joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011bf73
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.1011bff2
jae 0x1011bf7f
xor ecx, ecx
call fcn.1011bff2
jae 0x1011bfa9
xor eax, eax
call fcn.1011bff2
jae 0x1011bfba
mov al, 0x10
call fcn.1011bff2
adc al, al
jae 0x1011bf9b
jne 0x1011bfe7
stosb byte es:[edi], al
jmp 0x1011bf80
call fcn.1011bffe
dec ecx
loop 0x1011bfc6
mov eax, ebp
call fcn.1011bffc
jmp 0x1011bfe8
lodsb al, byte [esi]
shr eax, 1
je 0x1011c00e
adc ecx, 2
mov ebp, eax
jmp 0x1011bfe8
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.1011bffc
cmp eax, 0x7d00
jae 0x1011bfe6
cmp eax, 0x500
jae 0x1011bfe7
cmp eax, 0x7f
ja 0x1011bfe8
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1011bf80
pop ebp
ret 8
Function at 0x401cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d0b
cmp byte [esi + ebx - 1], 0xa
je 0x401cdf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030d8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x401e10
Capabilities:
Terminate process

Disassembly:
cmp eax, 0x30
je 0x401ea0
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
lea eax, [eax - 0x68]
sub esp, 0x20
cmp eax, 0xf
ja case.0x401e2b.105
jmp dword [eax*4 + 0x404070]
mov dword [esp + 4], str.winepath
mov dword [esp], str.Usage:__s__OPTION___PATH_..._n
call sym._printf
mov dword [esp], str.Convert_PATH_s__to_Unix_or_Windows_long_or_short_paths._n_n___u____unix____converts_a_Windows_path_to_a_Unix_path_n___w____windows_converts_a_Unix_path_to_a_long_Windows_path_n___l____long____converts_the_short_Windows_path_of_an_existing_file_or_n________________directory_to_the_long_format_n___s____short___converts_the_long_Windows_path_of_an_existing_file_or_n________________directory_to_the_short_format_n___0____________separate_output_with_0_character__instead_of_a_newline_n___h____help____output_this_help_message_and_exit_n_nIf_more_than_one_option_is_given_then_the_input_paths_are_output_in_nall_formats_specified__in_the_order_long__short__Unix__Windows._nIf_no_option_is_given_the_default_is_Unix_format._n
call sym._printf
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
mov eax, 2
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
add esp, 0x20
mov eax, 8
pop ebx
pop esi
pop ebp
ret
mov eax, 4
jmp 0x401e6d
mov eax, 1
jmp 0x401e6d
mov eax, 0x10
ret
mov dword [ebp - 0xc], edx
mov esi, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], 2
call esi
mov dword [esp + 8], str.winepath
mov dword [esp + 4], str._s:_invalid_option
mov dword [esp], eax
call sym._fprintf
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x401f2b
mov eax, edx
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp], 2
mov ebx, eax
call esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x404049
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], str.winepath
mov dword [esp + 4], str.Try__s___help_for_help_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_exit]
mov dword [esp], 2
call esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__c_n
mov dword [esp], eax
call sym._fprintf
jmp 0x401efd
Function at 0x402b40
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x401e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [str.V_we], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.tascraft
push str.bamed
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401e98
xor eax, eax
jmp 0x401eb3
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4025f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0xb8], eax
push 0x4040a4
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401000
add esp, 4
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401e50
add esp, 8
test eax, eax
jne 0x402638
xor eax, eax
jmp 0x402696
push 0
push 0
push 0
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40268a
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0xb0]
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x402688
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x402638
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp - 0xa8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401d50
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401db0
Function at 0x4024c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402515
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40250e
test esi, esi
je 0x40250e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4024f0
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402730
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402768
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40275e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40276a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402750
xor eax, eax
pop ebx
pop esi
ret
Function at 0xc6bd00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x707000]
push edi
or ebp, 0xffffffff
jmp 0xc6bd22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc6bd29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc6bd18
mov eax, 1
add ebx, ebx
jne 0xc6bd3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc6bd4c
jne 0xc6bd6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc6bd6b
dec eax
add ebx, ebx
jne 0xc6bd58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xc6bd30
add ebx, ebx
jne 0xc6bd67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xc6bdbd
xor ecx, ecx
sub eax, 3
jb 0xc6bd83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc6bdf2
sar eax, 1
mov ebp, eax
jmp 0xc6bd8e
add ebx, ebx
jne 0xc6bd8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc6bd5c
inc ecx
add ebx, ebx
jne 0xc6bd9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc6bd5c
add ebx, ebx
jne 0xc6bda9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc6bd9e
jne 0xc6bdba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc6bd9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc6bddc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc6bdce
jmp 0xc6bd1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc6bddc
add edi, ecx
jmp 0xc6bd1e
pop esi
mov edi, esi
mov ecx, 0x30ea61
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xc6be17
cmp byte [edi], 0x3a
jne 0xc6bdfc
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xc6bdfa
lea edi, [esi + 0x868000]
mov eax, dword [edi]
or eax, eax
je 0xc6be68
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x86ffc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8701e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc6be1d
mov ecx, edi
jns 0xc6be4c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8701e8]
or eax, eax
je 0xc6be62
mov dword [ebx], eax
add ebx, 4
jmp 0xc6be3a
call dword [esi + 0x8701e4]
mov ebp, dword [esi + 0x8701ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x25f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc6be9c
sub esp, 0xffffff80
jmp 0x6f370f
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, eax
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax*4]
sub ecx, eax
neg ecx
add ecx, ecx
add ecx, ecx
mov edx, ecx
mov ecx, 0xc
sub ecx, edx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax + 1]
push ecx
xor esi, esi
call fcn.004ffa25
add esp, 4
cmp ebx, 2
mov ecx, eax
jle 0x4010ea
lea edx, [ebx - 3]
mov eax, 0xaaaaaaab
mul edx
push ebp
mov ebp, edx
shr ebp, 1
add ebp, 1
lea eax, [ebp*4]
sub eax, ebp
neg eax
add ebx, eax
mov dword [esp + 0x14], ebx
jmp 0x401080
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
mov edx, eax
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
and eax, 3
shl eax, 4
mov edx, ebx
shr edx, 4
movzx eax, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi + 1], al
movzx eax, byte [edi + 2]
add esi, 1
mov edx, eax
shr edx, 6
and ebx, 0xf
movzx edx, byte [edx + ebx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add esi, 1
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
add esi, 1
mov byte [ecx + esi], al
add esi, 1
add edi, 3
sub ebp, 1
jne 0x401080
mov ebx, dword [esp + 0x14]
pop ebp
test ebx, ebx
je 0x40114c
movzx eax, byte [edi]
mov edx, eax
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 3
mov byte [ecx + esi], dl
add esi, 1
shl eax, 4
cmp ebx, 1
jle 0x401132
movzx edx, byte [edi + 1]
mov edi, edx
shr edi, 4
mov al, byte [edi + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
add esi, 1
and edx, 0xf
mov dl, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
jmp 0x401142
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
add esi, 1
mov byte [ecx + esi], 0x3d
add esi, 1
mov byte [ecx + esi], 0x3d
add esi, 1
mov eax, dword [esp + 0x14]
test eax, eax
mov byte [ecx + esi], 0
je 0x40115a
mov dword [eax], esi
pop edi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x4013f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x56b1dc]
xor eax, esp
mov dword [esp + 0x20c], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x1a
push 0
mov dword [esp + 0x14], 0
call dword [0x5313b0]
push esi
lea ecx, [esp + 8]
call fcn.00402550
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, esi
call fcn.004ff939
add esp, 0x210
ret
Function at 0x404680
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esi + 0x54]
sub esp, 0xc
mov ecx, eax
push ebx
and ecx, 0xc
cmp cl, 0xc
push edi
mov bl, 1
jne 0x4046d9
mov eax, dword [esi + 4]
mov edi, dword [0x53144c]
push eax
mov dword [esp + 0xc], eax
call edi
mov edx, dword [esi + 4]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [0x531420]
lea ecx, [esp + 8]
push ecx
push edi
push 0x4e
push eax
call dword [0x531444]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
shr eax, 2
test al, 1
je 0x404712
mov edx, dword [esi + 4]
push edx
call dword [0x53144c]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [0x531420]
mov ecx, dword [esi + 4]
push ecx
movzx edx, di
push edx
push 0x111
push eax
call dword [0x531444]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 0x28]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [0x5313ac]
cmp eax, 0x20
seta bl
test bl, bl
je 0x404745
mov ecx, dword [esi + 4]
or byte [esi + 0x58], 2
push 1
push 0
push ecx
call dword [0x531424]
pop edi
mov al, bl
pop ebx
add esp, 0xc
ret
Function at 0x405020
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [0x531040]
test eax, eax
jne 0x40508e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40505f
cmp eax, 2
jne 0x40507a
test esi, esi
mov eax, dword [esp]
je 0x405088
test eax, eax
je 0x405083
test al, 1
jne 0x40507a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x405088
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x405b50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52cb52
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [edi + 8], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
mov byte [esp + 0x1c], 1
mov dword [edi], vtable.CCitiesDictPage.0
mov dword [edi + 4], vtable.CCitiesDictPage.1.0
mov dword [edi + 0x24], esi
call fcn.0040dcc0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], esi
mov ebx, 2
mov byte [esp + 0x1c], bl
mov dword [edi + 0x34], esi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], esi
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5759e8
lea ebp, [edi + 0x40]
call edx
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x1c], 3
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5759e8
call edx
add eax, 0x10
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], esi
mov dword [edi + 0x50], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
mov dword [edi + 0x5c], esi
mov eax, 0xa
mov dword [edi + 0x60], esi
mov dword [edi + 0x64], esi
mov dword [edi + 0x68], esi
mov dword [edi + 0x6c], esi
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], esi
mov dword [edi + 0x78], esi
mov dword [edi + 0x7c], esi
mov dword [edi + 0x80], esi
mov dword [edi + 0x84], esi
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], esi
lea esi, [edi + 0x90]
call fcn.004037a0
mov dword [esi], vtable.WTL::CHyperLink.0
push 0xffffff
mov byte [esp + 0x20], 8
call dword [0x5310a4]
mov dword [edi + 0x24], eax
push 0x535684
mov eax, ebp
call fcn.004026c0
push 0x535684
lea eax, [edi + 0x44]
call fcn.004026c0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x40af00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x52a748
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x56b1dc]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x5759e8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5759e8
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
neg esi
sbb esi, esi
mov dword [esp + 0x24], 0
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
and esi, 0xffffffeb
sub eax, 0x106
add esi, 0x17
or eax, ecx
jge 0x40af80
mov ecx, 0x106
lea eax, [esp + 0x10]
call fcn.00402120
mov edi, dword [esp + 0x10]
push 1
push esi
push edi
push 0
call dword [0x5313b4]
test edi, edi
jne 0x40af94
xor eax, eax
jmp 0x40afb1
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40afa0
sub eax, edx
sar eax, 1
js 0x40b026
cmp eax, dword [edi - 8]
jg 0x40b026
mov dword [edi - 0xc], eax
mov word [edi + eax*2], 0
cmp dword [edi - 0xc], 0
jle 0x40afe3
push ebx
push ecx
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], esp
mov esi, esp
call fcn.004020b0
mov ecx, dword [esp + 0x34]
add eax, 0x10
mov dword [esi], eax
call fcn.0040b040
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b007
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004ff939
add esp, 0x1c
ret 4
push 0x80070057
call fcn.004026a0
int3
Function at 0x411740
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ebx]
push esi
push eax
call dword [0x53140c]
lea esi, [eax + 1]
mov eax, dword [edi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, esi
or ecx, edx
jge 0x41176c
mov ecx, esi
mov eax, edi
call fcn.00402120
mov eax, dword [edi]
push esi
push eax
mov eax, dword [ebx]
push eax
call dword [0x5313dc]
cmp eax, 0xffffffff
mov ecx, eax
jne 0x41179f
mov ecx, dword [edi]
test ecx, ecx
je 0x4117a3
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x411790
sub ecx, esi
sar ecx, 1
test ecx, ecx
jl 0x4117b7
mov edx, dword [edi]
cmp ecx, dword [edx - 8]
jg 0x4117b7
mov dword [edx - 0xc], ecx
mov edx, dword [edi]
mov word [edx + ecx*2], 0
pop esi
ret
push 0x80070057
call fcn.004026a0
int3

Function at 0x411880
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0
push str.PermitFlag
push ecx
mov dword [esp + 0x18], 4
call dword [0x531040]
test eax, eax
jne 0x4118b9
mov eax, dword [esp + 8]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 4
Function at 0x413660
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x52ec08
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0xc], esi
lea eax, [esp + 8]
push eax
push 0x20019
push esi
push str.SOFTWARETencentQQPinyinRecommendCellDict
mov dword [esp + 0x28], esi
push 0x80000001
mov dword [esp + 0x1c], esi
call dword [section..rdata]
test eax, eax
jne 0x4136b7
mov esi, dword [esp + 8]
jmp 0x413721
push 0
mov ecx, str.SOFTWARETencentQQPinyin
call fcn.0045dfa0
add esp, 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x2001f
push 1
push 0
push 0
push str.SOFTWARETencentQQPinyinRecommendCellDict
push 0x80000001
mov dword [esp + 0x2c], 0
call dword [0x53100c]
test eax, eax
jne 0x4136fd
mov esi, dword [esp + 8]
xor eax, eax
cmp dword [esp + 0x20], eax
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
setne al
push 0
push str.PermitFlag
push esi
mov dword [esp + 0x38], eax
call dword [0x531010]
test esi, esi
je 0x41372c
push esi
call dword [0x531004]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4

Function at 0x415360
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52eb65
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x56b1dc]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0xc0], 1
call fcn.004156c0
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 4]
and dword [esp + eax + 0x34], 0xfffffffe
lea eax, [esp + eax + 0x24]
mov byte [esp + 0xbc], 2
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], 0
lea edx, [esp + 0xc4]
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x10], 1
call fcn.00415c90
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
add esp, 8
test byte [edx + eax + 8], 6
jne 0x415466
push esi
lea eax, [esp + 0x28]
push eax
call fcn.00415650
test al, al
je 0x415466
lea ecx, [esp + 0x78]
mov byte [esp + 0xbc], 1
call fcn.00413ba0
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.std::ios_base.0
call fcn.005201f6
add esp, 4
cmp dword [esp + 0xdc], 8
jb 0x41544e
mov edx, dword [esp + 0xc8]
push edx
call fcn.004ffbbe
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xbc
ret
push str.bad_cast
lea ecx, [esp + 0x14]
call fcn.00500410
mov eax, 0x573b90
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push 0x55ea80
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], vtable.fund::bad_lexical_cast.0
call fcn.0050957c
int3