joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c0
Capabilities:
Create shortcut via ishelllink
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
mov ebx, dword [esp + 0x430]
push ebp
mov ebp, dword [esp + 0x42c]
push esi
mov esi, dword [esp + 0x434]
push 0x200
lea eax, [esp + 0x22c]
push 0
push eax
call fcn.0043f190
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Desktop
push edx
mov dword [esp + 0x30], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
lea ecx, [esp + 0x25]
push 0
push ecx
call fcn.0043f190
mov edx, 0x5c
mov eax, esi
add esp, 0xc
mov word [esp + 0x20], dx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401475
push edi
lea edi, [esp + 0x24]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401484
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x24]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4014a0
mov ecx, dword [0x452750]
mov dl, byte [0x452754]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x24]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4014c0
lea edi, [esp + 0x22c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4014d1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x10]
push eax
push 0x453240
push 1
push 0
push 0x453270
call dword [sym.imp.ole32.dll_CoCreateInstance]
pop edi
test eax, eax
jl 0x401595
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push ebp
push eax
call edx
test ebx, ebx
je 0x401533
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push ebx
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x453260
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x401589
push 0x104
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x234]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x428]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043ee6a
add esp, 0x420
ret
Function at 0x4015b0
Capabilities:
Create directory
Create shortcut via ishelllink
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
mov esi, dword [esp + 0x428]
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40171f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Programs
push ecx
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401626
mov ecx, dword [0x4527b8]
mov edx, dword [0x4527bc]
mov dword [eax], ecx
mov dword [eax + 4], edx
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x18]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401651
mov ecx, dword [0x4527ac]
mov edx, dword [0x4527b0]
mov dword [eax], ecx
mov ecx, dword [0x4527b4]
mov dword [eax + 4], edx
push 0
mov dword [eax + 8], ecx
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 4]
push edx
push 0x453240
push 1
push 0
push 0x453270
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40171f
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x4527a4
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x453260
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x401713
push 0x104
lea ecx, [esp + 0x21c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x24]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x21c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x420]
pop esi
xor ecx, esp
call fcn.0043ee6a
add esp, 0x420
ret
Function at 0x401740
Capabilities:
Create directory
Create shortcut via ishelllink
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
mov esi, dword [esp + 0x428]
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018ba
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Programs
push ecx
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4017b6
mov ecx, dword [0x4527b8]
mov edx, dword [0x4527bc]
mov dword [eax], ecx
mov dword [eax + 4], edx
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x18]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4017e1
mov ecx, dword [0x4527d8]
mov edx, dword [0x4527dc]
mov dword [eax], ecx
mov ecx, dword [0x4527e0]
mov dword [eax + 4], edx
mov dx, word [0x4527e4]
mov dword [eax + 8], ecx
push 0
mov word [eax + 0xc], dx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x453240
push 1
push 0
push 0x453270
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4018ba
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x4527cc
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x453260
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x4018ae
push 0x104
lea ecx, [esp + 0x21c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x24]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x21c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x420]
pop esi
xor ecx, esp
call fcn.0043ee6a
add esp, 0x420
ret
Function at 0x402a10
Capabilities:
Delete registry value
Persist via run registry key
Print debug messages
Set registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, dword [esp + 0x30]
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.00402590
cmp dword [esp + 0x2c], 0
mov eax, dword [esp + 0xc]
je 0x402aaf
cmp dword [esp + 0x20], 0x10
jae 0x402a5e
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402aa2
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a80
sub eax, edx
mov edx, dword [esp + 4]
inc eax
push eax
push esi
push 1
push 0
push str.TXTV
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x402ae6
push 0x45286c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x402af1
cmp dword [esp + 0x20], 0x10
jae 0x402aba
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402af1
mov edx, dword [esp + 4]
push str.TXTV
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x20], 0x10
pop esi
jb 0x402b06
mov ecx, dword [esp + 8]
push ecx
call fcn.0043f32c
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043ee6a
add esp, 0x24
ret
Function at 0x406b90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406bc3
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 0x14]
movzx edx, word [esp + 0x10]
push ebx
push edi
push ecx
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, 1
pop esi
pop ecx
ret

Function at 0x406c10
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
push 0
push 0x45310c
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x79e0
mov edi, eax
call fcn.00408f43
push 0x79e0
mov esi, eax
push 0
push esi
mov dword [0x47c218], esi
call fcn.0043f190
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x79e0
push esi
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [0x47c218]
pop edi
pop esi
pop ecx
ret
Function at 0x407c40
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x44f8fb
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x278], eax
push esi
mov eax, dword [0x47aed0]
xor eax, esp
push eax
lea eax, [esp + 0x284]
mov dword fs:[0], eax
push 0xffffffffffffffff
push 0
push 0x47a2a8
lea ecx, [esp + 0x68]
mov dword [esp + 0x80], 0xf
mov dword [esp + 0x7c], 0
mov byte [esp + 0x6c], 0
call fcn.004024b0
push 0xf
push str._tinxingbox.exe
lea ecx, [esp + 0x64]
mov dword [esp + 0x294], 0
call fcn.004026f0
xor eax, eax
push 0x44
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
call fcn.0043f190
mov eax, dword [esp + 0x6c]
add esp, 0xc
cmp dword [esp + 0x74], 0x10
mov dword [esp + 0x18], 0x44
jae 0x407cf6
lea eax, [esp + 0x60]
push 0x45311c
push eax
lea ecx, [esp + 0x80]
push str.__s___s
push ecx
call fcn.0043f674
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x2000020
push 0
push 0
push 0
lea ecx, [esp + 0x98]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x407d67
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
cmp dword [esp + 0x74], 0x10
jb 0x407d7b
mov edx, dword [esp + 0x60]
push edx
call fcn.0043f32c
add esp, 4
mov ecx, dword [esp + 0x284]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.0043ee6a
add esp, 0x288
ret
Function at 0x407da0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x44f93b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push esi
mov eax, dword [0x47aed0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x31]
push ebx
push eax
mov byte [esp + 0x38], bl
call fcn.0043f190
add esp, 0xc
push 0x104
lea ecx, [esp + 0x30]
push ecx
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x2c]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x407e10
mov edx, dword [0x452e6c]
mov ecx, dword [0x452e70]
mov dword [eax], edx
mov edx, dword [0x452e74]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407e40
sub eax, edx
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, 0x47a2a8
call fcn.00402590
sub esp, 0x1c
mov ecx, esp
lea eax, [esp + 0x48]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 0x28], esp
mov byte [ecx + 4], bl
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x407e76
sub eax, esi
push eax
lea edx, [esp + 0x4c]
push edx
call fcn.00402590
call fcn.004049e0
add esp, 0x1c
call fcn.00407c40
push 0xffffffffffffffff
push ebx
push 0x47a2a8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004024b0
push 0xf
push str._tinxingbox.exe
lea ecx, [esp + 0x18]
mov dword [esp + 0x144], ebx
call fcn.004026f0
mov eax, dword [esp + 0x14]
mov esi, 0x10
cmp dword [esp + 0x28], esi
jae 0x407ee2
lea eax, [esp + 0x14]
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x28], esi
jb 0x407f06
mov eax, dword [esp + 0x14]
push eax
call fcn.0043f32c
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0043ee6a
add esp, 0x134
ret
Function at 0x41aaed
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xd0]
mov ecx, edi
xor ebx, ebx
call sym.TXKmplayer.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
test eax, eax
jle 0x41ab3c
push ebx
mov ecx, edi
mov byte [ebp - 1], 0
call sym.TXKmplayer.exe_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x41ab9a
mov ecx, edi
inc ebx
call sym.TXKmplayer.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp ebx, eax
jl 0x41ab0b
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x41abf1
sub eax, 4
je 0x41ab9e
dec eax
dec eax
jne 0x41abe8
push dword [ebp + 0xc]
mov byte [ebp + 8], al
lea edi, [ebp + 9]
stosb byte es:[edi], al
call fcn.00441926
pop ecx
mov ecx, dword [esi + 0x50]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov byte [ebp + 8], al
mov eax, dword [ecx]
push sym.TXKmplayer.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x41abe8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x41abea
cmp dword [esi + 0x54], 0
je 0x41abe8
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x10], al
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.00418265
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41abe8
cmp dword [esi + 0x54], 0
je 0x41ac40
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41ac40
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x41ac40
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc]
push str.RichEditUI
push eax
call fcn.0044022f
pop ecx
pop ecx
test eax, eax
je 0x41ac40
mov ecx, dword [esi + 0x54]
call sym.TXKmplayer.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x41abe8
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx eax, al
push eax
mov ecx, esi
call sym.TXKmplayer.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
jmp 0x41ab9a
Function at 0x427a6e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x47aed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x427ade
cmp dword [esi + 0x10], ebx
je 0x427ade
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
inc edi
mov eax, edi
call fcn.004414c0
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x427ade
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x138
call fcn.00417863
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.TXKmplayer.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ee6a
leave
ret 0x10

Function at 0x42bbb3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x314], ebx
je 0x42bc1a
cmp dword [ebp + 8], 0x100
jne 0x42bc09
cmp byte [ebp + 0xc], 0xd
jne 0x42bc09
cmp byte [esi + 0x31a], bl
je 0x42bbf0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x42bc09
cmp byte [esi + 0x31b], bl
jne 0x42bc09
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x42bc05
push ebx
push ebx
push ebx
push str.return
push esi
call sym.TXKmplayer.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x42bc1d
mov eax, dword [esi + 0x314]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x435477
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x435482
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x43553d
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x459728]
inc edx
sub edi, 8
dec esi
jne 0x4354a2
pop ebx
test edi, edi
je 0x435556
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x459728]
inc edx
dec edi
jne 0x435541
pop edi
not eax
pop esi
ret

Function at 0x435998
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4359cc
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4359c7
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4359f4
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4359dd
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00440660
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x43678c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x47aed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x436820
mov al, byte [esi]
test al, al
je 0x436820
push edi
mov edi, esi
mov ecx, esi
cmp al, 0x2f
je 0x4367be
cmp al, 0x5c
jne 0x4367c0
mov edi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x4367b6
cmp edi, esi
je 0x4367f3
sub edi, esi
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.004412ab
lea eax, [ebp - 0x108]
push eax
push ebx
mov byte [ebp + edi - 0x108], 0
call fcn.0043678c
add esp, 0x14
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004413a0
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004413b0
add esp, 0x10
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ee6a
leave
ret
Function at 0x437ca4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x437d1f
cmp dword [esi + 4], 0xffffffff
jne 0x437d1f
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x452918
push edi
call fcn.004413b0
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x437cf1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x437cf1
mov eax, 0x2000000
jmp 0x437d24
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004357ae
add esp, 0x10
test eax, eax
jne 0x437d0f
mov eax, dword [ebp + 0x10]
jmp 0x437d24
push eax
call fcn.004378a0
mov dword [esi], eax
mov eax, dword [0x47c558]
pop ecx
jmp 0x437d24
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc