add esp, 0x18
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x41c], ecx
cmp ecx, eax
je 0x410dc6
mov esi, ebx
push edi
mov ebx, dword [ecx + 0x14]
lea edi, [ebx + 0xc]
push edi
call fcn.00546031
pop ecx
test eax, eax
jle 0x410da9
push edi
lea eax, [ebp - 0x414]
push str.Is_s
push eax
call fcn.00404de4
mov esi, dword [ebp - 0x418]
add esp, 0xc
add esi, 0x78
cmp dword [esi + 0x14], 8
jb 0x410cee
mov eax, dword [esi]
jmp 0x410cf0
mov eax, esi
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x5fc2c8
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push 0x5fc2c8
push eax
call fcn.0054ab2b
pop ecx
pop ecx
test eax, eax
je 0x410d3d
lea eax, [ebp - 0x20c]
push eax
call fcn.0054fc97
pop ecx
mov ecx, dword [ebx + 4]
mov byte [ecx], al
push edi
lea eax, [ebp - 0x414]
push str.Use_s
push eax
call fcn.00404de4
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x410d5a
mov esi, dword [esi]
push esi
push 0x104
lea eax, [ebp - 0x20c]
mov esi, str.nothing
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0054ab2b
pop ecx
pop ecx
test eax, eax
je 0x410da3
lea eax, [ebp - 0x20c]
push eax
push dword [ebx + 8]
call fcn.0054ab6b
pop ecx
pop ecx
mov esi, dword [ebp - 0x418]
lea ecx, [ebp - 0x41c]
call fcn.0051fd9e
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [eax]
jne 0x410cb1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9c4
mov esp, ebp
pop ebp
ret

Function at 0x411f94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
sub eax, 0x201
je 0x411fc3
sub eax, 9
jne 0x41200e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x41200e
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
jmp 0x41200e
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ebx
movzx eax, bx
shr edi, 0x10
push edi
push eax
mov dword [ebp + 8], eax
lea eax, [esi + 0x2f4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x41200c
push edi
push dword [ebp + 8]
lea eax, [esi + 0x304]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x41200c
push ebx
push 2
push 0xa1
lea ecx, [esi - 0x24]
call dword [sym.imp.DuiLib32.dll_public:_long_int___thiscall_DuiLib::CWindowWnd::PostMessageW_unsigned_int__unsigned_int__long_int_]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x415da8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
sub eax, 0x3ea
je 0x415de8
sub eax, 1
je 0x415dd6
sub eax, 1
je 0x415dcf
sub eax, 1
jne 0x415e07
call fcn.0041616f
jmp 0x415e07
call fcn.00415e7e
jmp 0x415e07
xor esi, esi
push esi
call fcn.00416587
push esi
push esi
push edi
push 0x414fd8
jmp 0x415df8
xor esi, esi
push esi
call fcn.00416587
push esi
push esi
push edi
push 0x416621
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 4
Function at 0x415f6a
Capabilities:
Create thread

Disassembly:
push 0xa0
mov eax, 0x5f2789
call fcn.0044ea40
mov edi, ecx
mov esi, dword [ebp + 8]
lea edx, [ebp - 0xac]
push edx
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x108]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp eax, dword [edi + 0x334]
jne 0x415fc8
push 1
mov ecx, edi
call fcn.00414d13
push 2
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 1
call fcn.00415ad5
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_]
jmp 0x41613c
cmp eax, dword [edi + 0x338]
jne 0x415fe5
push ebx
mov ecx, edi
call fcn.00416587
push ebx
push ebx
push edi
push 0x416571
jmp 0x4160ef
cmp eax, dword [edi + 0x33c]
jne 0x4160af
push ebx
push 0x54
call fcn.0040ba15
mov ecx, eax
call fcn.0041146b
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push 7
pop ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push eax
mov esi, 0x5faef8
mov word [ebp - 0x28], ax
push esi
call fcn.00403bdf
mov byte [ebp - 4], 1
call fcn.005400a1
lea ecx, [ebp - 0x28]
push ecx
push 0x9b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004037bf
call fcn.005400a1
push 0
push 0x9d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 4]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x28]
xor ebx, ebx
xor eax, eax
push ebx
push esi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00403bdf
mov byte [ebp - 4], 2
call fcn.005400a1
lea ecx, [ebp - 0x28]
push ecx
push 0x9f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004037bf
push 0xffffffffffffffff
mov ecx, edi
call fcn.00414d13
mov ecx, edi
call fcn.0041616f
jmp 0x41613c
cmp eax, dword [edi + 0x340]
jne 0x4160be
mov esi, str.UpUserMB
jmp 0x4160cb
cmp eax, dword [edi + 0x344]
jne 0x416100
mov esi, str.DownUserMB
push esi
call fcn.00546031
pop ecx
push eax
push esi
lea ecx, [edi + 0x2ec]
call fcn.00403bdf
push ebx
mov ecx, edi
call fcn.00416587
push ebx
push ebx
push edi
push 0x414cd6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41613c
cmp eax, dword [edi + 0x348]
jne 0x41610f
push 0x3ea
jmp 0x41611c
cmp eax, dword [edi + 0x34c]
jne 0x416125
push 0x3eb
mov ecx, edi
call fcn.00415da8
jmp 0x41613c
cmp eax, dword [edi + 0x328]
je 0x416135
cmp eax, dword [edi + 0x32c]
jne 0x41613c
mov ecx, edi
call fcn.004164fb
push str.OnBind
lea ecx, [ebp - 0xac]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
test al, al
je 0x416158
mov ecx, edi
call fcn.00415e0d
lea ecx, [ebp - 0xac]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
call fcn.0044e9ea
ret 4
Function at 0x41abed
Capabilities:
Read .ini file

Disassembly:
push 0x280
mov eax, 0x5f2f5e
call fcn.0044ea40
mov dword [ebp - 0x258], ecx
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x1dc]
push ebx
push eax
call fcn.00543220
add esp, 0xc
call fcn.00403028
mov ecx, eax
call fcn.005165e5
mov esi, eax
call fcn.005400a1
push ebx
mov edi, 0x9b
lea ecx, [ebp - 0x1f4]
push edi
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 0x10]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1e4], ebx
jne 0x41acac
push esi
push 0x64
lea eax, [ebp - 0xd8]
push eax
push 0x5faef8
push 0x5fafe4
push str.UserLogin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xd8], bx
jne 0x41ac78
mov eax, ebx
jmp 0x41ac85
lea eax, [ebp - 0xd8]
push eax
call fcn.00546031
pop ecx
push eax
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x1f4]
call fcn.00403bdf
call fcn.005400a1
lea ecx, [ebp - 0x1f4]
push ecx
push edi
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push str.http:__theuser.wnwb.com_user_mutual_member_getuserinfo.php
lea ecx, [ebp - 0x20c]
call fcn.004021d9
xor eax, eax
lea ecx, [ebp - 0x28c]
inc eax
mov byte [ebp - 4], al
call fcn.00533388
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0052c265
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x41acee
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1dc]
push 0x5fe124
push eax
call fcn.004041c3
add esp, 0xc
lea ecx, [ebp - 0x254]
xor edi, edi
inc edi
push ebx
push edi
call fcn.0040376a
lea ecx, [ebp - 0x23c]
call fcn.0040cf6b
mov esi, 0x5fb524
mov byte [ebp - 4], 3
push esi
call fcn.00546050
pop ecx
push eax
push esi
lea ecx, [ebp - 0x23c]
call fcn.00403ad1
cmp byte [ebp - 0x1dc], 0
jne 0x41ad48
mov eax, ebx
jmp 0x41ad55
lea eax, [ebp - 0x1dc]
push eax
call fcn.00546050
pop ecx
push eax
lea eax, [ebp - 0x1dc]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403ad1
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x28c]
call fcn.00519a6e
cmp dword [ebp - 0x1f8], 0x10
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x28c]
cmovae eax, dword [ebp - 0x20c]
push eax
call fcn.0053357e
lea ecx, [ebp - 0x28c]
call fcn.00533773
mov ebx, eax
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
cmove esi, edi
add esi, 2
push esi
call fcn.00421070
push esi
xor esi, esi
mov edi, eax
push esi
push edi
call fcn.00543220
mov ecx, dword [ebx + 4]
add esp, 0x10
mov edx, esi
sub ecx, dword [ebx]
je 0x41ade2
mov eax, dword [ebx]
mov al, byte [edx + eax]
mov byte [edx + edi], al
inc edx
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cmp edx, eax
jb 0x41add0
test edi, edi
je 0x41adf9
mov ecx, dword [ebp - 0x258]
push edi
call fcn.004197b2
push edi
call fcn.00421079
pop ecx
lea ecx, [ebp - 0x23c]
call fcn.0040af20
lea ecx, [ebp - 0x28c]
call fcn.005333c9
xor ebx, ebx
lea ecx, [ebp - 0x20c]
push esi
inc ebx
push ebx
call fcn.0040376a
push esi
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.004037bf
xor eax, eax
call fcn.0044e9ea
ret