joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x1001a491
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1001a496
jmp 0x10019de9
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1001a4dd
lea eax, [ebp - 0x714]
push eax
call fcn.10018457
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.1001840c
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1001a4e8
jmp 0x1001a4ed
jmp 0x10019de9

Function at 0x1001a600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jo 0x1001a61e
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x1001a60b
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10018447
mov eax, 0x8bee0d70
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
push esp
pop es
js 0x1001a625
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.10018447
test eax, 0x8b496726
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x1001a634
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x1001a634
call fcn.10018447
push cs
pop esp
shl dword [esi], 1
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.10018447
invalid
Function at 0x1001a810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 2
jne 0x1001a8e8
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hResourceInstance]
test eax, eax
jne 0x1001a82b
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance]
mov ecx, dword [esp + 0x10]
movzx edx, word [esp + 0xc]
push ebp
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
je 0x1001a893
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hResourceInstance]
test eax, eax
jne 0x1001a852
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance]
push ebx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x1001a86d
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop ebp
ret 0x14
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hResourceInstance]
test eax, eax
jne 0x1001a87b
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance]
push esi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
jne 0x1001a897
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop ebx
pop ebp
ret 0x14
push edi
push esi
call fcn.10062a58
mov edi, eax
add esp, 4
test edi, edi
je 0x1001a8da
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
cmp byte [esp + 0x24], 0
push esi
push edi
je 0x1001a8c9
call sym.DTLUI.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetBaseResourceZip_void___unsigned_int_
jmp 0x1001a8ce
call sym.DTLUI.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetSkinExResourceZip_void___unsigned_int_
add esp, 8
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp eax, 1
jne 0x1001a894
cmp byte [esp + 0x14], 0
je 0x1001a905
push eax
mov eax, dword [esp + 0xc]
push eax
call sym.DTLUI.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceZip_wchar_t_const___bool_
add esp, 8
ret 0x14
mov ecx, dword [esp + 8]
push ecx
call sym.DTLUI.dll_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceZipEx_wchar_t_const__
add esp, 4
ret 0x14
Function at 0x1001e100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
test ecx, ecx
jne 0x1001e10b
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1001e1e4
mov esi, edx
shr esi, 3
push edi
lea ecx, [ecx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006e360]
inc ecx
sub edx, 8
sub esi, 1
jne 0x1001e120
pop edi
test edx, edx
je 0x1001e20b
jmp 0x1001e1f0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x1006e360]
inc ecx
sub edx, 1
jne 0x1001e1f0
not eax
pop esi
ret

Function at 0x1001e9a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
imul esi, dword [esp + 0x10]
cmp byte [edi], 0
je 0x1001e9d8
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001e9cd
mov byte [edi + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x1001e9eb
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call sub.MSVCR90.dll_memcpy
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret
Function at 0x1001ec00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x1001ec45
cmp byte [esi + 1], 0
je 0x1001ec4d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x1001ec61
cmp byte [esi + 1], 0
je 0x1001ec53
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x1001ec6a
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x1001ec1e
xor eax, eax
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x1001ec6a
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x1001ec7e
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call dword [sym.imp.MSVCR90.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1001ec9a
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0
cmp edi, eax
jbe 0x1001edac
jmp 0x1001ecbd
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x1001ecce
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x1001ece7
mov ebp, 0x404
cmp byte [esi], 0
je 0x1001ed0c
cmp byte [esi + 1], 0
je 0x1001edac
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001ed0f
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebp
je 0x1001ed37
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001ed31
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x1001ed5d
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x1001ed48
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
push edi
add ecx, eax
push ecx
push ebx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x1001edac
lea eax, [ebp - 3]
test eax, eax
jle 0x1001ed9e
lea ecx, [ecx]
dec eax
cmp byte [eax + ebx], 0x50
jne 0x1001ed8c
cmp byte [eax + ebx + 1], 0x4b
jne 0x1001ed8c
cmp byte [eax + ebx + 2], 5
jne 0x1001ed8c
cmp byte [eax + ebx + 3], 6
je 0x1001ed92
test eax, eax
jg 0x1001ed70
jmp 0x1001ed9e
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
jne 0x1001edac
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x1001ecb1
push ebx
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x1001fa70
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
jne 0x1001fb03
cmp dword [esi + 4], 0xffffffff
jne 0x1001fb03
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001faa0
mov eax, dword [0x1006f22c]
mov dword [edi], eax
cmp ebx, 1
jne 0x1001face
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebx
je 0x1001face
mov eax, 0x2000000
pop edi
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
push ebp
mov edi, ebx
call fcn.1001e860
add esp, 0xc
test eax, eax
jne 0x1001faf1
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
ret 0xc
call fcn.1001edd0
mov dword [esi], eax
mov eax, dword [0x100a6c38]
pop edi
pop ebp
pop ebx
ret 0xc
pop edi
pop ebp
mov eax, 0x1000000
pop ebx
ret 0xc

Function at 0x10025690
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, ecx
mov cl, byte [esp + 4]
mov byte [eax + 0x171], cl
test cl, cl
jne 0x100256bc
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x100256bc
cmp dword [ecx + 0x94], eax
jne 0x100256bc
mov dword [esp + 4], 0
jmp sym.DTLUI.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SetFocus_class_DuiLib::CControlUI__
ret 4

Function at 0x1002a5d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x1002a5e8
mov esi, 8
push 2
call edi
test ax, ax
jge 0x1002a5f4
or esi, 2
push 1
call edi
test ax, ax
jge 0x1002a600
or esi, 1
push 0x10
call edi
test ax, ax
jge 0x1002a60c
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x1002a618
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x1002b430
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x100a501c]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x12]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x14], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esi + 4]
xor ecx, ecx
push 0xffffffffffffffff
lea edx, [esp + 0xc]
mov word [eax], cx
push edx
mov ecx, esi
mov dword [esi], eax
call sym.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::Assign_wchar_t_const___int_
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10062a76
add esp, 0x214
ret
Function at 0x1002ec50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
cmp eax, ecx
je 0x1002ec85
cmp edi, dword [esi + 0x94]
je 0x1002ec85
cmp byte [esi + 0xfb], 0
je 0x1002ec85
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x94]
cmp edi, eax
je 0x1002eda2
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x1002ed05
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0x15
mov dword [esp + 0x14], edi
call ebx
mov ecx, dword [esi + 0x94]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x124]
lea edx, [esp + 0x10]
push edx
call eax
mov ecx, dword [esi + 0x94]
push 0
push 0
push 0
push str.killfocus
push ecx
mov ecx, esi
call sym.DTLUI.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov dword [esi + 0x94], 0
test edi, edi
je 0x1002eda2
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
cmp eax, esi
jne 0x1002eda2
mov edx, dword [edi]
mov eax, dword [edx + 0xe4]
mov ecx, edi
call eax
test al, al
je 0x1002eda2
mov edx, dword [edi]
mov eax, dword [edx + 0xf0]
mov ecx, edi
call eax
test al, al
je 0x1002eda2
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x94], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0x16
mov dword [esp + 0x14], edi
call ebx
mov ecx, dword [esi + 0x94]
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x124]
lea eax, [esp + 0x10]
push eax
call edx
mov eax, dword [esi + 0x94]
push 0
push 0
push 0
push str.setfocus
push eax
mov ecx, esi
call sym.DTLUI.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100342f0
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
test ecx, ecx
jne 0x10034322
mov ecx, dword [esp + 0x18]
push edi
lea eax, [esp + 0x14]
push eax
push ecx
call sym.DTLUI.dll_public:_static_int___cdecl_DuiLib::CPaintManagerUI::LoadFileData_wchar_t_const___unsigned_char____bool_
mov edi, dword [esp + 0x1c]
add esp, 0xc
mov dword [ebx], eax
jmp 0x100343a1
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hResourceInstance]
test eax, eax
jne 0x10034330
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x100343a5
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hResourceInstance]
test eax, eax
jne 0x10034351
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x1003439a
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hResourceInstance]
test eax, eax
jne 0x1003436d
mov eax, dword [sym.DTLUI.dll_struct_HINSTANCE____DuiLib::CPaintManagerUI::m_hInstance]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
test eax, eax
je 0x1003439a
push eax
call fcn.10062a58
add esp, 4
mov edi, eax
mov eax, dword [ebx]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
jne 0x10034423
mov ecx, dword [esp + 0x18]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003441b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x10034410
push eax
mov dword [esp + 0x20], 0
call fcn.10062a58
add esp, 4
push 0
mov edi, eax
mov eax, dword [ebx]
lea edx, [esp + 0x20]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [ebx]
je 0x10034410
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x10034423
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10038390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10063f60
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a501c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, dword [esp + 0x60]
mov ebp, dword [edi + 8]
mov esi, dword [edi + 0xc]
sub ebp, dword [edi]
sub esi, dword [edi + 4]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x50], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], esi
imul esi, ebp
add esi, esi
mov dword [esp + 0x28], eax
mov ecx, 1
mov edx, 0x20
add esi, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x1c], 0x28
mov dword [esp + 0x20], ebp
mov word [esp + 0x28], cx
mov word [esp + 0x2a], dx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x60], eax
mov byte [esp + 0x50], cl
mov ecx, dword [esp + 0x58]
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx]
push eax
push eax
lea edx, [esp + 0x68]
push edx
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
push esi
push ebx
mov dword [esp + 0x20], esi
call ebp
mov ecx, dword [esp + 0x5c]
mov edx, dword [ecx]
push edi
push edi
mov dword [esp + 0x60], eax
mov eax, dword [edx + 0x138]
push ebx
call eax
mov ecx, dword [esp + 0x58]
push ecx
push ebx
call ebp
test ebx, ebx
je 0x1003849e
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x1003f030
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov al, byte [esp + 4]
mov byte [ecx + 0x171], al
test al, al
jne 0x1003f05c
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x1003f074
cmp dword [eax + 0x94], ecx
jne 0x1003f074
mov dword [esp + 4], 0
mov ecx, eax
jmp sym.DTLUI.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SetFocus_class_DuiLib::CControlUI__
cmp byte [ecx + 0x170], 0
je 0x1003f074
mov eax, dword [ecx + 0x754]
mov dword [esp + 4], eax
jmp sym.DTLUI.dll_public:_void___thiscall_DuiLib::CAnimationUI::StartAnimation_int_
ret 4
Function at 0x100432e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov dword [esi + 0x10], eax
push ebx
mov dword [eax + 0x7fc], 0
cmp dword [esi + 4], 0
push edi
jne 0x10043376
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
call edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x1c]
call edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
push 0
sub ebx, edx
push ebx
sub edi, ecx
push edi
push edx
push ecx
push 0
push 0x40000000
push 0
push eax
mov ecx, esi
call sym.DTLUI.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x74c]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x1c]
call eax
mov ecx, eax
call sym.DTLUI.dll_public:_struct_DuiLib::tagTFontInfo____thiscall_DuiLib::CPaintManagerUI::GetFontInfo_int_
mov ecx, dword [eax]
mov edx, dword [esi + 4]
push 1
push ecx
push 0x30
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x1c]
push edx
call eax
mov ecx, dword [eax]
cmp word [ecx], 0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
sete bl
cmp eax, edx
je 0x100433a4
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test bl, bl
je 0x100433b7
mov eax, dword [esi + 0x10]
add eax, 0x7ec
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
add ecx, 0x7ec
push ecx
push 0
push 0x1002
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov byte [esi + 0x18], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100440a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100a501c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0x10], 0
push ebx
push edi
je 0x1004410b
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.10063690
mov ebx, esp
test ebx, ebx
je 0x1004410b
mov ecx, dword [esi + 4]
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push 0xffffffffffffffff
add ecx, 0x194
push ebx
call sym.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::Assign_wchar_t_const___int_
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
push 0
push 0
push 0
push str.textchanged
push ecx
call eax
mov ecx, eax
call sym.DTLUI.dll_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062a76
mov esp, ebp
pop ebp
ret