joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bd320
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push 0x14
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
jne 0x100bd33d
push str.QieHuan_An
push str.QieHuan_Cn
jmp 0x100bd3a8
call fcn.10112474
push 0
push 0x73
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [edi + 0xd0]
mov esi, eax
push 0x52
mov edx, dword [ecx]
call dword [edx]
mov ebx, eax
mov ecx, edi
cmp esi, 1
jne 0x100bd37f
push str.QieHuan_En
push str.QieHuan_Cn
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
push str.BiaoDian_En
push str.BiaoDian_Cn
jmp 0x100bd3a8
push str.QieHuan_Cn
push str.QieHuan_En
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
test ebx, ebx
je 0x100bd39e
push str.BiaoDian_En
push str.BiaoDian_Cn
jmp 0x100bd3a8
push str.BiaoDian_Cn
push str.BiaoDian_En
mov ecx, edi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
call fcn.10112474
push 0
push 0x75
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 1
jne 0x100bd3d5
push str.Quan_Jiao
push str.Ban_Jiao
mov ecx, edi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
call fcn.10112474
push 0
push 0x74
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 1
je 0x100bd3ef
cmp eax, 2
jne 0x100bd400
push str.Fan_Ti
push str.Jian_Ti
mov ecx, edi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
pop edi
pop esi
pop ebx
ret
Function at 0x100bd410
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x14
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
jne 0x100bd42b
push str.QieHuan_An
push str.QieHuan_Cn
jmp 0x100bd4a5
call fcn.10112474
push 0
push 0x73
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 1
jne 0x100bd45d
push str.QieHuan_En
push str.QieHuan_Cn
mov ecx, esi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
push str.BiaoDian_En
push str.BiaoDian_Cn
jmp 0x100bd4a5
call fcn.10112337
push 3
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, esi
test eax, eax
je 0x100bd48c
push str.QieHuan_En
push str.QieHuan_Cn
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
push str.BiaoDian_En
push str.BiaoDian_Cn
jmp 0x100bd4a5
push str.QieHuan_Cn
push str.QieHuan_En
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
push str.BiaoDian_Cn
push str.BiaoDian_En
mov ecx, esi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
call fcn.10112474
push 0
push 0x75
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 1
jne 0x100bd4d2
push str.Quan_Jiao
push str.Ban_Jiao
mov ecx, esi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
call fcn.10112474
push 0
push 0x74
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp eax, 1
je 0x100bd4ec
cmp eax, 2
jne 0x100bd4fd
push str.Fan_Ti
push str.Jian_Ti
mov ecx, esi
call sym.WnSkinPreview.dll_public:_int___thiscall_CStatusWnd::OnReplaceBotton_wchar_t_const___wchar_t_const__
pop esi
ret
Function at 0x100bfb00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
cmp edi, 0x200
ja 0x100bfbfb
je 0x100bfbef
cmp edi, 0x14
ja 0x100bfba5
je 0x100bfb8e
mov eax, edi
sub eax, 1
je 0x100bfb78
sub eax, 4
je 0x100bfb4e
sub eax, 0xa
jne 0x100bfc81
lea eax, [ebp + 8]
push eax
call fcn.100c0550
jmp 0x100bfc81
mov eax, ebx
movsx ecx, bx
shr eax, 0x10
cwde
test ecx, ecx
jle 0x100bfc81
test eax, eax
jle 0x100bfc81
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], eax
jmp 0x100bfc81
push dword [ebp + 8]
call fcn.100bf940
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp + 8]
push eax
call fcn.100c0550
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp edi, 0x20
je 0x100bfbc4
cmp edi, 0x113
jne 0x100bfc81
push ecx
push dword [ebp + 0x10]
call fcn.100c07a0
jmp 0x100bfc81
call dword [sym.imp.USER32.dll_GetCapture]
mov ecx, dword [ebp + 8]
cmp eax, ecx
je 0x100bfbe1
push ecx
call dword [sym.imp.USER32.dll_SetCapture]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ebx
push ecx
call fcn.100c0810
jmp 0x100bfc81
cmp edi, 0x2a1
ja 0x100bfc3c
je 0x100bfc25
mov eax, edi
sub eax, 0x201
je 0x100bfc1c
sub eax, 1
jne 0x100bfc81
push ebx
push ecx
call fcn.100bfd10
jmp 0x100bfc81
push ebx
push ecx
call fcn.100bfca0
jmp 0x100bfc81
push 2
push dword [esi + 0x98]
mov dword [esi + 0x1c], 1
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x100bfc81
cmp edi, 0x2a3
je 0x100bfc66
cmp edi, 0x4c8
jne 0x100bfc81
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100bfc81
push dword [ebp + 0x10]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x100bfc81
push 0
push dword [esi + 0x98]
mov dword [esi + 0x1c], 0
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100bfd10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp + 0xc], ecx
mov esi, dword [edi + 0x9c]
mov dword [ebp - 4], eax
cmp esi, dword [edi + 0xa0]
je 0x100bfd83
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
nop dword [eax]
push eax
push ecx
lea eax, [esi + 0x18]
push eax
call ebx
test eax, eax
je 0x100bfd52
cmp dword [esi + 0x28], 1
je 0x100bfd65
add esi, 0x30
cmp esi, dword [edi + 0xa0]
je 0x100bfd83
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x100bfd40
cmp esi, dword [edi + 0x28]
jne 0x100bfd83
cmp dword [esi + 0x2c], 2
jne 0x100bfd75
call fcn.100d5620
push 0
push dword [edi + 0x98]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c07a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
sub eax, 1
je 0x100c07d6
sub eax, 1
jne 0x100c0804
push 2
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ecx
pop ebp
ret 8
mov eax, dword [esi + 0x2c]
sub eax, 1
je 0x100c07ff
sub eax, 1
je 0x100c07f1
sub eax, 1
call fcn.100c0aa0
pop esi
pop ecx
pop ebp
ret 8
call fcn.100698c0
mov byte [esi], 1
pop esi
pop ecx
pop ebp
ret 8
call fcn.10069b80
pop esi
pop ecx
pop ebp
ret 8

Function at 0x100c1a70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160716
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101b90ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CUIEventManager.0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x100c1abb
mov eax, dword [ecx]
jmp 0x100c1abd
mov eax, ecx
xor edx, edx
mov word [eax], dx
mov dword [ebp - 4], edx
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], edx
cmp dword [esi + 0x44], 8
jb 0x100c1ada
mov eax, dword [esi + 0x30]
jmp 0x100c1add
lea eax, [esi + 0x30]
xor edx, edx
mov word [eax], dx
push edx
mov byte [ebp - 4], 1
push 0x1018344c
mov dword [esi + 4], edx
call fcn.10041f70
push 0
push 0x1018344c
lea ecx, [esi + 0x30]
call fcn.10041f70
mov dword [esi + 8], 0
mov eax, esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c2a20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160991
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x101b90ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x458], eax
mov esi, dword [eax + 0xc]
push dword [ebp - 0x458]
push ecx
mov edx, dword [esi + 4]
mov ecx, dword [esi]
call fcn.10053990
mov eax, dword [esi]
lea ecx, [ebp - 0x438]
add esp, 8
mov dword [esi + 4], eax
call fcn.10052d00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
cmovae eax, dword [ebp - 0x438]
push eax
push 0
push str.count
push str.MenuSkins
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov esi, 1
cmp ebx, esi
jl 0x100c2c3c
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x440], 7
mov dword [ebp - 0x444], 0
mov word [ebp - 0x454], ax
push eax
push 0x1018344c
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 1
call fcn.10041f70
mov word [ebp - 0x43c], 0
push esi
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 2
push str.MenuSkin_d
push eax
call fcn.10041b30
add esp, 0xc
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
cmovae eax, dword [ebp - 0x438]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x1018344c
push 0x1018e3a4
lea eax, [ebp - 0x420]
push eax
call edi
cmp word [ebp - 0x218], 0
jne 0x100c2b56
xor eax, eax
jmp 0x100c2b6f
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100c2b60
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x454]
call fcn.10041f70
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x10183a68
push str.isVip
lea eax, [ebp - 0x420]
push eax
call edi
mov ecx, 0x10183ad4
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100c2be7
test dx, dx
je 0x100c2be3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100c2be7
add eax, 4
add ecx, 4
test dx, dx
jne 0x100c2bc1
xor eax, eax
jmp 0x100c2bec
sbb eax, eax
or eax, 1
test eax, eax
mov byte [ebp - 0x43c], 0
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x458]
sete byte [ebp - 0x43b]
mov ecx, dword [eax + 0xc]
call fcn.100530f0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x440]
cmp eax, 8
jb 0x100c2c33
inc eax
lea ecx, [ebp - 0x454]
push eax
push dword [ebp - 0x454]
call fcn.10042110
inc esi
cmp esi, ebx
jle 0x100c2ac0
mov eax, dword [ebp - 0x424]
cmp eax, 8
jb 0x100c2c5a
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.10042110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ec2
mov esp, ebp
pop ebp
ret
Function at 0x100ca5a0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x101b90ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x38], esi
call fcn.10054640
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
mov dword [esi + 0xd0], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call ebx
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xd4], eax
call fcn.100541d0
push 0
mov dword [esi + 0xd8], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.Shell_TrayWnd
call ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call edi
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0
mov dword [ecx + 0xdc], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call ebx
mov esi, eax
call edi
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push 0
mov dword [ecx + 0xe0], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call ebx
mov esi, eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
push eax
call ebx
lea eax, [ebp - 0x24]
push eax
push esi
call ebx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
pop edi
mov dword [ecx + 0xe4], eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10109ec2
mov esp, ebp
pop ebp
ret
Function at 0x100ced20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161bb2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101b90ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x10], 0x4c8
jne 0x100ced6b
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [0x101c74e8]
test eax, eax
jne 0x100ced9e
push 0x304
call fcn.10109ed3
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], 0
call sym.WnSkinPreview.dll_public:_void___thiscall_CMergeWnd::constructor_void_
mov dword [ebp - 4], 0xffffffff
mov dword [0x101c74e8], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call sym.WnSkinPreview.dll_public:_long_int___stdcall_CMergeWnd::ThisMergeWndProc_struct_HWND_____unsigned_int__unsigned_int__long_int_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100cf0b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161c42
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101b90ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
mov edi, dword [ebp + 0xc]
sub eax, 2
je 0x100cf1c3
sub eax, 0x52b
je 0x100cf117
cmp ecx, 0x4c8
jne case.default.0x100cf12e
push dword [ebp + 0x14]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffeae
mov dword [ecx + 4], edi
cmp eax, 4
ja case.default.0x100cf12e
jmp dword [eax*4 + 0x100cf224]
push 0x54
call fcn.100cf240
mov ecx, eax
call fcn.100e95b0
test eax, eax
je 0x100cf14d
push 1
push 1
jmp 0x100cf157
cmp dword [ebp + 0x18], 1
jne 0x100cf16c
push 0
push 0
push str.PassSon
push ecx
call fcn.100c37c0
add esp, 4
mov ecx, eax
call fcn.10077a70
call fcn.100c37c0
mov ecx, eax
call sym.WnSkinPreview.dll_public:_void___thiscall_CStatusWnd::ModifyImageVisible_void_
call fcn.100c37c0
mov ecx, eax
call sym.WnSkinPreview.dll_public:_void___thiscall_CStatusWnd::OnInvalidateRect_void_
jmp case.default.0x100cf12e
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x25
call esi
push 0
push 2
push 0
push 0x25
call esi
jmp case.default.0x100cf12e
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x27
call esi
push 0
push 2
push 0
push 0x27
call esi
jmp case.default.0x100cf12e
mov dword [ecx + 4], edi
jmp case.default.0x100cf12e
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov eax, dword [0x101c74e4]
test eax, eax
jne 0x100cf1fc
push 0x140
call fcn.10109ed3
add esp, 4
mov dword [ebp + 0xc], eax
mov ecx, eax
mov dword [ebp - 4], 0
call sym.WnSkinPreview.dll_public:_void___thiscall_CStatusWnd::constructor_void_
mov dword [ebp - 4], 0xffffffff
mov dword [0x101c74e4], eax
lea ecx, [ebp + 0x18]
push ecx
lea ecx, [ebp + 0x14]
push ecx
lea ecx, [ebp + 0x10]
push ecx
push edi
push eax
call sym.WnSkinPreview.dll_public:_long_int___stdcall_CStatusWnd::ThisStatusWndProc_struct_HWND_____unsigned_int___unsigned_int___long_int__
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100d6730
Capabilities:
Print debug messages

Disassembly:
push edi
mov edi, edx
cmp ecx, edi
je 0x100d678f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
lea esi, [ecx + 0x18]
push 0x1018344c
call ebx
lea ecx, [esi + 0xc]
call fcn.100d66d0
mov eax, dword [esi]
cmp eax, 8
jb 0x100d6764
inc eax
lea ecx, [esi - 0x14]
push eax
push dword [ecx]
call fcn.10042110
mov dword [esi], 7
cmp dword [esi], 8
mov dword [esi - 4], 0
jb 0x100d677b
mov eax, dword [esi - 0x14]
jmp 0x100d677e
lea eax, [esi - 0x14]
add esi, 0x30
xor ecx, ecx
mov word [eax], cx
lea eax, [esi - 0x18]
cmp eax, edi
jne 0x100d6742
pop esi
pop ebx
pop edi
ret
Function at 0x100dd0e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162da6
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x101b90ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x58]
mov edi, dword [ebp + 0xc]
mov ecx, 0x101c6dec
mov ebx, dword [ebp + 0x10]
push eax
call fcn.100e2f30
push esi
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.100dcb80
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1004a620
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100dd18c
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x100dd178
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.10041c00
mov dword [ebx], 0
xor edi, edi
mov dword [ebx + 4], 0
jmp 0x100dd240
mov word [ebp - 0x68], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x70]
cmovae eax, dword [ebp - 0x28]
push eax
call sym.WnSkinPreview.dll_public:_int___thiscall_CImgInfo::LoadImgInfo_wchar_t_const__
test eax, eax
jne 0x100dd1d5
xor edi, edi
jmp 0x100dd202
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x100dd1e8
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.10041c00
lea ecx, [ebp - 0x70]
call sym.WnSkinPreview.dll_public:_int___thiscall_CImgInfo::GetImgWidth_void_
lea ecx, [ebp - 0x70]
mov dword [ebx], eax
call sym.WnSkinPreview.dll_public:_int___thiscall_CImgInfo::GetImgHeight_void_
mov dword [ebx + 4], eax
mov edi, 1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x64], 0
je 0x100dd240
cmp byte [ebp - 0x68], 0
je 0x100dd231
cmp dword [0x101c74b0], 0
jne 0x100dd220
call fcn.1007cb70
mov esi, dword [ebp - 0x60]
mov ecx, dword [0x101c74b0]
push esi
call fcn.10073200
jmp 0x100dd234
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x100dd240
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x100dd255
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10042110
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x100dd27e
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10042110
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp ecx, 8
jb 0x100dd2a7
inc ecx
push ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x58]
call fcn.10042110
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10109ec2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100df9c0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [0x101b90ec]
xor eax, esp
mov dword [esp + 0x42c], eax
lea eax, [esp]
mov ecx, 0x101c6dec
push eax
call fcn.100e2f30
cmp dword [esp + 0x14], 8
lea eax, [esp]
push str.VipSkin.xml
cmovae eax, dword [esp + 4]
push eax
lea eax, [esp + 0x228]
push 0x10183440
push eax
call fcn.10041b30
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
push 0x1018e100
cmovae eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push 0x10183440
push eax
call fcn.10041b30
add esp, 0x20
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100dfa69
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100dfa69
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x224]
push eax
call fcn.1013c091
add esp, 8
mov eax, dword [esp + 0x14]
cmp eax, 8
jb 0x100dfa80
inc eax
lea ecx, [esp]
push eax
push dword [esp + 4]
call fcn.10042110
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.10109ec2
mov esp, ebp
pop ebp
ret
Function at 0x100e2260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100e2275
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100e22b6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100e22b2
nop word [eax + eax]
cmp esi, edx
jae 0x100e22b6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100e22a0
cmp esi, edx
jb 0x100e22bb
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret