joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021bb0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011aef6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1019142c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10021a90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x20], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x24], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x28], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.10021b20
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x4c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.10021b20
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x64]
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x68]
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x6c]
mov dword [eax + 0x6c], edx
mov eax, dword [ebp + 8]
add eax, 0x70
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.10021b20
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 8]
add ecx, 0x88
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x88
call fcn.10021b20
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa0]
mov dword [edx + 0xa0], ecx
mov edx, dword [ebp + 8]
add edx, 0xa4
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.10021b20
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xbc]
mov dword [eax + 0xbc], edx
mov eax, dword [ebp + 8]
add eax, 0xc0
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xc0
call fcn.10021b20
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 8]
add ecx, 0xd8
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xd8
call fcn.10021b20
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf0]
mov dword [edx + 0xf0], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf4]
mov dword [edx + 0xf4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xf8]
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xfc]
mov dword [edx + 0xfc], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10023930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x10023a1b
cmp dword [0x101973bc], 0xffffffff
je 0x1002398a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x101973bc]
cmp eax, 0x64
jae 0x1002397f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x10023a2f
mov ecx, dword [ebp - 0x10]
mov dword [0x101973bc], ecx
jmp 0x10023995
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101973bc], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10023a1b
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100243d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0x2e0
jne 0x100244bb
cmp dword [0x101973c0], 0xffffffff
je 0x1002442a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [0x101973c0]
cmp eax, 0x64
jae 0x1002441f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x100244cf
mov ecx, dword [ebp - 0x10]
mov dword [0x101973c0], ecx
jmp 0x10024435
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101973c0], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x100244bb
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002ad40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011b7a3
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x1019142c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c0], 0
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea ecx, [ebp + 0xc]
call fcn.10021de0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0xffffffff
jne 0x1002addf
push str.001233
mov ecx, dword [ebp + 8]
call fcn.100213a0
mov eax, dword [ebp - 0x4c0]
or eax, 1
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10022960
mov eax, dword [ebp + 8]
jmp 0x1002ae98
lea ecx, [ebp - 0x4bc]
call fcn.10029590
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x4c8]
push ecx
push 0x400
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x4c4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002ae3a
cmp dword [ebp - 0x4c8], 0
jne 0x1002ae1f
jmp 0x1002ae3a
mov ecx, dword [ebp - 0x4c8]
push ecx
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x4bc]
call fcn.100296b0
jmp 0x1002adee
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.10029800
mov ecx, dword [ebp - 0x4c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1002ab80
add esp, 0xc
mov ecx, dword [ebp - 0x4c0]
or ecx, 1
mov dword [ebp - 0x4c0], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4bc]
call fcn.100295f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10022960
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ddfee
mov esp, ebp
pop ebp
ret
Function at 0x1002f1e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1002f27e
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp byte [ebp - 1], 0
jne 0x1002f233
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
jmp 0x1002f280
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1002ffe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011bc58
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1019142c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.100226d0
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030116
mov eax, dword [ebp - 0x30]
add eax, 2
push eax
call fcn.100f562e
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100db6b0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push 0
push 0
lea ecx, [ebp + 8]
call fcn.100226d0
push eax
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100300ed
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.10018650
mov edx, dword [ebp - 0x30]
add edx, 1
shr edx, 1
push edx
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002fe60
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.10018670
lea ecx, [ebp - 0x28]
call fcn.10022b70
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100f5639
add esp, 4
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10022b70
mov eax, dword [ebp - 0x3c]
jmp 0x10030140
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100f5639
add esp, 4
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10022b70
mov eax, dword [ebp - 0x40]
jmp 0x10030140
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10022b70
mov eax, dword [ebp - 0x44]
jmp 0x10030140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ddfee
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100306a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2e0
je 0x100306d5
cmp dword [ebp - 0x10], 0x4d2
je 0x100306c6
jmp 0x100307a9
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x100307a9
cmp dword [0x10197954], 0xffffffff
je 0x10030719
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x10197954]
cmp ecx, 0x64
jae 0x1003070e
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x100307bd
mov edx, dword [ebp - 0x14]
mov dword [0x10197954], edx
jmp 0x10030724
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10197954], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push 0x14
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x100307a9
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10030b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x113
je 0x10030b7e
cmp dword [ebp - 0x10], 0x2e0
je 0x10030ba8
cmp dword [ebp - 0x10], 0x4d2
je 0x10030b6f
jmp 0x10030c7d
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10030c7d
push 0x463
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp + 0xc], 0x463
jne 0x10030ba3
push 1
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10030c7d
cmp dword [0x10197958], 0xffffffff
je 0x10030bec
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [0x10197958]
cmp eax, 0x64
jae 0x10030be1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x10030c91
mov ecx, dword [ebp - 0x14]
mov dword [0x10197958], ecx
jmp 0x10030bf7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10197958], eax
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x14
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
sub ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10030c7d
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10038330
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011b626
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x1019142c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], ecx
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], 0
push 0x10148358
mov ecx, dword [ebp - 0x128]
call sym.UserAndPayClient.dll_public:_bool___thiscall_xx_DuiLib::CDuiString::operator_wchar_t_const__const
mov byte [ebp - 0x119], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
movzx edx, byte [ebp - 0x119]
test edx, edx
je 0x100383df
push 0
mov ecx, dword [ebp - 0x120]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1003846a
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 4], 1
push str.buyVip
mov ecx, dword [ebp - 0x130]
call sym.UserAndPayClient.dll_public:_bool___thiscall_xx_DuiLib::CDuiString::operator_wchar_t_const__const
mov byte [ebp - 0x11a], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
movzx edx, byte [ebp - 0x11a]
test edx, edx
je 0x1003846a
push 0
mov eax, dword [ebp - 0x120]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov ecx, dword [ebp - 0x120]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ddfee
mov esp, ebp
pop ebp
ret 4
Function at 0x10038c10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2e0
je 0x10038c2d
jmp 0x10038d01
cmp dword [0x10197974], 0xffffffff
je 0x10038c71
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x10197974]
cmp ecx, 0x64
jae 0x10038c66
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
jmp 0x10038d15
mov edx, dword [ebp - 0x10]
mov dword [0x10197974], edx
jmp 0x10038c7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10197974], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::SetDPI_int_
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CPaintManagerUI::ResetDPIAssets_void_
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
push 0x14
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
test eax, eax
je 0x10038d01
mov ecx, dword [ebp - 8]
add ecx, 0x30
call sym.UserAndPayClient.dll_public:_class_xx_DuiLib::CControlUI____thiscall_xx_DuiLib::CPaintManagerUI::GetRoot_void_const
mov ecx, eax
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CControlUI::NeedUpdate_void_
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call sym.UserAndPayClient.dll_public_virtual:_long_int___thiscall_xx_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
mov esp, ebp
pop ebp
ret 0xc