joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056a40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008330c
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100d9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x100e11d0
call fcn.10063695
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10056a81
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x10056a95
mov al, 1
jmp 0x10056bcf
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10056a9f
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000ee00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10056830
mov ebx, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.1000f080
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
cmp ebx, 0xffffffff
jne 0x10056ae8
xor al, al
jmp 0x10056bcf
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10056af2
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000ee00
mov dword [ebp - 4], 5
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.10056750
mov bl, al
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.1000f080
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x10056ae1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10056b3c
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x10056a8e
lea ecx, [ebp - 0x28]
call fcn.10016820
mov dword [ebp - 4], 0xa
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10056dd0
test al, al
je 0x10056b7a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x10056b7a
mov bl, 1
jmp 0x10056bb0
cmp dword [esi + 0x14], 8
jb 0x10056b82
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x48]
call fcn.1000ee00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x48]
mov edx, dword [ebp - 0x30]
call fcn.10056750
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x48]
call fcn.1000f080
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 0xa
xor bl, bl
mov dword [ebp - 4], 0x14
lea ecx, [ebp - 0x28]
call fcn.1000f080
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006161e
mov esp, ebp
pop ebp
ret
Function at 0x1005b7a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100d9008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, dword [esp + 0x20]
mov ecx, 0x100e11d0
call fcn.10063695
mov esi, dword [esp + 0x24]
xor ebx, ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x1005b822
mov ecx, 0x100000
nop dword [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x1005b822
test ecx, ecx
je 0x1005b81e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1005b7e0
xor eax, eax
jmp 0x1005b827
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1005b831
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006161e
add esp, 0xc
ret 0xc

Function at 0x1005eee0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100d9008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x100e11d0
push edi
mov edi, dword [esp + 0x14]
call fcn.10063695
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1005ef51
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1005ef2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1005ef51
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1006161e
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.1006161e
add esp, 8
ret 4
Function at 0x10060f00
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100856b8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100d9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, 0x100e11d0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], ebx
call fcn.10063695
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10060f56
mov dword [eax], 0
mov dword [ebx], 0
cmp dword [edi], 0xffffffff
je 0x100610ab
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
nop dword [eax]
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x10061076
test eax, eax
je 0x10061076
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x10061079
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x28], eax
cmp ecx, 0xffffffff
je 0x10060ffb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10060fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10060ffb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x10061009
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x28]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.10010ef0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x10061076
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x10060fb4
jmp 0x10061079
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
add dword [ecx], edx
test eax, eax
jne 0x100610a2
test edx, edx
je 0x1006109e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x10060f70
mov al, 1
jmp 0x100610ad
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x100610ab
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006161e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000149c
pop dword [ebp - 0x34]
mov eax, 0x1000149c
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3d0c913d
sub dword [ebp - 0x44], 0xeeba4bf2
mov dword [ebp - 0x40], 0xa88f6600
sub dword [ebp - 0x40], 0x765c19bb
mov dword [ebp - 0x3c], 0x8f977aea
sub dword [ebp - 0x3c], 0x434b36bc
mov dword [ebp - 0x38], 0x33645cc1
sub dword [ebp - 0x38], 0x33645cc1
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xf760c8b
add dword [ebp - 0x44], 0x64fc5ccb
mov dword [ebp - 0x40], 0x5ffee4ab
sub dword [ebp - 0x40], 0x1e928336
mov dword [ebp - 0x3c], 0x7079c49c
add dword [ebp - 0x3c], 0xf2f5a7d0
mov dword [ebp - 0x38], 0xde8b3d22
sub dword [ebp - 0x38], 0xde8b3d22
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x41cf6eec
sub eax, 0x31cf5eac
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3828f
push 0
call eax
mov ecx, 0x4eb9
mov esi, eax
mov edi, 0xd7f4f8c2
sub edi, 0xc7f4a6c2
add edi, dword [ebp - 0x34]
mov ebx, 0xda81cf71
sub ebx, 0xa171367e
xor dword [ebp - 0xc], edx
mov edx, dword [edi]
xor dword [ebp - 0x2c], 0x30fb4349
xor edx, ebx
mov dword [esi], edx
add esi, 0x46b1505
sub esi, 0x46b1501
add edi, 0x61f6d69a
add edi, 0x9e09296a
loop 0x100015ae
add eax, 0x12db7
mov ebx, eax
add eax, 0x7949715d
sub eax, 0x79497158
mov ecx, 0xb884aa97
sub ecx, 0xa884aa97
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4010b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fc3f2
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x5364a8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov ecx, esi
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_void_]
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
call fcn.0046ffa0
mov dword [esp + 0x38], 1
cmp dword [eax + 0x1c], 8
jb 0x401112
mov eax, dword [eax + 8]
jmp 0x401115
add eax, 8
push eax
push str._sdata
push esi
call dword [sym.imp.LibDui.dll_public:_int___cdecl_DuiLib::CDuiString::Format_wchar_t_const__]
add esp, 0xc
mov byte [esp + 0x38], bl
cmp dword [esp + 0x2c], 8
jb 0x40113d
mov eax, dword [esp + 0x18]
push eax
call fcn.0047c2f0
add esp, 4
xor ecx, ecx
mov word [esp + 0x18], cx
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
call fcn.00401050
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret
Function at 0x404a90
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x501cea
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5364a8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
lea esi, [edi + 0xd1c]
lea eax, [esp + 0x1c]
mov dword [edi + 0xf04], 0
call fcn.00404b20
lea eax, [esp + 8]
push eax
push 0
push edi
push 0x404c70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x18], 0xffffffff
call fcn.004046b0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1a4

Function at 0x404d00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0xd18]
cmp eax, 1
jne 0x404d6a
push esi
call fcn.004057f0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0xbb9
mov ecx, edi
call dword [sym.imp.LibDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x405180
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xf04], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x404d7c
call fcn.00404a20
mov edx, dword [ebp + 0x10]
push edx
push 2
jmp 0x404d97
cmp eax, 3
jne 0x404d8e
call fcn.00404a20
mov eax, dword [ebp + 0x10]
push eax
push 3
jmp 0x404d97
test eax, eax
jne 0x404dab
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push 0xbb9
mov ecx, edi
call dword [sym.imp.LibDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405cc0
Capabilities:
Get routing table

Disassembly:
sub esp, 8
push edi
push 1
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x405d7c
mov ecx, dword [esp + 4]
push ebx
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 1
lea edx, [esp + 0xc]
mov ebx, eax
push edx
push ebx
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x405d72
push esi
xor esi, esi
cmp dword [ebx], edi
jbe 0x405d60
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_inet_addr]
lea edi, [ebx + 8]
mov eax, dword [esp + 0x1c]
push eax
call ebp
cmp dword [edi - 4], eax
jne 0x405d2d
mov ecx, dword [esp + 0x20]
push ecx
call ebp
cmp dword [edi], eax
je 0x405d37
inc esi
add edi, 0x38
cmp esi, dword [ebx]
jb 0x405d16
jmp 0x405d5b
push 0x38
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edx, [esi*8]
sub edx, esi
lea esi, [ebx + edx*8 + 4]
mov ecx, 0xe
mov edi, eax
mov dword [esp + 0x14], eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebx
mov eax, edi
pop edi
add esp, 8
ret 8
pop ebx
mov eax, edi
pop edi
add esp, 8
ret 8
mov eax, edi
pop edi
add esp, 8
ret 8

Function at 0x405d90
Capabilities:
Get routing table

Disassembly:
sub esp, 8
push esi
push 1
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x405e6b
mov ecx, dword [esp + 4]
push ebx
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 1
lea edx, [esp + 0xc]
mov ebx, eax
push edx
push ebx
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x405e61
push edi
xor edi, edi
cmp dword [ebx], esi
jbe 0x405e4f
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_inet_addr]
lea esi, [ebx + 8]
lea ebx, [ebx]
push str.255.255.255.255
call ebp
cmp dword [esi - 4], eax
jne 0x405e1c
push str.255.255.255.255
call ebp
cmp dword [esi], eax
jne 0x405e1c
mov eax, dword [esp + 0x1c]
push eax
call ebp
cmp dword [esi + 8], eax
jne 0x405e1c
mov ecx, dword [esp + 0x20]
cmp dword [esi + 0xc], ecx
je 0x405e26
inc edi
add esi, 0x38
cmp edi, dword [ebx]
jb 0x405df0
jmp 0x405e4a
push 0x38
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edx, [edi*8]
sub edx, edi
lea esi, [ebx + edx*8 + 4]
mov ecx, 0xe
mov edi, eax
mov dword [esp + 0x14], eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov eax, esi
pop esi
add esp, 8
ret 8
pop ebx
mov eax, esi
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x405e80
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x19c
mov eax, dword [0x5364a8]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x101
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x405ee2
test esi, esi
jne 0x405ec7
push 0x43c
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.invalid_null_pointer
call fcn.00479bd0
add esp, 0xc
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405ed0
sub eax, edx
push eax
push esi
mov ecx, ebx
call fcn.00402130
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x405f22
test esi, esi
jne 0x405f0a
push 0x43c
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.invalid_null_pointer
call fcn.00479bd0
add esp, 0xc
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405f10
sub eax, edx
push eax
push esi
mov ecx, ebx
call fcn.00402130
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
test esi, esi
jne 0x405f4d
push 0x43c
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.invalid_null_pointer
call fcn.00479bd0
add esp, 0xc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405f52
sub eax, edx
push eax
push esi
mov ecx, ebx
call fcn.00402130
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
xor ecx, esp
call fcn.0047bfe0
add esp, 0x19c
ret
Function at 0x4085b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4f797b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5364a8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0047af10
push 0x1b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCinclude_streambuf
mov dword [esp + 0x24], 0
call fcn.00479ab0
push eax
push 4
call fcn.004799c0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40863b
call fcn.0047a3d0
mov dword [edi], eax
call fcn.0047a1a0
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00479b60
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x408630
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00479ba0
jmp 0x40863d
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x40a0a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f7413
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5364a8]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [0x5364a8]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0
push 0x1c
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x22c], 0
push 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_void_]
lea ecx, [esp + 0xc]
push ecx
push 0x514608
mov dword [esp + 0x228], 0
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.LibDui.dll_public:_int___cdecl_DuiLib::CDuiString::Format_wchar_t_const__]
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0047bfe0
add esp, 0x220
ret
Function at 0x412290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x500d90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5364a8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
and dword [esp + 0x14], 0xfffffe00
mov dword [esp + 0x18], 0
push 1
push 1
lea eax, [esp + 0x14]
push eax
sub esp, 0x20
mov dword [esp + 0x54], 1
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x5131a8
call fcn.00401f10
sub esp, 0x20
mov ecx, esp
mov dword [esp + 0x54], esp
push str.outline
mov byte [esp + 0x78], 2
call fcn.00401f10
mov byte [esp + 0x74], 1
call fcn.0044b2d0
add esp, 0x4c
lea eax, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00460d60
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret
Function at 0x412a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f789b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5364a8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x488
call fcn.0047ef00
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x412ae4
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
mov eax, dword [esp + 0x1c]
mov dword [esi], vtable.CSettingWnd.0
mov dword [esi + 0x10], vtable.CSettingWnd.1.0
mov dword [esi + 0x20], vtable.CSettingWnd.2.0
mov dword [esi + 0x24], vtable.CSettingWnd.3.0
mov dword [esi + 0x28], vtable.CSettingWnd.4.0
mov dword [esi + 0x2c], vtable.CSettingWnd.5.0
mov dword [esi + 0x480], edi
mov dword [esi + 0x484], eax
jmp 0x412ae6
xor esi, esi
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0
push 0
push pe_nt_image_headers32
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [edi + 4]
push str.settingui
push ecx
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
push 0x71
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CWindowWnd::SetIcon_unsigned_int_]
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CWindowWnd::CenterWindow_void_]
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_unsigned_int___thiscall_DuiLib::CWindowWnd::ShowModal_void_]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x417090
Capabilities:
Create thread

Disassembly:
push ecx
inc dword [eax + 0x1bc0]
lea ecx, [esp]
push ecx
push 0
push eax
push 0x417270
push 0
push 0
mov dword [eax + 0x1bbc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret