joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d45d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x18]
movzx eax, byte [edi]
mov byte [esi], al
movzx eax, byte [edi + 1]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
mov byte [esi + 2], al
movzx eax, byte [edi + 3]
mov byte [esi + 3], al
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
movzx eax, byte [edi + 6]
mov byte [esi + 6], al
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
cmp ecx, eax
je 0x4d4636
push 0xffffffffffffffff
push 0
push eax
call fcn.00413280
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
cmp ecx, eax
je 0x4d464a
push 0xffffffffffffffff
push 0
push eax
call fcn.00413280
lea ebx, [edi + 0x48]
lea edi, [esi + 0x48]
cmp edi, ebx
je 0x4d4684
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
call fcn.004d5ea0
mov eax, dword [edi]
mov ecx, edi
mov byte [ebp + 8], 0
push dword [ebp + 8]
mov dword [eax + 4], eax
mov eax, dword [edi]
push ebx
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
call fcn.004d7ea0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4e08d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608c5d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x258]
push eax
call fcn.00579a20
push 0x6398f8
push eax
lea eax, [ebp - 0x2a0]
mov dword [ebp - 4], 0
push eax
call fcn.004256f0
push str.XuanZhi9_
push eax
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 1
push eax
call fcn.004256f0
push str.appconfig.ini
push eax
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 2
push eax
call fcn.004256f0
add esp, 0x28
cmp dword [ebp - 0x274], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x4e096c
push dword [ebp - 0x288]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x274], 7
mov dword [ebp - 0x278], 0
mov word [ebp - 0x288], ax
cmp dword [ebp - 0x28c], 8
jb 0x4e099d
push dword [ebp - 0x2a0]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x28c], 7
mov dword [ebp - 0x290], 0
mov word [ebp - 0x2a0], ax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x244], 8
jb 0x4e09d2
push dword [ebp - 0x258]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x244], 7
cmp dword [ebp - 0x25c], 8
mov word [ebp - 0x258], ax
lea eax, [ebp - 0x270]
cmovae eax, dword [ebp - 0x270]
push eax
push 0x50
lea eax, [ebp - 0x210]
mov dword [ebp - 0x248], 0
push eax
push 0x63d740
push str.firststart
push 0x63e0d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
mov edi, eax
add esp, 4
cmp edi, 1
jne 0x4e0b46
lea eax, [ebp - 0x2d0]
push eax
call fcn.00579a20
push 0x6398f8
push eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 7
push eax
call fcn.004256f0
push str.XuanZhi9_
push eax
lea eax, [ebp - 0x2b8]
mov byte [ebp - 4], 8
push eax
call fcn.004256f0
push str.appconfig.ini
push eax
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 9
push eax
call fcn.004256f0
add esp, 0x28
cmp dword [ebp - 0x2a4], 8
jb 0x4e0aa2
push dword [ebp - 0x2b8]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x2a4], 7
cmp dword [ebp - 0x214], 8
mov dword [ebp - 0x2a8], 0
mov word [ebp - 0x2b8], ax
jb 0x4e0ad3
push dword [ebp - 0x228]
call esi
add esp, 4
xor eax, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x2bc], 8
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x4e0b08
push dword [ebp - 0x2d0]
call esi
add esp, 4
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
cmovae eax, dword [ebp - 0x240]
push eax
push 0x63e488
push str.firststart
push 0x63e0d0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0x22c], 8
jb 0x4e0b46
push dword [ebp - 0x240]
call esi
add esp, 4
push edi
push str.is_first_start__d
push 0x96
push str.view::AppModel::isFirstStart
call fcn.0056c830
add esp, 0x10
cmp edi, 1
sete bl
cmp dword [ebp - 0x25c], 8
jb 0x4e0b78
push dword [ebp - 0x270]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x4e12b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608c9b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x240]
push eax
call fcn.00579910
push str.data.ini
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
push eax
call fcn.004256f0
add esp, 0x10
cmp dword [ebp - 0x22c], 8
jb 0x4e131c
push dword [ebp - 0x240]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0x50
lea eax, [ebp - 0x210]
push eax
push 0x63e488
push str.fullscreen
push 0x63e0d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
add esp, 4
cmp eax, 1
sete bl
cmp dword [ebp - 0x214], 8
jb 0x4e137d
push dword [ebp - 0x228]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret

Function at 0x4e13a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608c9b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x240]
push eax
call fcn.00579910
push str.data.ini
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
push eax
call fcn.004256f0
add esp, 0x10
cmp dword [ebp - 0x22c], 8
jb 0x4e140c
push dword [ebp - 0x240]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0x50
lea eax, [ebp - 0x210]
push eax
push 0x63d740
push str.joystickEntrance
push 0x63e0d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
add esp, 4
cmp eax, 1
sete bl
cmp dword [ebp - 0x214], 8
jb 0x4e146d
push dword [ebp - 0x228]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x4e17d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608d86
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x13
xor eax, eax
mov dword [ebp - 0x258], 0
push str.SOFTWARE_fwzsSetup
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00413650
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x250]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4e187a
push 0x6304a0
mov ecx, esi
call fcn.00413780
jmp 0x4e1929
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x254]
push eax
push 0
push str.Path
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4e18be
push 0x6304a0
mov ecx, esi
call fcn.00413780
jmp 0x4e1929
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00413780
push 0xd
push str.Bin_fwzs.exe
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.004245a0
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.00418050
cmp dword [ebp - 0x234], 8
jb 0x4e190c
push dword [ebp - 0x248]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp dword [ebp - 0x21c], 8
jb 0x4e1941
push dword [ebp - 0x230]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x4e4640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa968
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x37
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SYSTEMCurrentControlSetControlDeviceGuardScenarios_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00413650
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0042da40
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4e4748
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push str.Enabled
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e4716
cmp dword [ebp - 0x30], eax
je 0x4e473d
cmp dword [esi + 0x14], 8
jb 0x4e46fa
mov esi, dword [esi]
push esi
push str._s_not_0
push 0x6ae
push str.view::isEnableDeviceGuid
call fcn.0056c830
add esp, 0x10
mov bl, 1
jmp 0x4e4771
cmp dword [esi + 0x14], 8
jb 0x4e471e
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_read_error__d
push 0x6b3
push str.view::isEnableDeviceGuid
call fcn.0056c830
add esp, 0x14
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4e476f
cmp dword [esi + 0x14], 8
jb 0x4e4750
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_open_error__d
push 0x6b9
push str.view::isEnableDeviceGuid
call fcn.0056c830
add esp, 0x14
xor bl, bl
cmp dword [ebp - 0x14], 8
jb 0x4e4783
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x4e4f50
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x609422
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
mov dword [ebp - 0xa4], 0
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
sar esi, 0x10
push edi
and esi, 0xfff
call ebx
test eax, eax
jne 0x4e4fab
push 1
push esi
call ebx
mov edi, eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
xorps xmm0, xmm0
push 0x10
movq qword [ebp - 0xa0], xmm0
call esi
mov ebx, dword [ebp - 0xa0]
xor ecx, ecx
test ax, ax
mov edx, 4
push 0x11
cmovs ecx, edx
or ebx, ecx
call esi
xor ecx, ecx
mov edx, 2
test ax, ax
push 0x12
cmovs ecx, edx
or ebx, ecx
call esi
xor ecx, ecx
test ax, ax
sets cl
or ebx, ecx
cmp edi, 0x10
je 0x4e5037
cmp edi, 0x11
je 0x4e5037
cmp edi, 0x12
je 0x4e5037
mov edx, edi
lea ecx, [ebp - 0x98]
call fcn.004e51a0
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 0xa4], 1
call fcn.005a78d0
test al, al
jne 0x4e5037
mov word [ebp - 0x9c], di
jmp 0x4e5040
xor eax, eax
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], 0xffffffff
test byte [ebp - 0xa4], 1
je 0x4e505b
lea ecx, [ebp - 0x98]
call fcn.005a6ee0
mov edx, dword [ebp - 0x9c]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x4e74a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov edi, edx
push eax
push 0
push 0x2011f
push 0
push 0
push 0
push str.SoftwareXuanZhildmultiplay
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4e7535
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x4e74e7
mov esi, dword [esi]
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push 0x63ff1c
push dword [ebp - 4]
call esi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x4e750f
mov edi, dword [edi]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push str.Version
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.install_writeRegedit_machine__multi_failed_
push 0x941
push str.view::AppModel::saveMulPath
call fcn.0056c830
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e78e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 1
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esi + 0x7c]
push 0
push 0
push 0x24e4
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [esi + 0x7c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [esi + 0x78]
push 0
mov eax, dword [ecx]
call dword [eax + 0x11c]
mov byte [0x6d5b58], 0
pop esi
ret

Function at 0x4e82f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x609d88
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6af320]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov eax, dword [0x6af320]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.00571db0
push 0x26
xor eax, eax
mov dword [esp + 0x30], 7
push str.3A53EB8F_E5E8_4046_B0F2_A953D10459AC
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00413650
lea eax, [esp + 0x18]
mov dword [esp + 0x40], 0
push eax
lea ecx, [esp + 0x10]
call fcn.00571fe0
mov dword [esp + 0x40], 0xffffffff
mov bl, al
cmp dword [esp + 0x2c], 8
jb 0x4e8389
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
test bl, bl
je 0x4e83bf
push str.ldspace_exist
push 0xa30
push str.view::AppModel::isLDSpaceRunning
call fcn.0056c830
add esp, 0xc
mov al, 1
jmp 0x4e83d8
push str.ldspace_not_exist
push 0xa34
push str.view::AppModel::isLDSpaceRunning
call fcn.0056c830
add esp, 0xc
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x4e8680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x609d88
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6af320]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov eax, dword [0x6af320]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push dword [ebp + 8]
push str.post_to_group__d
push 0xa79
push str.view::AppModel::postToGroupControl
call fcn.0056c830
add esp, 0x10
lea ecx, [esp + 0xc]
call fcn.00571db0
push 0x26
xor eax, eax
mov dword [esp + 0x30], 7
push 0x6526e8
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00413650
lea eax, [esp + 0x18]
mov dword [esp + 0x40], 0
push eax
lea ecx, [esp + 0x10]
call fcn.00571fe0
mov dword [esp + 0x40], 0xffffffff
mov bl, al
cmp dword [esp + 0x2c], 8
jb 0x4e8733
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
test bl, bl
je 0x4e8762
push dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00572120
jmp 0x4e8779
push str.multi_not_exist
push 0xa7f
push str.view::AppModel::postToGroupControl
call fcn.0056c830
add esp, 0xc
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ea940
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8f03
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6af320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
call fcn.004458f0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
mov dword [edi], vtable.std::_Packaged_state_void____cdecl___void__.0
mov dword [ebp - 0x18], ecx
mov dword [ecx + 0x10], 0
push ecx
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004eaff0
mov dword [ebp - 4], 2
lea ebx, [edi + 0x48]
mov dword [edi], vtable.std::_Task_async_state_void__0_.0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov byte [ebp - 4], 3
lea eax, [edi + 4]
mov ecx, 1
lock xadd dword [eax], ecx
sub esp, 0x2c
mov esi, esp
sub esp, 8
mov ecx, esp
call fcn.00445af0
mov ecx, esi
call fcn.00445a70
lea ecx, [esi + 0xc]
call fcn.00445b00
mov dword [esi + 0x1c], 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x18], 0
mov byte [esi + 0x14], 0
push edi
mov word [esi + 0x28], 0
call fcn.004eaad0
add esp, 0x30
cmp ebx, eax
je 0x4eaa23
push eax
mov ecx, ebx
call fcn.00445b50
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x4eaa4f
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x4eaa4f
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x4eaa4f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov byte [edi + 0x26], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4edd30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, ecx
push edi
movzx eax, byte [esi + 0x1f5]
push eax
movzx eax, bl
push eax
push str.showMainFrame__force___d__showFlag___d
push 0x1d3
push str.CCmdLineMgr::showMainFrame
call fcn.0056c830
add esp, 0x14
test bl, bl
je 0x4eddab
cmp byte [esi + 0x1f5], 0
mov edi, dword [ebp + 8]
jne 0x4edd8b
push ecx
mov ecx, dword [ebp + 0xc]
mov byte [esi + 0x1f5], 1
call fcn.0054f960
push 1
push edi
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov byte [esi + 0x1f6], 0
push edi
call fcn.00573f70
add esp, 4
mov byte [0x6d5bb0], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x1f5], 0
je 0x4eddee
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0054f960
mov edi, dword [ebp + 8]
push 1
push edi
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
cmp byte [esi + 0x1f6], 0
je 0x4edd92
push 0
push 0xf020
push 0x112
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.mainframe_hide
push 0x1ef
push str.CCmdLineMgr::showMainFrame
call fcn.0056c830
add esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f23b0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60af5c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6af320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.005b70a0
mov dword [ebp - 4], 0
mov dword [edi], vtable.view::CDraggingIconUI.0
mov dword [edi + 0x1828], 0
lea esi, [edi + 0x1830]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.005a6db0
lea ecx, [esi + 8]
call fcn.005a6d30
lea ecx, [esi + 0x18]
call fcn.005a6d30
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 2
mov ecx, edi
movdqu xmm0, xmmword [ebp + 8]
push 0x24
mov byte [edi + 0x1898], 0
movdqu xmmword [edi + 0x1888], xmm0
call fcn.005baf00
push 0x24
mov ecx, edi
call fcn.005baef0
push 1
mov ecx, edi
call fcn.005b58f0
sub esp, 0x18
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_struct_std::_Callable_obj_class__lambda_989701223720de8644926303afec5152___0___class_std::allocator_class_std::_Func_class_void__class_DuiLib::CDuiRect____void__class_DuiLib::CDuiRect_.0
mov ecx, esi
push 0
mov dword [eax + 4], edi
push edi
mov dword [eax + 0x10], eax
mov byte [ebp - 4], 2
call fcn.00506e40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f54c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x60bb6b
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x6af320]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [0x6af320]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x30], 7
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], eax
mov word [esp + 0x4c], ax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
mov byte [esp + 0x7c], 1
movupd xmmword [esp + 0x84], xmm0
mov dword [esp + 0xa8], eax
xor edx, edx
movdqu xmm0, xmmword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov eax, esp
movdqu xmmword [esp + 0x14], xmm0
mov dword [eax], edx
mov ecx, dword [ecx]
add ecx, 0x528
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [esp + 0xc]
call fcn.00499920
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4f55b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x60bbab
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x6af320]
xor eax, esp
mov dword [esp + 0x90], eax
push esi
mov eax, dword [0x6af320]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x30], 0xf
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], eax
mov word [esp + 0x4c], ax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
mov byte [esp + 0x7c], 1
movupd xmmword [esp + 0x84], xmm0
mov dword [esp + 0xa8], eax
lea ecx, [esp + 0x1c]
movdqu xmm0, xmmword [ebp + 8]
push eax
push 0x63c6c8
movdqu xmmword [esp + 0x14], xmm0
call fcn.0042d440
lea eax, [esp + 0xc]
push eax
push ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [esi]
add ecx, 0x528
mov eax, dword [ecx]
call dword [eax + 0x2c]
lea ecx, [esp + 0xc]
call fcn.00495d70
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret 0x10