joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430ab0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4919ef
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
add eax, 0x88
mov dword [ebp - 0xbc], 0
mov edi, dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
push eax
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xc0], esi
call edi
push str.Data_version.ini
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::Append_char_const__]
lea ecx, [ebp - 0xb8]
call dword [sym.imp.DuiLib.dll_public:_char_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
push 0x63
lea eax, [ebp - 0x74]
push eax
push 0x4a1c4c
push 0x4a5348
push str.appver
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x74]
push ecx
mov ecx, esi
call edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], 1
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret 4

Function at 0x430b90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4919ef
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
add eax, 0x88
mov dword [ebp - 0xbc], 0
mov edi, dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
push eax
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xc0], esi
call edi
push str.Data_version.ini
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::Append_char_const__]
lea ecx, [ebp - 0xb8]
call dword [sym.imp.DuiLib.dll_public:_char_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
push 0x63
lea eax, [ebp - 0x74]
push eax
push 0x4a1c4c
push str.ver2
push str.appver
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x74]
push ecx
mov ecx, esi
call edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], 1
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret 4
Function at 0x430c70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49198f
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov edi, ecx
mov dword [ebp - 0xbc], eax
mov ebx, dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
push 0x4a1d98
mov ecx, esi
mov dword [ebp - 0xc0], esi
call ebx
push 0xffffffffffffffff
add edi, 0x88
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], 1
call ebx
push str.Data_setup.ini
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::Append_char_const__]
lea ecx, [ebp - 0xb8]
call dword [sym.imp.DuiLib.dll_public:_char_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
push 0x63
lea eax, [ebp - 0x74]
push eax
push 0x4a1d98
push 0x4a153c
push 0x4a153c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x74]
push ecx
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CDuiString_const____thiscall_DuiLib::CDuiString::operator_char_const__]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret
Function at 0x430d60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49198f
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov edi, ecx
mov dword [ebp - 0xbc], eax
mov ebx, dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
push str.2000_01_01
mov ecx, esi
mov dword [ebp - 0xc0], esi
call ebx
push 0xffffffffffffffff
add edi, 0x88
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], 1
call ebx
push str.Data_setup.ini
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::Append_char_const__]
lea ecx, [ebp - 0xb8]
call dword [sym.imp.DuiLib.dll_public:_char_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
push 0x63
lea eax, [ebp - 0x74]
push eax
push str.2000_01_01
push str.SETUPDATE
push 0x4a153c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x74]
push ecx
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CDuiString_const____thiscall_DuiLib::CDuiString::operator_char_const__]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret
Function at 0x430e50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49198f
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov edi, ecx
mov dword [ebp - 0xbc], eax
mov ebx, dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
push str.2000_01_01_00:00:00
mov ecx, esi
mov dword [ebp - 0xc0], esi
call ebx
push 0xffffffffffffffff
add edi, 0x88
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], 1
call ebx
push str.Data_client.ini
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::Append_char_const__]
lea ecx, [ebp - 0xb8]
call dword [sym.imp.DuiLib.dll_public:_char_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
push 0x63
lea eax, [ebp - 0x74]
push eax
push str.2000_01_01_00:00:00
push str.LASTTIME
push str.DATA
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x74]
push ecx
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CDuiString_const____thiscall_DuiLib::CDuiString::operator_char_const__]
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret

Function at 0x431070
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0xc
mov dword [ebp - 0x1c], 0
call fcn.0046d74e
push 0xa
mov edi, eax
call fcn.0046d74e
add esp, 8
push 0xa
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0xc
push edi
push 0x4a6864
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push 0x4a5b08
push ecx
call fcn.0046f204
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.0046eadd
mov esp, ebp
pop ebp
ret
Function at 0x4310f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4918ff
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1f0]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x1f4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4311ac
lea ecx, [ebp - 0x1f8]
push ecx
mov ecx, dword [ebp - 0x1f0]
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x1fc]
push eax
push 0
push str.ProductName
push ecx
mov dword [ebp - 0x1f8], 0xff
mov dword [ebp - 0x1fc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43119f
push 0xffffffffffffffff
push 0x4a1520
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
jmp 0x43121b
mov edx, dword [ebp - 0x1f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1ec]
push eax
mov dword [ebp - 0x1ec], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0xffffffffffffffff
test eax, eax
jne 0x4311d8
push 0x4a1520
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
jmp 0x43121b
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x158]
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_]
lea edx, [ebp - 0x158]
push edx
mov ecx, esi
mov dword [ebp - 4], 1
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__]
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x1f4], 1
mov byte [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret

Function at 0x431a50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0x10], 0
ja 0x431a64
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431aad
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x431a8e
mov esi, dword [esi]
mov ecx, dword [ebp - 4]
push eax
push esi
push 1
push 0
push str.Start_Page
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4960ab
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
push 0x103
lea eax, [ebp - 0x113]
push ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.00475cb0
add esp, 0xc
lea ecx, [ebp - 0x134]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsTheWorld.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x431ba1
mov ecx, dword [ebp - 0x134]
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push str.Path
push ecx
mov dword [ebp - 0x138], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x431b85
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.0040d510
cmp dword [ebp - 0x120], ebx
jbe 0x431c0a
push 0xd
push str.TheWorld.ini
lea ecx, [ebp - 0x130]
call fcn.0040d510
cmp dword [ebp - 0x11c], 0x10
mov ecx, dword [ebp - 0x130]
jae 0x431bd0
lea ecx, [ebp - 0x130]
cmp dword [esi + 0x14], 0x10
jb 0x431bda
mov eax, dword [esi]
jmp 0x431bdc
mov eax, esi
push ecx
push eax
push str.HomePage
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 0x11c], 0x10
jb 0x431c06
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.0046ead2
add esp, 4
mov al, 1
jmp 0x431c24
cmp dword [ebp - 0x11c], 0x10
jb 0x431c22
mov edx, dword [ebp - 0x130]
push edx
call fcn.0046ead2
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret
Function at 0x433330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp dword [eax + 0x10], 0
ja 0x433347
xor al, al
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push str.SoftwareTENCENTQQBrowserLaunch
push SysReAllocStringLen
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4333b5
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push str.LaunchOpenPageType
push eax
mov dword [ebp - 8], 1
call esi
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push str.MainPageType
push edx
mov dword [ebp - 8], 2
call esi
mov eax, dword [ebp - 4]
push eax
call ebx
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push str.SoftwareTENCENTQQBrowserCommon
push SysReAllocStringLen
call edi
test eax, eax
jne 0x433403
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
add eax, 0x1c
cmp dword [eax + 0x14], 0x10
jb 0x4333e1
mov eax, dword [eax]
mov edx, dword [ebp - 4]
push ecx
push eax
push 1
push 0
push str.MainPageDIY
push edx
call esi
mov eax, dword [ebp - 4]
push eax
call ebx
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x433ee0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x433f03
xor eax, 0xedb88320
test al, 1
je 0x433f10
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f12
shr eax, 1
test al, 1
je 0x433f1f
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f21
shr eax, 1
test al, 1
je 0x433f2e
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f30
shr eax, 1
test al, 1
je 0x433f3d
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f3f
shr eax, 1
test al, 1
je 0x433f4c
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f4e
shr eax, 1
test al, 1
je 0x433f5b
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f5d
shr eax, 1
test al, 1
je 0x433f6a
shr eax, 1
xor eax, 0xedb88320
jmp 0x433f6c
shr eax, 1
mov dword [ebp + ecx*4 - 0x404], eax
inc ecx
cmp ecx, 0x100
jl 0x433ef5
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jle 0x433faf
push ebx
push edi
jmp 0x433f90
movsx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [ebp + edi*4 - 0x404]
inc ecx
cmp ecx, edx
jl 0x433f90
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
not eax
call fcn.0046eadd
mov esp, ebp
pop ebp
ret
Function at 0x4343b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496ef7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c56f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x4a4798
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov dword [ebx + edx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.00404e70
lea esi, [ebx + 0x10]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.0040d990
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x434449
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00404c90
mov dword [ebp - 4], 2
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov ecx, esi
mov dword [ebx + edx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.0040c6d0
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x4d678c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4344e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4983c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c56f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x4a9c28
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.00404e70
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.0040d990
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x434573
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00404c90
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.0040c6d0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x4d678c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c7f0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
mov ecx, esi
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
mov ebx, dword [sym.imp.gdiplus.dll_GdipAlloc]
push 0x10
mov dword [esi], vtable.CWindowLrcFrameWnd.0
mov dword [esi + 0x10], vtable.CWindowLrcFrameWnd.1.0
mov dword [esi + 0x20], vtable.CWindowLrcFrameWnd.2.0
mov dword [esi + 0x24], vtable.CWindowLrcFrameWnd.3.0
mov dword [esi + 0x28], vtable.CWindowLrcFrameWnd.4.0
mov dword [esi + 0x29c], 0xffffffff
mov byte [esi + 0x2a8], 0
mov dword [esi + 0x2b4], 0xa
mov dword [esi + 0x2b8], 0x28a
mov dword [esi + 0x2bc], 0x3e8
mov dword [esi + 0x2c0], 0x64
mov byte [esi + 0x2d0], 0
call ebx
mov edi, eax
test edi, edi
je 0x43c88c
lea eax, [edi + 4]
push eax
push str.Skin_bkcolor_5.png
mov dword [edi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromFile]
mov dword [edi + 8], eax
jmp 0x43c88e
xor edi, edi
push 0x10
mov dword [esi + 0x2c4], edi
call ebx
mov edi, eax
test edi, edi
je 0x43c8be
lea eax, [edi + 4]
push eax
push str.Skin_forecolor_5.png
mov dword [edi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromFile]
mov dword [edi + 8], eax
jmp 0x43c8c0
xor edi, edi
mov eax, dword [esi + 0x2c4]
push esi
push 0
push 0x43d980
mov dword [esi + 0x2c8], edi
mov dword [esi + 0x2cc], eax
call fcn.00471bed
add esp, 0xc
pop edi
mov eax, esi
pop ebx
ret

Function at 0x43dce0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x4c56f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3f
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.00475cb0
add esp, 0xc
xor eax, eax
jmp 0x43dd10
mov ecx, eax
shr ecx, 3
movsx edx, byte [ecx + str.Sta_Enctypt]
mov ecx, eax
and ecx, 7
shl edx, cl
inc eax
sar edx, 7
and dl, 1
mov byte [ebp + eax - 0x7d], dl
cmp eax, 0x40
jb 0x43dd10
push 0x37
lea eax, [ebp - 0x3b]
push 0
push eax
mov byte [ebp - 0x3c], 0
call fcn.00475cb0
add esp, 0xc
xor eax, eax
lea esp, [esp]
movsx ecx, byte [eax + str.91__]
movzx edx, byte [ebp + ecx - 0x7d]
movsx ecx, byte [eax + 0x4a609d]
mov byte [ebp + eax - 0x3c], dl
movzx edx, byte [ebp + ecx - 0x7d]
movsx ecx, byte [eax + 0x4a609e]
mov byte [ebp + eax - 0x3b], dl
movzx edx, byte [ebp + ecx - 0x7d]
movsx ecx, byte [eax + 0x4a609f]
mov byte [ebp + eax - 0x3a], dl
movzx edx, byte [ebp + ecx - 0x7d]
mov byte [ebp + eax - 0x39], dl
add eax, 4
cmp eax, 0x38
jl 0x43dd50
lea edx, [ebp - 0x3c]
mov ecx, esi
call fcn.0043ddb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046eadd
mov esp, ebp
pop ebp
ret