joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003dda3
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x1003ddc7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x1003ddeb
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x498
mov eax, 0x101dc6d5
call fcn.1005d8df
mov esi, ecx
push str.http:__down.wn51.com_plugin_handinput.dat
lea ecx, [ebp - 0x498]
call fcn.1001c8a9
lea eax, [ebp - 0x498]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100611f6
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100610b8
mov edi, 0x208
mov byte [ebp - 4], 1
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10078730
push edi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.10078730
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 8
pop edi
cmp dword [ebp - 0x43c], edi
lea ecx, [ebp - 0x420]
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push ecx
push eax
call fcn.1006a151
xor eax, eax
mov dword [ebp - 0x424], 7
pop ecx
pop ecx
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
cmp word [ebp - 0x218], ax
jne 0x1003deb5
mov eax, ebx
jmp 0x1003dec2
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.100026f0
cmp word [ebp - 0x420], 0
mov byte [ebp - 4], 2
jne 0x1003dee7
mov eax, ebx
jmp 0x1003def4
lea eax, [ebp - 0x420]
push eax
call fcn.100802ff
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.100042e0
lea ecx, [ebp - 0x4a4]
call fcn.100023f0
cmp dword [ebp - 0x43c], edi
lea ecx, [ebp - 0x218]
push ebx
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 3
cmovae eax, dword [ebp - 0x450]
push ecx
push eax
lea ecx, [ebp - 0x4a4]
call fcn.100024d0
test al, al
je 0x1003dff7
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.1006fd0f
pop ecx
pop ecx
mov byte [ebp - 4], 4
call fcn.10021605
mov ecx, eax
call fcn.100416a6
push eax
lea ecx, [ebp - 0x468]
call fcn.10002590
cmp dword [ebp - 0x46c], 0x10
lea ecx, [ebp - 0x480]
push ebx
cmovae ecx, dword [ebp - 0x480]
lea eax, [ebp - 0x468]
cmp dword [ebp - 0x454], edi
push ebx
cmovae eax, dword [ebp - 0x468]
push ecx
push eax
mov byte [ebp - 4], 5
call fcn.1002291b
add esp, 0x10
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], edi
cmovae eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi], 0
je 0x1003dfdb
push ebx
push ebx
push 0x13a2
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push 1
lea ecx, [ebp - 0x468]
call fcn.10002630
push ebx
push 1
lea ecx, [ebp - 0x480]
call fcn.1001d28d
lea ecx, [ebp - 0x4a4]
call fcn.100024c0
push ebx
push 1
lea ecx, [ebp - 0x438]
call fcn.10002630
push ebx
push 1
lea ecx, [ebp - 0x450]
call fcn.10002630
push ebx
push 1
lea ecx, [ebp - 0x498]
call fcn.1001d28d
call fcn.1005d89a
ret
Function at 0x10040af5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x550
mov eax, 0x101dc96c
call fcn.1005d8df
mov dword [ebp - 0x504], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4fc]
push 0x3e8
xor ebx, ebx
push ebx
push eax
call fcn.10078730
add esp, 0xc
lea ecx, [ebp - 0x55c]
call fcn.10059460
push 0x101e68fc
push str.MENUDATA
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x10040cfd
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea esi, [edi + 1]
push esi
call fcn.1001f34a
push esi
mov esi, eax
mov dword [ebp - 0x508], eax
push 0
push esi
call fcn.10078730
push edi
push ebx
push esi
call fcn.1008d5e0
add esp, 0x1c
lea ecx, [ebp - 0x55c]
xor ebx, ebx
push ebx
push ebx
push esi
call fcn.1005c0e0
push str.TheAppMenu
lea ecx, [ebp - 0x55c]
call fcn.1005a0a0
mov edi, eax
test edi, edi
je 0x10040cfd
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.10078730
add esp, 0xc
mov ecx, edi
call fcn.1005a140
mov edi, eax
inc ebx
mov dword [ebp - 0x500], edi
test edi, edi
je 0x10040cf2
push 0x1c
call fcn.1005d503
pop ecx
mov dword [ebp - 0x510], eax
mov byte [ebp - 4], bl
test eax, eax
je 0x10040c04
mov ecx, eax
call fcn.10041455
mov edi, eax
jmp 0x10040c06
xor edi, edi
push 0xc
mov byte [ebp - 4], 0
mov dword [ebp - 0x50c], edi
call fcn.1005d503
pop ecx
mov dword [ebp - 0x514], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10040c31
mov ecx, eax
call fcn.1004175a
mov esi, eax
jmp 0x10040c33
xor esi, esi
push 0xc
mov byte [ebp - 4], 0
call fcn.1005d503
pop ecx
mov ecx, eax
test ecx, ecx
je 0x10040c51
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
jmp 0x10040c53
xor ecx, ecx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 4]
push esi
mov ecx, edi
call fcn.100414f1
mov eax, dword [ebp - 0x500]
mov eax, dword [eax + 0x20]
add eax, 8
je 0x10040cec
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.1007c240
lea eax, [ebp - 0x114]
push eax
call fcn.10090a96
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.10073459
mov ecx, dword [ebp - 0x504]
add esp, 0x14
push esi
mov esi, dword [ebp - 0x500]
push esi
call fcn.10040d41
lea eax, [ebp - 0x4fc]
mov ecx, edi
push eax
call fcn.100414e8
mov ecx, esi
call fcn.1005a570
mov esi, eax
lea eax, [ebp - 0x50c]
push eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x500], esi
mov ecx, dword [eax]
call fcn.10028ba9
test esi, esi
jne 0x10040be4
mov esi, dword [ebp - 0x508]
test esi, esi
je 0x10040cfd
push esi
call fcn.1001f39e
pop ecx
lea ecx, [ebp - 0x55c]
call fcn.10029ca9
mov eax, ebx
call fcn.1005d89a
ret 4
Function at 0x10043d96
Capabilities:
Enumerate files on windows

Disassembly:
push 0x684
mov eax, 0x101dcd6e
call fcn.1005d8df
mov dword [ebp - 0x690], ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x420]
push 0x101e3638
push eax
call fcn.10021c56
add esp, 0xc
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10043faf
push 0x2e
pop ebx
lea eax, [ebp - 0x68c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10043faf
cmp word [ebp - 0x660], bx
je 0x10043de5
cmp word [ebp - 0x65e], 0
je 0x10043de5
cmp word [ebp - 0x65e], bx
jne 0x10043e21
cmp word [ebp - 0x65c], 0
je 0x10043de5
test byte [ebp - 0x68c], 0x10
jne 0x10043de5
lea ecx, [ebp - 0x43c]
xor bl, bl
call fcn.10020d7d
and dword [ebp - 4], 0
lea eax, [ebp - 0x660]
push str..wnpf
push eax
call fcn.10078f22
pop ecx
pop ecx
test eax, eax
je 0x10043ea6
lea eax, [ebp - 0x660]
mov byte [ebp - 0x424], bl
push eax
lea eax, [ebp - 0x218]
inc bl
push 0x1026de28
push eax
call fcn.10021c56
push str..wnpf
call fcn.100802ff
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
sub eax, esi
add esp, 0x14
add eax, eax
cmp eax, 0x208
jae 0x10043faa
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x660]
push str..swnpf
push eax
call fcn.10078f22
pop ecx
pop ecx
test eax, eax
je 0x10043f11
lea eax, [ebp - 0x660]
mov bl, 1
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 0x424], bl
push 0x1026de28
push eax
call fcn.10021c56
push str..swnpf
call fcn.100802ff
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
sub eax, esi
add esp, 0x14
add eax, eax
cmp eax, 0x208
jae 0x10043faa
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
test bl, bl
je 0x10043f92
cmp word [ebp - 0x218], 0
jne 0x10043f23
xor eax, eax
jmp 0x10043f30
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x43c]
call fcn.100026f0
lea eax, [ebp - 0x218]
push eax
call fcn.10021643
mov ebx, dword [ebp - 0x690]
test eax, eax
pop ecx
setne byte [ebp - 0x423]
mov eax, dword [ebx + 8]
mov esi, dword [eax]
jmp 0x10043f7e
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.100218da
test eax, eax
je 0x10043f92
mov eax, dword [ebx + 8]
add esi, 0x1c
cmp esi, dword [eax + 4]
jne 0x10043f66
mov ecx, dword [ebx + 8]
lea eax, [ebp - 0x43c]
push eax
call fcn.10021bcd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
push 0
push 1
call fcn.10002630
jmp 0x10043de2
call fcn.1005daa0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.1005d89a
ret 4
Function at 0x100442ab
Capabilities:
Check if file exists

Disassembly:
push 0xbd4
mov eax, 0x101dcddb
call fcn.1005d8df
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x7e0]
mov edi, 0x3e8
xor ebx, ebx
push edi
push ebx
push eax
call fcn.10078730
push edi
lea eax, [ebp - 0xbc8]
push ebx
push eax
call fcn.10078730
push edi
lea eax, [ebp - 0x3f8]
push ebx
push eax
call fcn.10078730
add esp, 0x24
call fcn.10021605
mov ecx, eax
call fcn.100416a6
mov edi, eax
call fcn.10021605
mov ecx, eax
call fcn.10073b97
push eax
lea eax, [ebp - 0x7e0]
push 0x1026de28
push eax
call fcn.10021c56
lea eax, [ebp - 0x7e0]
push eax
call fcn.10072113
call fcn.10020e13
push str..wnpf
push esi
push edi
lea eax, [ebp - 0x3f8]
push str._sSkin_s_s
push eax
call fcn.10021c56
add esp, 0x24
lea eax, [ebp - 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10044381
push str..wnpf
push esi
call fcn.10021605
mov ecx, eax
call fcn.1005ec3e
push eax
lea eax, [ebp - 0x3f8]
push str._sAllSkin_s_s
push eax
call fcn.10021c56
add esp, 0x14
lea eax, [ebp - 0x3f8]
push eax
push str.WnSkinInst.exe
push edi
lea eax, [ebp - 0xbc8]
push str._s_s__untie__s
push eax
call fcn.10021c56
lea eax, [ebp - 0xbc8]
push eax
call fcn.1007204e
push 0x101e3658
push esi
call fcn.10086563
add esp, 0x20
test eax, eax
jne 0x100443c5
call fcn.100760de
push ebx
jmp 0x100443cc
call fcn.100760de
push 1
mov edx, dword [eax]
mov ecx, eax
push 0x4f
call dword [edx + 0x14]
push esi
lea ecx, [ebp - 0xbe0]
call fcn.10002590
mov dword [ebp - 4], ebx
call fcn.100760de
lea ecx, [ebp - 0xbe0]
push ecx
push 0x91
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe0]
push ebx
push 1
call fcn.10002630
call fcn.10021db8
mov edi, 0x8c
mov ecx, eax
push edi
mov edx, dword [eax]
call dword [edx]
lea esi, [eax + 1]
call fcn.10021db8
push esi
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
call fcn.10021db8
push esi
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x48]
call fcn.10021605
mov ecx, eax
call fcn.100739f4
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, eax
push edi
push 0x101e35b0
push str.IsModifyUIStyle64
mov ebx, str.SetModify
push ebx
call esi
push edi
push 0x101e35b0
push str.IsModifyUIStyle
push ebx
call esi
push edi
push 0x101e35b0
push str.IsTempModifyUIStyle64
push ebx
call esi
push edi
push 0x101e35b0
push str.IsTempModifyUIStyle
push ebx
call esi
call fcn.1005d89a
ret
Function at 0x100449c0
Capabilities:
Check if file exists

Disassembly:
push 0x224
mov eax, 0x101de212
call fcn.1005d8df
call fcn.10021605
mov ecx, eax
call fcn.100416a6
push eax
lea ecx, [ebp - 0x230]
call fcn.10002590
mov esi, str.WnHandInput.exe
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.100802ff
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.100042e0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x208
test eax, eax
lea eax, [ebp - 0x218]
push edi
push eax
je 0x10044a6d
call fcn.10078730
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push 0x101eb4c8
push eax
call fcn.10021c56
lea eax, [ebp - 0x218]
push eax
call fcn.10071e57
add esp, 0x1c
jmp 0x10044aa7
call fcn.10078730
add esp, 0xc
push str.WnPlugin.exe
call fcn.10021605
mov ecx, eax
call fcn.100416a6
push eax
lea eax, [ebp - 0x218]
push str.__s_s__DownLoadHandInputByHand
push eax
call fcn.10021c56
lea eax, [ebp - 0x218]
push eax
call fcn.10071e57
add esp, 0x14
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.10002630
call fcn.1005d89a
ret

Function at 0x1004542d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x43c], edi
call fcn.10078730
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x22c
mov ebx, eax
lea eax, [ebp - 0x438]
push edi
push eax
call fcn.10078730
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x10045496
push 0x1026dd78
jmp 0x100454ed
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100454c4
cmp dword [ebp - 0x430], ebx
je 0x100454ca
lea eax, [ebp - 0x438]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100454af
jmp 0x100454df
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100802dd
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.10002590
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x1004bfcd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x1004c046
push ebx
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push edi
push eax
call fcn.10077c30
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp + 0x10]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp + 0x10]
call fcn.10028d96
pop ecx
pop ecx
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x1004ce39
Capabilities:
Check if file exists

Disassembly:
push 0x224
mov eax, 0x101dd9cb
call fcn.1005d8df
mov esi, dword [ebp + 0x20]
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
call fcn.100211c9
mov ax, word [0x1026dd78]
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov dword [esp], 0x206
push 0
push eax
mov byte [ebp - 4], 1
call fcn.10078730
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
lea eax, [ebp - 0x230]
cmovae ecx, dword [ebp + 8]
cmp dword [ebp - 0x21c], 8
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push str._s_s.png
push eax
call fcn.10021c56
add esp, 0x1c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004cef5
cmp word [ebp - 0x218], 0
jne 0x1004ced5
xor eax, eax
jmp 0x1004cee2
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.100026f0
mov bl, 1
jmp 0x1004cef7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.10002630
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10002630
mov al, bl
call fcn.1005d89a
ret 0x1c
Function at 0x1004cf1c
Capabilities:
Read .ini file

Disassembly:
push 0x430
mov eax, 0x101dda06
call fcn.1005d8df
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x43c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x438]
push eax
call fcn.100210cd
pop ecx
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x438]
push eax
push 0
push str.count
push str.MenuSkins
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor esi, esi
mov edi, eax
inc esi
cmp edi, esi
jl 0x1004cfeb
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x420]
push str.MenuSkin_d
push eax
call fcn.10021c56
add esp, 0xc
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
cmovae eax, dword [ebp - 0x438]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x101eca70
push 0x101e3668
lea eax, [ebp - 0x420]
push eax
call ebx
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10086563
pop ecx
pop ecx
test eax, eax
je 0x1004d012
inc esi
cmp esi, edi
jle 0x1004cf7f
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.10002630
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10002630
mov al, bl
call fcn.1005d89a
ret 0x1c
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x101eca70
push str.previewUrl
lea eax, [ebp - 0x420]
push eax
call ebx
cmp word [ebp - 0x218], 0
jne 0x1004d054
xor eax, eax
jmp 0x1004d061
lea eax, [ebp - 0x218]
push eax
call fcn.100802ff
pop ecx
mov ecx, dword [ebp - 0x43c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100026f0
mov bl, 1
jmp 0x1004cfed

Function at 0x1004d11b
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push 0x240
mov eax, 0x101dda4c
call fcn.1005d8df
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 1
push eax
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.10004100
mov ecx, esi
call fcn.1004cf1c
test al, al
je 0x1004d229
lea eax, [ebp - 0x248]
push eax
call fcn.100211c9
mov ax, word [0x1026dd78]
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov dword [esp], 0x206
push ebx
push eax
mov byte [ebp - 4], 2
call fcn.10078730
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
lea eax, [ebp - 0x248]
cmovae ecx, dword [ebp + 8]
cmp dword [ebp - 0x234], 8
push ecx
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push str._s_s.png
push eax
call fcn.10021c56
lea eax, [ebp - 0x218]
push eax
call fcn.10061bf5
add esp, 0x20
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileW
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x248]
push 0
push 1
setne bl
call fcn.10002630
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.10002630
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10002630
mov al, bl
call fcn.1005d89a
ret 0x18
Function at 0x1004e0b2
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
push 0
mov ecx, dword [esi + 0x33c]
add ecx, 0x4b8
mov eax, dword [ecx]
call dword [eax]
push 0
lea ecx, [eax + 0x4b8]
mov eax, dword [ecx]
call dword [eax]
mov edi, eax
test edi, edi
je 0x1004e115
lea ecx, [edi + 0x4b8]
mov edx, dword [ecx]
call dword [edx + 0x20]
mov edx, dword [edi]
mov ecx, edi
push 0
call dword [edx + 0xd8]
mov eax, dword [edi]
mov ecx, edi
push 0x101e35b4
push str.height
call dword [eax + 0x120]
mov ecx, dword [esi + 0x3b8]
push 1
mov eax, dword [ecx]
call dword [eax + 0xd8]
mov ecx, esi
call fcn.1004e125
pop edi
mov ecx, esi
pop esi
jmp fcn.10050585
Function at 0x10052690
Capabilities:
Check if file exists

Disassembly:
push 0x224
mov eax, 0x101de212
call fcn.1005d8df
mov ebx, ecx
push dword [ebx + 4]
lea ecx, [ebx + 0x2ec]
call fcn.100747da
mov esi, dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
lea edi, [ebx + 0x2c]
push str.OnClose
mov ecx, edi
call esi
push str.char_face_btn
mov ecx, edi
mov dword [ebx + 0x324], eax
call esi
push str.symbol_lib_btn
mov ecx, edi
mov dword [ebx + 0x328], eax
call esi
push str.char_draw_btn
mov ecx, edi
mov dword [ebx + 0x32c], eax
call esi
push str.configure_btn
mov ecx, edi
mov dword [ebx + 0x330], eax
call esi
push str.mbmanager_btn
mov ecx, edi
mov dword [ebx + 0x334], eax
call esi
push str.wizard_btn
mov ecx, edi
mov dword [ebx + 0x338], eax
call esi
push str.celldictbtn
mov ecx, edi
mov dword [ebx + 0x33c], eax
call esi
push str.personalbtn
mov ecx, edi
mov dword [ebx + 0x340], eax
call esi
push str.imebtn
mov ecx, edi
mov dword [ebx + 0x344], eax
call esi
push str.tipical_wordbtn
mov ecx, edi
mov dword [ebx + 0x348], eax
call esi
push str.font_settingbtn
mov ecx, edi
mov dword [ebx + 0x34c], eax
call esi
push str.moreskin_btn
mov ecx, edi
mov dword [ebx + 0x350], eax
call esi
push str.skinbox_btn
mov ecx, edi
mov dword [ebx + 0x354], eax
call esi
push str.feedback
mov ecx, edi
mov dword [ebx + 0x358], eax
call esi
push str.officialweb
mov ecx, edi
mov dword [ebx + 0x35c], eax
call esi
push str.hand_input_btn
mov ecx, edi
mov dword [ebx + 0x364], eax
call esi
push str.hand_down_progress
mov ecx, edi
mov dword [ebx + 0x388], eax
call esi
push str.datetime_btn
mov ecx, edi
mov dword [ebx + 0x38c], eax
call esi
mov dword [ebx + 0x360], eax
push str.hand_input_text
mov ecx, edi
call esi
push str.tool_Bar_layout
mov ecx, edi
mov dword [ebx + 0x390], eax
call esi
push str.hand_input_pointer
mov ecx, edi
mov dword [ebx + 0x394], eax
call esi
mov dword [ebx + 0x398], eax
call fcn.10021605
mov ecx, eax
call fcn.100416a6
push eax
lea ecx, [ebp - 0x230]
call fcn.10002590
mov esi, str.WnHandInput.exe
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.100802ff
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.100042e0
call fcn.10021db8
push 0xb8
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x18]
mov esi, eax
mov ecx, dword [esi + 4]
cmp byte [ecx], 1
jne 0x10052899
cmp dword [ebx + 0x32c], edi
je 0x10052899
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.10078730
push dword [esi + 8]
lea eax, [ebp - 0x218]
push 0x101ed844
push eax
call fcn.10021c56
mov ecx, dword [ebx + 0x32c]
lea edx, [ebp - 0x218]
add esp, 0x18
mov eax, dword [ecx]
push edx
call dword [eax + 0x9c]
cmp dword [ebx + 0x398], edi
je 0x100528d3
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebx + 0x398]
test eax, eax
mov eax, dword [ecx]
jne 0x100528cc
push 1
jmp 0x100528cd
push edi
call dword [eax + 0xd8]
push edi
push 1
lea ecx, [ebp - 0x230]
call fcn.10002630
call fcn.1005d89a
ret