joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, dword [esp + 0x20]
jne 0x419737
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
cmp edi, 4
jb 0x41971a
mov ebp, eax
sub ebp, ebx
movzx ecx, byte [eax + 3]
movzx esi, byte [ebx + ebp + 2]
movzx edx, byte [ebx + 3]
shl ecx, 8
or esi, ecx
shl edx, 8
movzx ecx, byte [eax]
shl esi, 0x10
or esi, ecx
movzx ecx, byte [eax + 1]
and ecx, 0xffdfdfdf
and esi, 0xdfdfdfdf
shl ecx, 8
or esi, ecx
movzx ecx, byte [ebx + 2]
or edx, ecx
movzx ecx, byte [ebx]
shl edx, 0x10
or edx, ecx
movzx ecx, byte [ebx + 1]
and ecx, 0xffdfdfdf
and edx, 0xdfdfdfdf
shl ecx, 8
or edx, ecx
cmp edx, esi
jne 0x419737
sub edi, 4
add eax, 4
add ebx, 4
cmp edi, 4
jae 0x4196b3
test edi, edi
je 0x419730
sub ebx, eax
mov cl, byte [ebx + eax]
xor cl, byte [eax]
test cl, 0xdf
jne 0x419737
inc eax
sub edi, 1
jne 0x419720
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x41ae50
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x4fabc0
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x41ae9e
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
push sym.MainExtractor.exe_public_virtual:_void___thiscall_DuiLib::CTreeViewUI::Notify_struct_DuiLib::tagTNotifyUI__
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret
Function at 0x41f4f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebp, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x4f7028
push eax
lea ecx, [esp + 0x20]
call fcn.0040e4a0
mov esi, dword [esp + 0x38]
mov dword [esp + 0x34], 0x1ffff7
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov ebx, eax
mov dword [esi + 8], eax
cmp ebx, 1
je 0x41f565
mov eax, dword [esi]
mov ecx, eax
jmp 0x41f578
mov eax, dword [esi + 4]
xor edx, edx
div dword [esp + 0x34]
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x41f5cf
mov ecx, dword [0x4f7030]
mov eax, dword [0x4f7034]
cmp ecx, 0x257edfd1
jne 0x41f597
cmp eax, 0xb2ab117a
je 0x41f5a6
cmp ecx, 0x257edfd0
jne 0x41f5b3
cmp eax, 0xb2ab117a
jne 0x41f5b3
mov al, 1
mov dword [esi], 0x2746
jmp 0x41f637
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x41f637
cmp ebx, 1
je 0x41f5d8
mov eax, ecx
jmp 0x41f5e9
mov eax, dword [esi + 4]
xor edx, edx
div dword [esp + 0x34]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x4d2
jne 0x41f649
mov ecx, dword [0x4f7030]
mov eax, dword [0x4f7034]
cmp ecx, 0x257edfd1
jne 0x41f60a
cmp eax, 0xb2ab117a
je 0x41f619
cmp ecx, 0x257edfd0
jne 0x41f61d
cmp eax, 0xb2ab117a
jne 0x41f61d
mov al, 1
jmp 0x41f631
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x4f7028
mov dword [esi + 8], eax
jmp 0x41f68b
cmp ebx, 1
je 0x41f652
mov eax, ecx
jmp 0x41f663
mov eax, dword [esi + 4]
xor edx, edx
div dword [esp + 0x34]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x2738
je 0x41f69a
cmp ebx, 1
jne 0x41f683
mov eax, dword [esi + 4]
xor edx, edx
mov ebx, 0x1ffff7
div ebx
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0xea
je 0x41f69a
test ebp, ebp
je 0x41f69a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
pop edi
movq qword [esi], xmm0
mov dword [esi + 8], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x420ba0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push 0
push 0
push dword [esp + 0x30]
mov dword [esp + 0x38], 0
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x4f7028
push eax
lea ecx, [esp + 0x14]
call fcn.0040e4a0
mov ebp, 0x1ffff7
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
cmp eax, 1
je 0x420c06
mov eax, dword [esi]
mov ecx, eax
jmp 0x420c17
mov eax, dword [esi + 4]
xor edx, edx
div ebp
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x420c6e
mov ecx, dword [0x4f7030]
mov eax, dword [0x4f7034]
cmp ecx, 0x257edfd1
jne 0x420c36
cmp eax, 0xb2ab117a
je 0x420c45
cmp ecx, 0x257edfd0
jne 0x420c52
cmp eax, 0xb2ab117a
jne 0x420c52
mov al, 1
mov dword [esi], 0x2746
jmp 0x420cd2
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x420cd2
cmp dword [esi + 8], 1
jne 0x420c83
mov eax, dword [esi + 4]
xor edx, edx
div ebp
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x420ce2
mov ecx, dword [0x4f7030]
mov eax, dword [0x4f7034]
cmp ecx, 0x257edfd1
jne 0x420ca5
cmp eax, 0xb2ab117a
je 0x420cb4
cmp ecx, 0x257edfd0
jne 0x420cb8
cmp eax, 0xb2ab117a
jne 0x420cb8
mov al, 1
jmp 0x420ccc
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x4f7028
mov dword [esi + 8], eax
test ebx, ebx
je 0x420cf0
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x422800
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 1
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x42285d
cmp dword [esp + 0x18], 0x17
xorps xmm0, xmm0
mov ecx, dword [esp + 0x24]
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
jne 0x422856
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop esi
add esp, 0x10
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x4f7028
push eax
lea ecx, [esp + 0x10]
call fcn.0040e4a0
mov ecx, dword [esp + 0x24]
pop esi
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
or eax, 0xffffffff
add esp, 0x10
ret
Function at 0x423320
Capabilities:
Get socket status

Disassembly:
sub esp, 0x124
mov eax, dword [0x4f7600]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x130]
push ebx
mov ebx, dword [esp + 0x144]
push ebp
mov ebp, dword [esp + 0x130]
mov dword [esp + 8], eax
cmp ebp, 0xffffffff
jne 0x4233c4
mov ecx, dword [0x4f7030]
mov eax, dword [0x4f7034]
cmp ecx, 0x257edfd1
jne 0x42336e
cmp eax, 0xb2ab117a
je 0x42337d
cmp ecx, 0x257edfd0
jne 0x423381
cmp eax, 0xb2ab117a
jne 0x423381
mov al, 1
jmp 0x423395
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x2719
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
mov dword [ebx], 0x2719
add eax, 2
mov dword [ebx + 4], 0x4f7028
mov dword [ebx + 8], eax
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00489fe1
add esp, 0x124
ret
cmp byte [esp + 0x144], 0
je 0x4233ff
test byte [esp + 0x134], 0x10
je 0x4233ff
xorps xmm0, xmm0
xor eax, eax
movq qword [ebx], xmm0
pop ebp
mov dword [ebx + 8], 0
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00489fe1
add esp, 0x124
ret
push esi
push edi
push ebx
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push eax
push ebp
call fcn.00420ba0
add esp, 0x14
test eax, eax
jns 0x423592
test byte [esp + 0x13c], 1
jne 0x423590
mov edi, dword [0x4f7030]
mov esi, dword [0x4f7034]
cmp edi, 0x257edfd1
jne 0x42344c
cmp esi, 0xb2ab117a
je 0x42345c
cmp edi, 0x257edfd0
jne 0x423460
cmp esi, 0xb2ab117a
jne 0x423460
mov al, 1
jmp 0x423480
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x4f7034]
mov edi, dword [0x4f7030]
movzx eax, al
add eax, 2
mov dword [esp + 0x20], 0x2733
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push ebx
mov dword [esp + 0x2c], 0x4f7028
call fcn.00412810
add esp, 8
test al, al
jne 0x423514
cmp edi, 0x257edfd1
jne 0x4234bc
cmp esi, 0xb2ab117a
je 0x4234cc
cmp edi, 0x257edfd0
jne 0x4234d0
cmp esi, 0xb2ab117a
jne 0x4234d0
mov al, 1
jmp 0x4234e4
mov eax, dword [0x4f7028]
mov ecx, 0x4f7028
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0x14], 0x4d5
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x20], 0x4f7028
call fcn.00412810
add esp, 8
test al, al
je 0x423590
push 0
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x38], ebp
push eax
push 0
lea eax, [ebp + 1]
mov dword [esp + 0x3c], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x42356d
push ebx
push dword [esp + 0x14c]
xorps xmm0, xmm0
push dword [esp + 0x14c]
movq qword [ebx], xmm0
push dword [esp + 0x1c]
mov dword [ebx + 8], 0
push ebp
call fcn.00420ba0
add esp, 0x14
test eax, eax
js 0x423430
jmp 0x423592
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x4f7028
push eax
lea ecx, [esp + 0x1c]
call fcn.0040e4a0
movq xmm0, qword [eax]
movq qword [ebx], xmm0
mov eax, dword [eax + 8]
mov dword [ebx + 8], eax
xor eax, eax
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00489fe1
add esp, 0x124
ret
Function at 0x424d00
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
test eax, eax
jg 0x424d21
jl 0x424d17
test esi, esi
jne 0x424d21
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
push ebp
push edi
mov edi, esi
je 0x424dd4
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
nop dword [eax]
mov ecx, ebx
call fcn.00415440
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x424d91
jg 0x424d59
test esi, esi
je 0x424d91
cmp ebp, eax
jg 0x424d69
jl 0x424d63
cmp edi, esi
jae 0x424d69
mov esi, edi
mov dword [esp + 0x10], ebp
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x20]
call fcn.0048ba50
mov eax, dword [ebx + 0x2c]
add esp, 0xc
sub edi, esi
sbb ebp, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x18]
jmp 0x424db0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x424dc0
mov eax, dword [esp + 0x18]
add edi, 0xffffffff
mov esi, 1
adc ebp, 0xffffffff
mov byte [eax], cl
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
jg 0x424d40
jl 0x424dc0
test edi, edi
jne 0x424d40
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, edi
pop edi
sbb edx, ebp
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
test edx, edx
je 0x424e19
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x424e20
mov edi, dword [esp + 0x1c]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ebp
call fcn.0048ba50
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x424e20
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x424e89
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x424e4a
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x424e74
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call fcn.00494532
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x424e89
cmp edi, eax
ja 0x424e52
test edi, edi
je 0x424e89
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call fcn.00494532
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x20]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
pop ecx
ret 0xc

Function at 0x426cc0
Capabilities:
Create thread

Disassembly:
push esi
push 0x6b
mov esi, ecx
call sym.MainExtractor.exe_public:_void___thiscall_DuiLib::CWindowWnd::SetIcon_unsigned_int_
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
push esi
push 0x426d40
push 0
push 0
call fcn.00496017
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x429aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0x4b97d0
push 0x87
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x429ad9
call fcn.004868c0
push 0x87
push str.9hncD
push 4
push eax
call fcn.00485f00
add esp, 0x10
xor eax, eax
pop esi
ret 4
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x429b05
call fcn.004868c0
push 0x4b9818
push 4
push eax
call fcn.00485f00
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret 4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, 0x34b
je 0x429b3a
call fcn.004868c0
push 0x34b
push esi
push 0x4b982c
push 4
push eax
call fcn.00485f00
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret 4
mov esi, edi
mov ecx, 0xd2
mov edi, dword [esp + 0xc]
mov eax, 1
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret 4
Function at 0x429b60
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af6f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x4f7600]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
movzx eax, word [ebp + 8]
xor esi, esi
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0x4b97d0
push eax
push esi
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1b4], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x429d70
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1b0], eax
test eax, eax
je 0x429d70
push dword [ebp - 0x1ac]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp - 0x1a4], eax
cmp dword [ecx + 0x80], eax
je 0x429c3b
push 0x100
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.0048bfd0
mov eax, dword [ebp - 0x1a8]
push dword [eax + 0x80]
lea eax, [ebp - 0x138]
push dword [ebp - 0x1a4]
push str.Get_File_size__u___u_
push eax
call fcn.00429a70
add esp, 0x1c
jmp 0x429d70
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1ac], eax
cmp eax, 0xffffffff
je 0x429c87
push 0
lea ecx, [ebp - 0x1a4]
push ecx
push dword [ebp - 0x1a4]
push dword [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x1ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1a0]
mov byte [ebp - 0x18], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
call fcn.0047d2a0
movzx eax, byte [ebp - 0x139]
add esp, 8
push eax
movzx eax, byte [ebp - 0x13a]
push eax
movzx eax, byte [ebp - 0x13b]
push eax
movzx eax, byte [ebp - 0x13c]
push eax
movzx eax, byte [ebp - 0x13d]
push eax
movzx eax, byte [ebp - 0x13e]
push eax
movzx eax, byte [ebp - 0x13f]
push eax
movzx eax, byte [ebp - 0x140]
push eax
movzx eax, byte [ebp - 0x141]
push eax
movzx eax, byte [ebp - 0x142]
push eax
movzx eax, byte [ebp - 0x143]
push eax
movzx eax, byte [ebp - 0x144]
push eax
movzx eax, byte [ebp - 0x145]
push eax
movzx eax, byte [ebp - 0x146]
push eax
movzx eax, byte [ebp - 0x147]
push eax
movzx eax, byte [ebp - 0x148]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
lea eax, [ebp - 0x38]
push 0x21
push eax
call fcn.00402010
mov eax, dword [ebp - 0x1a8]
add eax, 0x84
push 0x21
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004968ab
add esp, 0x58
test eax, eax
je 0x429d5d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x429d70
mov esi, 1
jmp 0x429d70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00489fe1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x431460
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x4f7600]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, dword [esp + 0x220]
lea eax, [esp + 0xc]
push 0x20a
push 0
push eax
mov dword [esp + 0x10], esi
call fcn.0048bfd0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call sym.MainExtractor.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00489fe1
add esp, 0x218
ret

Function at 0x4323a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x11
call ebx
movsx esi, ax
sar esi, 0x1f
push 2
and esi, 8
call ebx
mov edi, esi
or edi, 1
test ax, ax
push 1
cmovns edi, esi
call ebx
mov esi, edi
or esi, 2
test ax, ax
push 0x10
cmovns esi, edi
call ebx
mov edi, esi
or edi, 4
test ax, ax
push 0x12
cmovns edi, esi
call ebx
mov ecx, edi
or ecx, 0x20
test ax, ax
cmovns ecx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x433f50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0x1c4]
call sym.MainExtractor.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
mov edi, dword [esp + 0x34]
test eax, eax
jle 0x433fb0
nop
push esi
lea ecx, [ebx + 0x1c4]
mov byte [esp + 0x38], 0
call sym.MainExtractor.exe_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
lea ecx, [esp + 0x34]
push ecx
push dword [esp + 0x40]
mov edx, dword [eax]
mov ecx, eax
push dword [esp + 0x40]
push edi
call dword [edx]
cmp byte [esp + 0x34], 0
jne 0x43410d
lea ecx, [ebx + 0x1c4]
inc esi
call sym.MainExtractor.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
cmp esi, eax
jl 0x433f70
sub edi, 0x100
je 0x434095
sub edi, 4
je 0x434023
sub edi, 2
jne 0x434089
push dword [esp + 0x38]
mov dword [esp + 0x38], edi
call fcn.00496c92
mov ecx, dword [ebx + 0x144]
lea edx, [esp + 0x38]
add esp, 4
mov word [esp + 0x34], ax
mov eax, dword [ecx]
push reloc.WS2_32.dll_ioctlsocket
push edx
push sym.MainExtractor.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x434089
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret 0x10
cmp dword [ebx + 0x148], 0
je 0x434089
mov eax, dword [esp + 0x38]
xorps xmm0, xmm0
mov ecx, dword [ebx + 0x15c]
mov word [esp + 0x24], ax
mov eax, dword [ebx + 0x158]
mov dword [esp + 0x14], 0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x10], 6
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.004323a0
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x148]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 0x10
cmp dword [esp + 0x38], 9
jne 0x434089
mov ecx, dword [ebx + 0x148]
test ecx, ecx
je 0x4340f4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc8]
call eax
test al, al
je 0x4340f4
mov ecx, dword [ebx + 0x148]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd4]
call eax
test al, al
je 0x4340f4
mov ecx, dword [ebx + 0x148]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0048c3ce
add esp, 8
test eax, eax
je 0x4340f4
mov ecx, dword [ebx + 0x148]
call sym.MainExtractor.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x434089
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
mov ecx, ebx
xor al, 1
movzx eax, al
push eax
call sym.MainExtractor.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4351c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi]
mov esi, dword [esp + 0x2c]
cmp eax, ecx
je 0x4351e6
cmp esi, dword [edi + 0x148]
je 0x4351e6
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x148]
cmp esi, eax
je 0x4352eb
test eax, eax
je 0x43525a
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
movlpd qword [esp + 0x14], xmm0
movlpd qword [esp + 0x1c], xmm0
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0x148]
mov ecx, edi
call sym.MainExtractor.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov dword [edi + 0x148], 0
test esi, esi
je 0x4352eb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x4352eb
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xc8]
call eax
test al, al
je 0x4352eb
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xd4]
call eax
test al, al
je 0x4352eb
xorps xmm0, xmm0
mov dword [edi + 0x148], esi
movlpd qword [esp + 0x14], xmm0
movlpd qword [esp + 0x1c], xmm0
mov dword [esp + 0x24], 0
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x148]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0x148]
mov ecx, edi
call sym.MainExtractor.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
add esp, 0x20
ret 4