joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb0f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov ecx, eax
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4cb101
sub ecx, esi
xor esi, esi
mov dword [ebp - 4], ecx
test ecx, ecx
jle 0x4cb1cb
push ebx
mov bl, byte [ebp + 0xb]
jmp 0x4cb120
cmp byte [eax], 0x3d
je 0x4cb1ca
lea esp, [esp]
mov cl, byte [eax]
test cl, cl
je 0x4cb1ca
lea edx, [ecx - 0x41]
cmp dl, 0x19
ja 0x4cb147
sub cl, 0x41
jmp 0x4cb173
lea edx, [ecx - 0x61]
cmp dl, 0x19
ja 0x4cb154
sub cl, 0x47
jmp 0x4cb173
lea edx, [ecx - 0x30]
cmp dl, 9
ja 0x4cb161
add cl, 4
jmp 0x4cb173
cmp cl, 0x2b
jne 0x4cb16a
mov cl, 0x3e
jmp 0x4cb173
cmp cl, 0x2f
setne cl
add cl, 0x3f
inc eax
cmp cl, 0x40
je 0x4cb130
cmp cl, 0x41
je 0x4cb1ca
mov edx, esi
and edx, 3
cmp edx, 3
ja case.default.0x4cb188
jmp dword [edx*4 + 0x4cb1d8]
add cl, cl
add cl, cl
mov bl, cl
jmp case.default.0x4cb188
mov dl, cl
shr dl, 4
or dl, bl
mov byte [edi], dl
inc edi
shl cl, 4
mov bl, cl
jmp case.default.0x4cb188
mov dl, cl
shr dl, 2
or dl, bl
mov byte [edi], dl
inc edi
shl cl, 6
mov bl, cl
jmp case.default.0x4cb188
mov dl, bl
or dl, cl
mov byte [edi], dl
inc edi
inc esi
cmp esi, dword [ebp - 4]
jl 0x4cb120
pop ebx
mov eax, edi
sub eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d05f0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
mov esi, ecx
call fcn.005de050
lea eax, [esi + 0x364]
add esp, 0xc
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x44c
jb 0x4d062a
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
jmp 0x4d062d
mov dword [ebp - 0x30], eax
mov edx, dword [esi + 4]
mov eax, 0x6906cc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
test eax, eax
je 0x4d0684
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 4], 0x103
jne 0x4d0684
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x4d0770
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x65016c
mov esi, ecx
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 4
push 0x2042
mov dword [ebp - 4], eax
call ebx
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x374]
lea eax, [eax + eax + 0x18]
push eax
push 0x2042
call ebx
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, 0x14
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, 1
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x374]
lea ecx, [esi + 0x364]
add eax, 0x14
cmp dword [ecx + 0x14], 8
lea edx, [edx + edx + 2]
jb 0x4d07fc
mov ecx, dword [ecx]
push edx
push ecx
push eax
call fcn.005dd900
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d083f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
push 0xf
call esi
mov eax, dword [ebp - 4]
push edi
push eax
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
push 1
push 0
push 0x68f468
push 0x650160
push ecx
call fcn.004ee140
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x14
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d0b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x508], 0
je 0x4d0bbc
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push str..Pipepipe_365_kantu
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d0b93
add edi, 0x4f8
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00401320
mov eax, dword [ebp - 0x20]
mov edi, 0x10
add esp, 8
cmp dword [ebp - 0xc], edi
jae 0x4d0b65
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x24]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x4d0ba5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], edi
jb 0x4d0b93
mov eax, dword [ebp - 0x20]
push eax
call fcn.004effaf
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], edi
jb 0x4d0bbc
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004effaf
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4d1570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636931
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, 7
xor edi, edi
xor eax, eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x25c], edi
mov word [ebp - 0x26c], ax
xor edx, edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], dx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x240], edi
mov word [ebp - 0x250], ax
lea esi, [ecx + 0x364]
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x26c]
push eax
push esi
mov byte [ebp - 4], 2
call fcn.004d8f40
push 0x206
lea edx, [ebp - 0x216]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x218], cx
call fcn.005de050
add esp, 0x1c
cmp dword [esi + 0x14], 8
jb 0x4d1630
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x218]
push str.__select___s
push eax
call fcn.00412ff0
push 0x38
lea ecx, [ebp - 0x2a4]
push edi
push ecx
call fcn.005de050
add esp, 0x18
lea eax, [ebp - 0x2a8]
lea edx, [ebp - 0x218]
push eax
mov dword [ebp - 0x2a8], 0x3c
mov dword [ebp - 0x298], str.explorer
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x29c], str.open
mov dword [ebp - 0x28c], 0xa
mov dword [ebp - 0x290], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, 8
cmp dword [ebp - 0x23c], esi
jb 0x4d16b7
mov ecx, dword [ebp - 0x250]
push ecx
call fcn.004effaf
add esp, 4
xor edx, edx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x240], edi
mov word [ebp - 0x250], dx
cmp dword [ebp - 0x220], esi
jb 0x4d16e3
mov eax, dword [ebp - 0x234]
push eax
call fcn.004effaf
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], cx
cmp dword [ebp - 0x258], esi
jb 0x4d170f
mov edx, dword [ebp - 0x26c]
push edx
call fcn.004effaf
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4d3df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4d2f10
push 0
push 0
mov dword [ebp - 4], 0
call fcn.005dfd06
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x4d3e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636da8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
xor edi, edi
lea ecx, [ebp - 0x68]
push ecx
push edi
push edi
push 0x4d3000
push edi
push edi
mov dword [ebp - 0x68], edi
call fcn.005dfd06
lea edx, [ebp - 0x64]
push edx
call fcn.0040c210
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], edi
call fcn.004cb1f0
add esp, 0x24
cmp dword [ebp - 0x50], 8
mov byte [ebp - 4], 2
jb 0x4d3e9f
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.004effaf
add esp, 4
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], edi
mov word [ebp - 0x64], dx
call fcn.00404ee0
add esp, 4
mov edx, dword [ebp - 0x2c]
mov ecx, 0x10
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], ecx
jae 0x4d3ecf
lea edx, [ebp - 0x2c]
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x1c]
mov eax, edi
cmp edi, ebx
jb 0x4d3edd
mov eax, ebx
cmp dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x48]
jae 0x4d3ee8
lea ecx, [ebp - 0x48]
push eax
push edx
push ecx
call fcn.00402f80
add esp, 0xc
test eax, eax
jne 0x4d3f04
cmp edi, ebx
jb 0x4d3f04
cmp edi, ebx
setne al
test eax, eax
je 0x4d3f2d
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0x4d2f10
push 0
push 0
mov dword [ebp - 0x68], 0
call fcn.005dfd06
lea edx, [ebp - 0x48]
push edx
call fcn.00404e20
add esp, 0x1c
push str.full_screen
lea ecx, [esi + 0x2c]
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
push 0x64ff30
mov ecx, eax
mov dword [esi + 0x530], eax
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_wchar_t_const__]
mov ecx, esi
call fcn.004cf240
mov ecx, esi
call fcn.004cf400
xor edi, edi
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push 0x4d3220
push edi
push edi
mov byte [esi + 0x529], 1
mov dword [ebp - 0x6c], edi
call fcn.005dfd06
mov esi, 0x10
add esp, 0x18
cmp dword [ebp - 0x18], esi
jb 0x4d3f93
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004effaf
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x34], esi
jb 0x4d3fb2
mov edx, dword [ebp - 0x48]
push edx
call fcn.004effaf
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4d51d0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x635488
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x18
mov esi, ecx
xor eax, eax
push str.MUTEX_Singleton_365Kantu
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00403600
mov eax, dword [ebp - 0x2c]
mov ebx, 8
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], ebx
jae 0x4d5236
lea eax, [ebp - 0x2c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x4d52ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4d5275
mov ecx, esi
call fcn.004d0b00
test al, al
je 0x4d52ac
cmp dword [ebp - 0x18], ebx
jb 0x4d526e
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004effaf
add esp, 4
mov eax, 2
jmp 0x4d52bf
lea eax, [ebp - 0x30]
push eax
push 0
push esi
push 0x4d4c60
push 0
push 0
mov dword [ebp - 0x30], 0
call fcn.005dfd06
add esp, 0x18
cmp dword [ebp - 0x18], ebx
jb 0x4d52a5
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004effaf
add esp, 4
mov eax, 1
jmp 0x4d52bf
cmp dword [ebp - 0x18], ebx
jb 0x4d52bd
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4d73b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
movsx ecx, ax
shr eax, 0x10
push edi
mov edi, dword [ebp + 0x14]
movsx edx, ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [esi + 4]
push eax
push ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x4d74c6
cmp byte [esi + 0x384], 0
je 0x4d74c6
mov eax, dword [esi + 0x36c]
mov edi, dword [ebp - 0x2c]
sub edi, dword [esi + 0x388]
push ebx
mov ebx, dword [ebp - 0x28]
sub ebx, dword [esi + 0x38c]
lea edx, [ebp - 0x24]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
add edx, edi
add ecx, 0xa
cmp edx, ecx
jl 0x4d74b1
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + edi]
mov edi, dword [ebp - 0x1c]
add edi, 0xfffffff6
cmp eax, edi
jg 0x4d74b1
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x20]
add eax, ebx
add edi, 0x28
mov dword [ebp - 0x34], eax
cmp eax, edi
jl 0x4d74b1
mov eax, dword [ebp - 8]
lea edi, [eax + ebx]
mov ebx, dword [ebp - 0x18]
add ebx, 0xffffffcc
cmp edi, ebx
jg 0x4d74b1
sub eax, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
push 0x40
push eax
push ecx
mov ecx, dword [ebp - 0x34]
push ecx
push edx
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov dword [esi + 0x388], eax
mov dword [esi + 0x38c], ecx
mov dword [edx], 1
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov dword [edi], 0
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d8ad0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x210], edi
jb 0x4d8afb
mov eax, dword [eax]
push esi
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d8b2b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.005de050
add esp, 0xc
pop esi
cmp edi, 0x400
jae 0x4d8b6c
push edi
lea edx, [ebp - 0x20c]
push 0x65138c
push edx
call fcn.00412ff0
add esp, 0xc
jmp 0x4d8c36
cmp edi, 0x100000
jae 0x4d8bb0
mov dword [ebp - 0x210], edi
fild dword [ebp - 0x210]
test edi, edi
jns 0x4d8b8a
fadd dword [0x651388]
fmul qword [0x651380]
sub esp, 8
lea eax, [ebp - 0x20c]
fstp dword [ebp - 0x210]
fld dword [ebp - 0x210]
fstp qword [esp]
push str._.2fKB
push eax
jmp 0x4d8c2e
cmp edi, 0x40000000
jae 0x4d8bf4
mov dword [ebp - 0x210], edi
fild dword [ebp - 0x210]
test edi, edi
jns 0x4d8bce
fadd dword [0x651388]
fmul qword [0x651368]
sub esp, 8
lea ecx, [ebp - 0x20c]
fstp dword [ebp - 0x210]
fld dword [ebp - 0x210]
fstp qword [esp]
push str._.2fMB
push ecx
jmp 0x4d8c2e
mov dword [ebp - 0x210], edi
fild dword [ebp - 0x210]
test edi, edi
jns 0x4d8c0a
fadd dword [0x651388]
fmul qword [0x651350]
sub esp, 8
lea edx, [ebp - 0x20c]
fstp dword [ebp - 0x210]
fld dword [ebp - 0x210]
fstp qword [esp]
push 0x651340
push edx
call fcn.00412ff0
add esp, 0x10
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4d8c52
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, ebx
call fcn.00403600
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4da060
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x224], eax
lea eax, [esi + 0x8ec]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
cmp dword [esi + 0xaa4], ebx
jle 0x4da141
lea edx, [esi + 0x914]
mov dword [ebp - 0x220], edx
lea esp, [esp]
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx]
lea eax, [ebp - 0x21c]
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x224]
push eax
push edi
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4da111
add dword [ebp - 0x220], 4
inc ebx
cmp ebx, dword [esi + 0xaa4]
jl 0x4da0d0
jmp 0x4da141
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x218]
mov dword [esi + 0x8ec], edx
mov edx, dword [ebp - 0x210]
mov dword [esi + 0x8f4], eax
mov dword [esi + 0x8f0], ecx
mov dword [esi + 0x8f8], edx
mov edx, dword [esi + 0xab0]
mov ebx, dword [esi + 0xab4]
mov ecx, dword [ebp - 0x224]
mov eax, edi
sub eax, edx
sub ecx, ebx
cmp edi, edx
jne 0x4da165
cmp dword [ebp - 0x224], ebx
je 0x4da1a9
mov edx, 1
cmp dword [esi + 0xab8], edx
jne 0x4da197
cmp dword [esi + 0xac0], edx
jne 0x4da184
mov dword [esi + 0xac0], 2
cmp dword [esi + 0xac0], 6
jne 0x4da197
mov dword [esi + 0xac0], 7
mov edx, dword [ebp - 0x224]
mov dword [esi + 0xab0], edi
mov dword [esi + 0xab4], edx
mov edx, dword [esi + 0xac0]
cmp edx, 2
jne 0x4da1c0
add dword [esi + 0x904], eax
add dword [esi + 0x908], ecx
cmp edx, 7
jne 0x4da273
mov edx, dword [esi + 0x910]
cmp edx, 8
ja case.default.0x4da1d4
jmp dword [edx*4 + 0x4da29c]
add dword [esi + 0x8fc], eax
add dword [esi + 0x900], ecx
jmp case.default.0x4da1d4
add dword [esi + 0x904], eax
add dword [esi + 0x900], ecx
jmp case.default.0x4da1d4
add dword [esi + 0x8fc], eax
jmp case.default.0x4da1d4
add dword [esi + 0x8fc], eax
add dword [esi + 0x900], ecx
add dword [esi + 0x904], eax
add dword [esi + 0x908], ecx
push 0x207
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.005de050
mov ecx, dword [esi + 0x908]
mov edx, dword [esi + 0x904]
mov eax, dword [esi + 0x900]
push ecx
mov ecx, dword [esi + 0x8fc]
push edx
push eax
push ecx
push str.BTN_CHANGE_ING_m_rcMouseMoveRect_left:_d__top:_d__right:_d_bottom:_d_n
lea edx, [ebp - 0x20c]
push 0x208
push edx
call fcn.005de363
add esp, 0x28
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret 8
add dword [esi + 0x904], eax
jmp case.default.0x4da1d4
add dword [esi + 0x8fc], eax
jmp case.0x4da1d4.7
Function at 0x4da1db
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x224], eax
lea eax, [esi + 0x8ec]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
cmp dword [esi + 0xaa4], ebx
jle 0x4da141
lea edx, [esi + 0x914]
mov dword [ebp - 0x220], edx
lea esp, [esp]
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx]
lea eax, [ebp - 0x21c]
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x224]
push eax
push edi
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4da111
add dword [ebp - 0x220], 4
inc ebx
cmp ebx, dword [esi + 0xaa4]
jl 0x4da0d0
jmp 0x4da141
mov edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x218]
mov dword [esi + 0x8ec], edx
mov edx, dword [ebp - 0x210]
mov dword [esi + 0x8f4], eax
mov dword [esi + 0x8f0], ecx
mov dword [esi + 0x8f8], edx
mov edx, dword [esi + 0xab0]
mov ebx, dword [esi + 0xab4]
mov ecx, dword [ebp - 0x224]
mov eax, edi
sub eax, edx
sub ecx, ebx
cmp edi, edx
jne 0x4da165
cmp dword [ebp - 0x224], ebx
je 0x4da1a9
mov edx, 1
cmp dword [esi + 0xab8], edx
jne 0x4da197
cmp dword [esi + 0xac0], edx
jne 0x4da184
mov dword [esi + 0xac0], 2
cmp dword [esi + 0xac0], 6
jne 0x4da197
mov dword [esi + 0xac0], 7
mov edx, dword [ebp - 0x224]
mov dword [esi + 0xab0], edi
mov dword [esi + 0xab4], edx
mov edx, dword [esi + 0xac0]
cmp edx, 2
jne 0x4da1c0
add dword [esi + 0x904], eax
add dword [esi + 0x908], ecx
cmp edx, 7
jne 0x4da273
mov edx, dword [esi + 0x910]
cmp edx, 8
ja case.default.0x4da1d4
jmp dword [edx*4 + 0x4da29c]
add dword [esi + 0x8fc], eax
add dword [esi + 0x900], ecx
jmp case.default.0x4da1d4
add dword [esi + 0x904], eax
add dword [esi + 0x900], ecx
jmp case.default.0x4da1d4
add dword [esi + 0x8fc], eax
jmp case.default.0x4da1d4
add dword [esi + 0x8fc], eax
add dword [esi + 0x900], ecx
add dword [esi + 0x904], eax
add dword [esi + 0x908], ecx
push 0x207
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.005de050
mov ecx, dword [esi + 0x908]
mov edx, dword [esi + 0x904]
mov eax, dword [esi + 0x900]
push ecx
mov ecx, dword [esi + 0x8fc]
push edx
push eax
push ecx
push str.BTN_CHANGE_ING_m_rcMouseMoveRect_left:_d__top:_d__right:_d_bottom:_d_n
lea edx, [ebp - 0x20c]
push 0x208
push edx
call fcn.005de363
add esp, 0x28
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret 8
add dword [esi + 0x904], eax
jmp case.default.0x4da1d4
add dword [esi + 0x8fc], eax
jmp case.0x4da1d4.7