joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a27f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592f93
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0048d030
mov dword [ebp - 4], 0
mov dword [edi + method.CSTree_struct_SOUI::tagTVITEM__.virtual_0], vtable.CSTree_struct_SOUI::tagTVITEM__.0
mov dword [edi + 0x3bc], 0
mov dword [edi + 0x3c0], 0
mov dword [edi], vtable.SOUI::STreeCtrl.0
mov dword [edi + 4], vtable.SOUI::STreeCtrl.1.0
mov dword [edi + 8], vtable.SOUI::STreeCtrl.2.0
mov dword [edi + method.SOUI::SPanel.3.virtual_0], vtable.SOUI::STreeCtrl.3.0
mov dword [edi + method.SOUI::STreeCtrl.4.virtual_0], vtable.SOUI::STreeCtrl.4.0
mov dword [edi + 0x3c4], 0
mov dword [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov dword [edi + 0x3fc], 0
mov dword [edi + 0x400], 0
mov dword [edi + 0x404], 0
mov dword [edi + 0x408], 0
mov dword [edi + 0x40c], 0
push 0x64
mov dword [edi + 0x410], 0
mov dword [edi + 0x414], 0
mov dword [edi + 0x418], 0x14
mov dword [edi + 0x41c], 0x12
mov dword [edi + 0x420], 4
mov dword [edi + 0x424], 0
mov dword [edi + 0x428], 0
mov dword [edi + 0x42c], 0
mov dword [edi + 0x430], 0
mov dword [edi + 0x434], 0
mov ecx, dword [0x5f95b8]
push 8
mov byte [ebp - 4], 1
call fcn.0044c430
push 0x64
mov dword [edi + 0x438], eax
mov ecx, dword [0x5f95b8]
push 9
call fcn.0044c430
push 0x64
mov dword [edi + 0x43c], eax
mov ecx, dword [0x5f95b8]
push 0xa
call fcn.0044c430
mov dword [edi + 0x440], eax
mov dword [edi + 0x444], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x448], eax
mov dword [edi + 0x44c], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x450], eax
mov dword [edi + 0x454], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x458], eax
mov dword [edi + 0x45c], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x460], eax
mov eax, dword [edi + 0x164]
mov byte [ebp - 4], 5
or eax, 8
mov dword [edi + 0x464], 0
mov dword [edi + 0x444], 0xffffffff
mov dword [edi + 0x44c], 0xff880000
mov dword [edi + 0x454], 0xff000000
mov dword [edi + 0x45c], 0xffffffff
push 0x5a9df0
or eax, 0x20
lea ecx, [edi + 0x30]
push 0x3a98
mov dword [edi + 0x164], eax
call fcn.0048c7e0
push 0x5a9e74
push 0x3a99
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5a9ef4
push 0x3a9b
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5a9f74
push 0x3a9a
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5a9ff4
push 0x3a9c
lea ecx, [edi + 0x30]
call fcn.0048c7e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a60b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59324b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004742a0
mov dword [edi + method.SOUI::SObjectFactory.virtual_4], vtable.SOUI::IScrollBarHost.0
lea esi, [edi + 0x288]
push 0x64
mov dword [edi], vtable.SOUI::SScrollBar.0
mov dword [edi + 4], vtable.SOUI::SScrollBar.1.0
mov dword [edi + 8], vtable.SOUI::SScrollBar.2.0
mov dword [esi], vtable.SOUI::SScrollBar.3.0
mov ecx, dword [0x5f95b8]
push 5
mov dword [ebp - 4], 0
call fcn.0044c430
mov dword [edi + 0x28c], eax
mov dword [edi + 0x290], 0xffffffff
mov dword [edi + 0x2b0], 0
mov dword [edi + 0x2b4], 0
push 0
push esi
lea ecx, [edi + 0x2bc]
mov byte [ebp - 4], 1
mov byte [edi + 0x2b8], 0x80
call fcn.004d88e0
xorps xmm0, xmm0
lea ecx, [edi + 0x30]
movups xmmword [edi + 0x294], xmm0
push 0x5a79e0
movq qword [edi + 0x2a4], xmm0
mov dword [edi + 0x2ac], 0
push 0x2714
mov dword [edi + 0x2ac], 0xffffffff
call fcn.0048c7e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a7050
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59334b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004742a0
push 0x64
mov dword [edi], vtable.SOUI::SHeaderCtrl.0
mov dword [edi + 4], vtable.SOUI::SHeaderCtrl.1.0
mov dword [edi + 8], vtable.SOUI::SHeaderCtrl.2.0
mov ecx, dword [0x5f95b8]
push 0xc
mov dword [ebp - 4], 0
call fcn.0044c430
mov dword [edi + 0x288], eax
mov dword [edi + 0x28c], 0
mov dword [edi + 0x290], 1
mov dword [edi + 0x294], 0
mov dword [edi + 0x298], 1
mov dword [edi + 0x29c], 0
mov dword [edi + 0x2a0], 0
mov dword [edi + 0x2a4], 0
mov dword [edi + 0x2a8], 0
mov dword [edi + 0x2ac], 0xffffffff
mov dword [edi + 0x2b8], 0
mov dword [edi + 0x2bc], 0
mov dword [edi + 0x2c0], 0
mov dword [edi + 0x2c4], 0
or dword [edi + 0x164], 8
lea ecx, [edi + 0x30]
push 0x5aa5c4
push 0x4650
mov byte [ebp - 4], 1
mov dword [edi + 0x2c8], 0x64
mov dword [edi + 0x2cc], 0
mov dword [edi + 0x2d0], 0
call fcn.0048c7e0
push 0x5aa6b4
push 0x4652
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5aa634
push 0x4651
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5aa734
push 0x4653
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5aa7ac
push 0x4654
lea ecx, [edi + 0x30]
call fcn.0048c7e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4aa150
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5936df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0048ce10
mov dword [edi], vtable.SOUI::SListCtrl.0
mov dword [edi + 4], vtable.SOUI::SListCtrl.1.0
mov dword [edi + 8], vtable.SOUI::SListCtrl.2.0
mov dword [edi + method.SOUI::SPanel.3.virtual_0], vtable.SOUI::SListCtrl.3.0
mov dword [edi + 0x398], 0x14
mov dword [edi + 0x39c], 0x14
mov dword [edi + 0x3a0], 0xffffffff
mov dword [edi + 0x3a8], 0
mov dword [edi + 0x3ac], 0xffffffff
mov dword [edi + 0x3b0], 0xffffffff
mov dword [edi + 0x3b4], 0xffffffff
mov dword [edi + 0x3b8], 0xffffffff
mov dword [edi + 0x3bc], 0xffffff
mov eax, dword [0x5f0130]
mov dword [ebp - 4], 0
mov dword [edi + 0x3c0], eax
mov dword [edi + 0x3c4], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x3c8], eax
mov dword [edi + 0x3cc], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x3d0], eax
mov dword [edi + 0x3d4], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x3d8], eax
mov dword [edi + 0x3dc], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x3e0], eax
mov dword [edi + 0x3e4], 0xffffff
mov eax, dword [0x5f0130]
mov dword [edi + 0x3e8], eax
push 0x64
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov ecx, dword [0x5f95b8]
push 0
mov byte [ebp - 4], 6
call fcn.0044c430
mov dword [edi + 0x3f4], eax
mov dword [edi + 0x3f8], 0
mov dword [edi + 0x3fc], 0
mov dword [edi + 0x400], 0
mov dword [edi + 0x404], 0
mov dword [edi + 0x408], 0
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0
mov dword [edi + 0x414], 0
lea ecx, [edi + 0x30]
mov dword [edi + 0x418], 0
mov eax, dword [edi + 0x164]
or eax, 8
mov byte [ebp - 4], 7
push 0x5aaa4c
or eax, 0x20
push 0x32c8
mov dword [edi + 0x164], eax
call fcn.0048c7e0
push 0x5aaad0
push 0x32c9
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5aab50
push 0x32cb
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0x5aabd4
push 0x32ca
lea ecx, [edi + 0x30]
call fcn.0048c7e0
mov dword [edi + 0x3bc], 0xffffffff
mov dword [edi + 0x3c4], 0xffe2e2e2
mov dword [edi + 0x3cc], 0xffd19139
mov dword [edi + 0x3d4], 0x80d19139
mov eax, edi
mov dword [edi + 0x3dc], 0xff000000
mov dword [edi + 0x3e4], 0xff00ffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4af730
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59306d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 0x10], eax
call esi
mov ecx, eax
and ecx, 0x8000
test edi, 0x8000
jne 0x4af7ab
cmp dword [ebp - 0x10], 0
jne 0x4af79b
test ecx, ecx
jne 0x4af794
xor eax, eax
jmp 0x4af7d0
mov eax, 4
jmp 0x4af7d0
test ecx, ecx
jne 0x4af7a4
lea eax, [ecx + 2]
jmp 0x4af7d0
mov eax, 6
jmp 0x4af7d0
cmp dword [ebp - 0x10], 0
jne 0x4af7c1
test ecx, ecx
jne 0x4af7ba
lea eax, [ecx + 1]
jmp 0x4af7d0
mov eax, 5
jmp 0x4af7d0
test ecx, ecx
mov edx, 3
mov eax, 7
cmove eax, edx
cmp ax, word [ebx + 0x28c]
jne 0x4af7e2
movzx eax, word [ebx + 0x28e]
jmp 0x4af7e5
movzx eax, ax
mov word [ebx + 0x288], ax
mov dword [ebp - 0x34], vtable.SOUI::TObjRefImpl_struct_SOUI::IObjRef_.0
mov dword [ebp - 0x30], 1
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], vtable.SOUI::EventArgs.0
mov dword [ebp - 0x2c], vtable.SOUI::EventArgs.1.0
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], ebx
call dword [eax + 0x20]
mov dword [ebp - 0x20], eax
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0x5ab174
mov dword [ebp - 0x2c], 0x5ab188
movzx eax, word [ebx + 0x288]
lea ecx, [ebp - 0x34]
mov word [ebp - 0x12], ax
movzx eax, word [ebx + 0x28a]
mov word [ebp - 0x14], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 4], 2
call dword [eax + 0xa8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1b70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593efd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x5f95b8]
push 0x64
push 0x1f
call fcn.0044c430
push 0x64
mov dword [esi + 0x2c0], eax
mov ecx, dword [0x5f95b8]
push 0x20
call fcn.0044c430
or dword [esi + 0x164], 0x20
mov dword [esi + 0x2c4], eax
lea eax, [esi + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x5ab61c
push 0x4e22
lea ecx, [esi + 0x30]
call fcn.0048c7e0
push 1
push ecx
lea ecx, [esi + 0x288]
mov dword [esp], 0x41f00000
call fcn.00474090
push 1
push ecx
lea ecx, [esi + 0x290]
mov dword [esp], 0x41a00000
call fcn.00474090
push 1
push ecx
lea ecx, [esi + 0x298]
mov dword [esp], 0x41a00000
call fcn.00474090
mov ecx, esi
mov dword [esi + 0x2a0], 0xffffffff
mov dword [esi + 0x2b0], 0xffcc7a00
mov dword [esi + 0x2a8], 0xffa0a0a0
call fcn.00465fd0
lea ebx, [esi + 0x2d0]
mov dword [ebp - 0x40], 0x65e5
mov dword [ebp - 0x3a], 0x4e00
lea edi, [ebp - 0x40]
mov dword [ebp - 0x34], 0x4e8c
mov dword [eax + 4], 0xffffffff
xor eax, eax
mov dword [esi + 0x2b8], 0xffcc7a00
mov dword [esi + 0x2c8], 0
mov dword [esi + 0x2cc], 0
mov dword [esi + 0x2c0], 0
mov dword [esi + 0x2c4], 0
mov dword [esi + 0x4b0], 0xffffff9b
mov esi, 7
mov word [ebp - 0x3c], ax
mov word [ebp - 0x36], ax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x2e], 0x4e09
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x28], 0x56db
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], 0x4e94
mov word [ebp - 0x1e], ax
mov dword [ebp - 0x1c], 0x516d
mov word [ebp - 0x18], ax
mov dword [ebp - 0x10], esi
mov eax, dword [0x5f0130]
mov dword [ebp - 0x14], eax
test edi, edi
je 0x4b1d51
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4b1d02
sub esi, ecx
sar esi, 1
je 0x4b1d4e
lea eax, [esi*2 + 0xe]
push eax
call fcn.00440020
add esp, 4
test eax, eax
je 0x4b1d4e
mov dword [eax], 1
xor ecx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + esi*2 + 0xc], cx
lea ecx, [eax + 0xc]
lea eax, [esi + esi]
mov dword [ebp - 0x14], ecx
push eax
push edi
push ecx
call fcn.005577f0
add esp, 0xc
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.0047d0a0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff4
mov dword [ebp - 4], 1
cmp ecx, dword [0x5f012c]
je 0x4b1d8d
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4b1d8d
push ecx
call fcn.00408c50
add esp, 4
add edi, 6
mov dword [ebp - 4], 0xffffffff
add ebx, 0xc
sub esi, 1
mov dword [ebp - 0x10], esi
jne 0x4b1cf1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bcef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594a00
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0048ce10
mov dword [edi + method.SOUI::SObjectFactory.virtual_4], vtable.SOUI::IItemContainer.0
mov dword [edi], vtable.SOUI::STreeView.0
mov dword [edi + 4], vtable.SOUI::STreeView.1.0
mov dword [edi + 8], vtable.SOUI::STreeView.2.0
mov dword [edi + method.SOUI::SPanel.3.virtual_0], vtable.SOUI::STreeView.3.0
mov dword [edi + method.SOUI::STreeView.4.virtual_0], vtable.SOUI::STreeView.4.0
mov dword [ebp - 4], 0
mov dword [edi + 0x39c], 0
mov dword [edi + 0x3a0], 0
mov dword [edi + 0x3a4], 0
mov dword [edi + 0x3a8], 0
mov dword [edi + 0x3ac], 0
mov dword [edi + 0x3b0], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov dword [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov dword [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0xa
push 0x30
mov byte [ebp - 4], 5
call fcn.005523ef
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax + 0x1c], 0
lea ecx, [edi + 0x3d4]
mov dword [eax + 0xc], 0x3f400000
mov dword [eax + 0x10], 0x3e800000
mov dword [eax + 0x14], 0x40100000
mov dword [eax + 0x18], 0xffffffff
mov dword [eax + 0x1c], 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x11
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0xa
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0xc], 0x3f400000
mov dword [eax + 0x10], 0x3e800000
mov dword [eax + 0x14], 0x40100000
mov dword [eax + 0x18], 0x26
mov dword [eax + 0x1c], 0
mov byte [ebp - 4], 5
mov dword [edi + 0x3d0], eax
call fcn.004411c0
or dword [edi + 0x164], 0x20
lea ecx, [edi + 0x30]
push 0x5ac84c
push 0x36b0
mov byte [ebp - 4], 7
mov dword [edi + 0x49c], 0
mov dword [edi + 0x4a0], 0
mov dword [edi + 0x4a4], 0
mov dword [edi + 0x4a8], 0
call fcn.0048c7e0
push 0x5ac7c4
push 0x36b1
lea ecx, [edi + 0x30]
call fcn.0048c7e0
push 0xc
call fcn.005523ef
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.SOUI::TObjRefImpl_struct_SOUI::ITvDataSetObserver_.0
mov dword [esi + 4], 1
mov dword [esi], vtable.SOUI::STreeViewDataSetObserver.0
mov dword [esi + 8], edi
mov ecx, dword [edi + 0x3a0]
test ecx, ecx
je 0x4bd10a
mov eax, dword [ecx]
call dword [eax + 8]
push 0x1c
mov dword [edi + 0x3a0], esi
call fcn.005523ef
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.SOUI::TObjRefImpl_struct_SOUI::ITreeViewItemLocator_.0
mov dword [esi + 4], 1
mov dword [esi], vtable.SOUI::STreeViewItemLocator.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x32
mov dword [esi + 0x10], 0xa
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], 0x32
mov ecx, dword [edi + 0x3a4]
test ecx, ecx
je 0x4bd164
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, edi
mov dword [edi + 0x3a4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c4190
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5f0a00]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5f9714], 0
je 0x4c41c5
xor eax, eax
cmp dword [0x5f9708], eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.00557d70
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x88], 2
push 0x5ad4ec
sete al
mov dword [0x5f9718], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4c42ae
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ad4fc
push esi
call edi
mov dword [0x5f96f8], eax
test eax, eax
je 0x4c42ae
push 0x5ad510
push esi
call edi
mov dword [0x5f96fc], eax
test eax, eax
je 0x4c42ae
push 0x5ad524
push esi
call edi
mov dword [0x5f9700], eax
test eax, eax
je 0x4c42ae
push str.MonitorFromPoint
push esi
call edi
mov dword [0x5f9704], eax
test eax, eax
je 0x4c42ae
push str.EnumDisplayMonitors
push esi
call edi
mov dword [0x5f970c], eax
test eax, eax
je 0x4c42ae
push str.EnumDisplayDevicesW
push esi
call edi
mov dword [0x5f9710], eax
test eax, eax
je 0x4c42ae
cmp dword [0x5f9718], 0
je 0x4c4296
push 0x5ad570
jmp 0x4c429b
push str.GetMonitorInfoA
push esi
call edi
mov dword [0x5f9708], eax
test eax, eax
je 0x4c42ae
mov eax, 1
jmp 0x4c42f6
mov dword [0x5f96f8], 0
xor eax, eax
mov dword [0x5f96fc], 0
mov dword [0x5f9700], 0
mov dword [0x5f9704], 0
mov dword [0x5f9708], 0
mov dword [0x5f970c], 0
mov dword [0x5f9710], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x5f9714], 1
pop esi
call fcn.00551e44
mov esp, ebp
pop ebp
ret
Function at 0x4c44c0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594f1d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.SOUI::IObject.0
mov dword [esi + 4], vtable.SOUI::ILayoutParam.0
mov dword [esi], vtable.SOUI::TObjRefImpl_struct_SOUI::ILayoutParam_.0
mov dword [esi + 4], vtable.SOUI::TObjRefImpl_struct_SOUI::ILayoutParam_.1.0
mov dword [esi + 8], 1
mov dword [esi], vtable.SOUI::SObjectImpl_class_SOUI::TObjRefImpl_struct_SOUI::ILayoutParam__.0
mov dword [esi + 4], vtable.SOUI::SObjectImpl_class_SOUI::TObjRefImpl_struct_SOUI::ILayoutParam__.1.0
push ecx
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 0
mov dword [esp], 0
call fcn.00473cd0
push ecx
lea ecx, [esi + 0x30]
mov dword [esp], 0
call fcn.00473cd0
push ecx
lea ecx, [esi + 0x44]
mov dword [esp], 0
call fcn.00473cd0
push ecx
lea ecx, [esi + 0x58]
mov dword [esp], 0
call fcn.00473cd0
push ecx
lea ecx, [esi + 0x68]
mov dword [esp], 0
call fcn.00473cd0
push ecx
lea ecx, [esi + 0x70]
mov dword [esp], 0
call fcn.00473cd0
lea ecx, [esi + 0x68]
mov dword [esi], vtable.SOUI::SouiLayoutParam.0
mov dword [esi + 4], vtable.SOUI::SouiLayoutParam.1.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
call fcn.004740b0
lea ecx, [esi + 0x70]
call fcn.004740b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c4730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594f54
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x78
call fcn.005523ef
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004c44c0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x30]
lea ecx, [esi + 0xc]
mov edi, eax
neg esi
mov eax, ebx
sbb esi, esi
and esi, ecx
mov ecx, 0x1b
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595154
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f0a00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x44
call fcn.005523ef
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004c6fe0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
call edx
lea ecx, [edi + 0xc]
neg edi
sbb edi, edi
and edi, ecx
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [eax + 0x20], xmm0
movq xmm0, qword [edi + 0x30]
movq qword [eax + 0x30], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c7250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, ecx
mov ecx, dword [ebp + 0xc]
cmp ecx, 3
ja case.0x4c725d.2
jmp dword [ecx*4 + 0x4c735c]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebp
ret 8
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebp
ret 8
mov ecx, dword [0x5f95b8]
push esi
push edi
test ecx, ecx
je 0x4c729d
call fcn.0044c610
mov esi, eax
jmp 0x4c729f
xor esi, esi
push 0x2801
call fcn.0055ba77
push str.GetSpecifiedSize_can_only_be_applied_for_Horz_or_Vert
push 0xffffffffffffffff
mov edi, eax
push 0x2800
push edi
call fcn.0042d1a0
add esp, 0x14
mov byte [eax + edi], 0
test esi, esi
je 0x4c72fc
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x4c72fc
mov eax, dword [ebp + 4]
mov ecx, esi
mov edx, dword [esi]
push eax
push 0x59b528
push 0x49
push str.F:XTrendPCdep_soui_srclayoutSLinearLayout.cpp
push edi
push str.soui
push 3
push 0
call dword [edx + 0x34]
jmp 0x4c733e
push 0x2801
call fcn.0055ba77
push 0x59b528
push edi
push 0x49
push str.F:XTrendPCdep_soui_srclayoutSLinearLayout.cpp
push str._s:_d___s__s__n
push 0xffffffffffffffff
mov esi, eax
push 0x2800
push esi
call fcn.0042d1a0
add esp, 0x24
mov byte [eax + esi], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.0055ba5c
add esp, 4
push edi
call fcn.0055ba5c
mov ecx, dword [ebp + 8]
mov dword [esp], 0
call fcn.00473cd0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 8