joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62941d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x258]
push eax
call fcn.00598a30
push 0x65bfe0
push eax
lea eax, [ebp - 0x2a0]
mov dword [ebp - 4], 0
push eax
call fcn.00428f60
push str.XuanZhi9_
push eax
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 1
push eax
call fcn.00428f60
push str.appconfig.ini
push eax
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 2
push eax
call fcn.00428f60
add esp, 0x28
cmp dword [ebp - 0x274], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x4ee22c
push dword [ebp - 0x288]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x274], 7
mov dword [ebp - 0x278], 0
mov word [ebp - 0x288], ax
cmp dword [ebp - 0x28c], 8
jb 0x4ee25d
push dword [ebp - 0x2a0]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x28c], 7
mov dword [ebp - 0x290], 0
mov word [ebp - 0x2a0], ax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x244], 8
jb 0x4ee292
push dword [ebp - 0x258]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x244], 7
cmp dword [ebp - 0x25c], 8
mov word [ebp - 0x258], ax
lea eax, [ebp - 0x270]
cmovae eax, dword [ebp - 0x270]
push eax
push 0x50
lea eax, [ebp - 0x210]
mov dword [ebp - 0x248], 0
push eax
push 0x65fef0
push str.firststart
push 0x6608dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
mov edi, eax
add esp, 4
cmp edi, 1
jne 0x4ee406
lea eax, [ebp - 0x2d0]
push eax
call fcn.00598a30
push 0x65bfe0
push eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 7
push eax
call fcn.00428f60
push str.XuanZhi9_
push eax
lea eax, [ebp - 0x2b8]
mov byte [ebp - 4], 8
push eax
call fcn.00428f60
push str.appconfig.ini
push eax
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 9
push eax
call fcn.00428f60
add esp, 0x28
cmp dword [ebp - 0x2a4], 8
jb 0x4ee362
push dword [ebp - 0x2b8]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x2a4], 7
cmp dword [ebp - 0x214], 8
mov dword [ebp - 0x2a8], 0
mov word [ebp - 0x2b8], ax
jb 0x4ee393
push dword [ebp - 0x228]
call esi
add esp, 4
xor eax, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x2bc], 8
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x4ee3c8
push dword [ebp - 0x2d0]
call esi
add esp, 4
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
cmovae eax, dword [ebp - 0x240]
push eax
push 0x660d80
push str.firststart
push 0x6608dc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0x22c], 8
jb 0x4ee406
push dword [ebp - 0x240]
call esi
add esp, 4
push edi
push str.is_first_start__d
push 0x98
push str.view::AppModel::isFirstStart
call fcn.00584a40
add esp, 0x10
cmp edi, 1
sete bl
cmp dword [ebp - 0x25c], 8
jb 0x4ee438
push dword [ebp - 0x270]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret
Function at 0x4eeb70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62945b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x240]
push eax
call fcn.00598920
push str.data.ini
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
push eax
call fcn.00428f60
add esp, 0x10
cmp dword [ebp - 0x22c], 8
jb 0x4eebdc
push dword [ebp - 0x240]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0x50
lea eax, [ebp - 0x210]
push eax
push 0x660d80
push str.fullscreen
push 0x6608dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
add esp, 4
cmp eax, 1
sete bl
cmp dword [ebp - 0x214], 8
jb 0x4eec3d
push dword [ebp - 0x228]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret

Function at 0x4eec60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62945b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x240]
push eax
call fcn.00598920
push str.data.ini
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
push eax
call fcn.00428f60
add esp, 0x10
cmp dword [ebp - 0x22c], 8
jb 0x4eeccc
push dword [ebp - 0x240]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push 0x50
lea eax, [ebp - 0x210]
push eax
push 0x65fef0
push str.joystickEntrance
push 0x6608dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCR120.dll__wtoi]
add esp, 4
cmp eax, 1
sete bl
cmp dword [ebp - 0x214], 8
jb 0x4eed2d
push dword [ebp - 0x228]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret
Function at 0x4ef090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629546
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x13
xor eax, eax
mov dword [ebp - 0x258], 0
push str.SOFTWARE_fwzsSetup
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00415c10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x250]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4ef13a
push 0x6523fc
mov ecx, esi
call fcn.00415d10
jmp 0x4ef1e9
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x254]
push eax
push 0
push str.Path
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4ef17e
push 0x6523fc
mov ecx, esi
call fcn.00415d10
jmp 0x4ef1e9
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00415d10
push 0xd
push str.Bin_fwzs.exe
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00428400
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.0041af00
cmp dword [ebp - 0x234], 8
jb 0x4ef1cc
push dword [ebp - 0x248]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp dword [ebp - 0x21c], 8
jb 0x4ef201
push dword [ebp - 0x230]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret
Function at 0x4f1f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a408
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x37
xor eax, eax
mov dword [ebp - 0x14], 7
push str.SYSTEMCurrentControlSetControlDeviceGuardScenarios_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00415c10
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00431600
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4f2078
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push str.Enabled
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f2046
cmp dword [ebp - 0x30], eax
je 0x4f206d
cmp dword [esi + 0x14], 8
jb 0x4f202a
mov esi, dword [esi]
push esi
push str._s_not_0
push 0x6b4
push str.view::isEnableDeviceGuid
call fcn.00584a40
add esp, 0x10
mov bl, 1
jmp 0x4f20a1
cmp dword [esi + 0x14], 8
jb 0x4f204e
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_read_error__d
push 0x6b9
push str.view::isEnableDeviceGuid
call fcn.00584a40
add esp, 0x14
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4f209f
cmp dword [esi + 0x14], 8
jb 0x4f2080
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_open_error__d
push 0x6bf
push str.view::isEnableDeviceGuid
call fcn.00584a40
add esp, 0x14
xor bl, bl
cmp dword [ebp - 0x14], 8
jb 0x4f20b3
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret
Function at 0x4f2880
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x629be2
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
mov dword [ebp - 0xa4], 0
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
sar esi, 0x10
push edi
and esi, 0xfff
call ebx
test eax, eax
jne 0x4f28db
push 1
push esi
call ebx
mov edi, eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
xorps xmm0, xmm0
push 0x10
movq qword [ebp - 0xa0], xmm0
call esi
mov ebx, dword [ebp - 0xa0]
xor ecx, ecx
test ax, ax
mov edx, 4
push 0x11
cmovs ecx, edx
or ebx, ecx
call esi
xor ecx, ecx
mov edx, 2
test ax, ax
push 0x12
cmovs ecx, edx
or ebx, ecx
call esi
xor ecx, ecx
test ax, ax
sets cl
or ebx, ecx
cmp edi, 0x10
je 0x4f2967
cmp edi, 0x11
je 0x4f2967
cmp edi, 0x12
je 0x4f2967
mov edx, edi
lea ecx, [ebp - 0x98]
call fcn.004f2ad0
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 0xa4], 1
call fcn.005c6970
test al, al
jne 0x4f2967
mov word [ebp - 0x9c], di
jmp 0x4f2970
xor eax, eax
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], 0xffffffff
test byte [ebp - 0xa4], 1
je 0x4f298b
lea ecx, [ebp - 0x98]
call fcn.005c5f80
mov edx, dword [ebp - 0x9c]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret
Function at 0x4f51f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov edi, edx
push eax
push 0
push 0x2011f
push 0
push 0
push 0
push str.SoftwareXuanZhildmultiplay
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4f5285
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x4f5237
mov esi, dword [esi]
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push 0x6627b8
push dword [ebp - 4]
call esi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x4f525f
mov edi, dword [edi]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push str.Version
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.install_writeRegedit_machine__multi_failed_
push 0x97f
push str.view::AppModel::saveMulPath
call fcn.00584a40
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f5630
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 1
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x7c]
mov eax, dword [ecx]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esi + 0x7c]
push 0
push 0
push 0x24e4
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [esi + 0x7c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x6c]
mov ecx, dword [esi + 0x78]
push 0
mov eax, dword [ecx]
call dword [eax + 0x120]
mov byte [0x700de8], 0
pop esi
ret
Function at 0x4f5ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62a558
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x6d8314]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov eax, dword [0x6d8314]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push dword [ebp + 8]
push str.post_to_group__d
push 0xad0
push str.view::AppModel::postToGroupControl
call fcn.00584a40
add esp, 0x10
lea ecx, [esp + 0xc]
call fcn.0058aaf0
push 0x26
xor eax, eax
mov dword [esp + 0x30], 7
push 0x675fa8
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00415c10
lea eax, [esp + 0x18]
mov dword [esp + 0x40], 0
push eax
lea ecx, [esp + 0x10]
call fcn.0058ad20
mov dword [esp + 0x40], 0xffffffff
mov bl, al
cmp dword [esp + 0x2c], 8
jb 0x4f5f93
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
test bl, bl
je 0x4f5fc2
push dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0058ae60
jmp 0x4f5fd9
push str.multi_not_exist
push 0xad6
push str.view::AppModel::postToGroupControl
call fcn.00584a40
add esp, 0xc
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f86a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x618653
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6d8314]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
call fcn.004499d0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
mov dword [edi], vtable.std::_Packaged_state_void____cdecl___void__.0
mov dword [ebp - 0x18], ecx
mov dword [ecx + 0x10], 0
push ecx
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004f8d50
mov dword [ebp - 4], 2
lea ebx, [edi + 0x48]
mov dword [edi], vtable.std::_Task_async_state_void__0_.0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov byte [ebp - 4], 3
lea eax, [edi + 4]
mov ecx, 1
lock xadd dword [eax], ecx
sub esp, 0x2c
mov esi, esp
sub esp, 8
mov ecx, esp
call fcn.00449bd0
mov ecx, esi
call fcn.00449b50
lea ecx, [esi + 0xc]
call fcn.00449be0
mov dword [esi + 0x1c], 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x18], 0
mov byte [esi + 0x14], 0
push edi
mov word [esi + 0x28], 0
call fcn.004f8830
add esp, 0x30
cmp ebx, eax
je 0x4f8783
push eax
mov ecx, ebx
call fcn.00449c30
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x4f87af
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x4f87af
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x4f87af
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov byte [edi + 0x26], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4fc210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, ecx
push edi
movzx eax, byte [esi + 0x20d]
push eax
movzx eax, bl
push eax
push str.showMainFrame__force___d__showFlag___d
push 0x243
push str.CCmdLineMgr::showMainFrame
call fcn.00584a40
add esp, 0x14
test bl, bl
je 0x4fc28b
cmp byte [esi + 0x20d], 0
mov edi, dword [ebp + 8]
jne 0x4fc26b
push ecx
mov ecx, dword [ebp + 0xc]
mov byte [esi + 0x20d], 1
call fcn.00567050
push 1
push edi
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov byte [esi + 0x20e], 0
push edi
call fcn.00591f60
add esp, 4
mov byte [0x700e40], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x20d], 0
je 0x4fc2ce
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00567050
mov edi, dword [ebp + 8]
push 1
push edi
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
cmp byte [esi + 0x20e], 0
je 0x4fc272
push 0
push 0xf020
push 0x112
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.mainframe_hide
push 0x25f
push str.CCmdLineMgr::showMainFrame
call fcn.00584a40
add esp, 0xc
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x500890
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62b7ac
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6d8314]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.005d62f0
mov dword [ebp - 4], 0
mov dword [edi], vtable.view::CDraggingIconUI.0
mov dword [edi + 0x1828], 0
lea esi, [edi + 0x1830]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.005c5e50
lea ecx, [esi + 8]
call fcn.005c5e30
lea ecx, [esi + 0x18]
call fcn.005c5e30
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 2
mov ecx, edi
movdqu xmm0, xmmword [ebp + 8]
push 0x24
mov byte [edi + 0x1898], 0
movdqu xmmword [edi + 0x1888], xmm0
call fcn.005da130
push 0x24
mov ecx, edi
call fcn.005da120
push 1
mov ecx, edi
call fcn.005d4b20
sub esp, 0x18
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_struct_std::_Callable_obj_class__lambda_989701223720de8644926303afec5152___0___class_std::allocator_class_std::_Func_class_void__class_DuiLib::CDuiRect____void__class_DuiLib::CDuiRect_.0
mov ecx, esi
push 0
mov dword [eax + 4], edi
push edi
mov dword [eax + 0x10], eax
mov byte [ebp - 4], 2
call fcn.005154d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5039a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62c3bb
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x6d8314]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [0x6d8314]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x30], 7
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], eax
mov word [esp + 0x4c], ax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
mov byte [esp + 0x7c], 1
movupd xmmword [esp + 0x84], xmm0
mov dword [esp + 0xa8], eax
xor edx, edx
movdqu xmm0, xmmword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov eax, esp
movdqu xmmword [esp + 0x14], xmm0
mov dword [eax], edx
mov ecx, dword [ecx]
add ecx, 0x528
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [esp + 0xc]
call fcn.0049edb0
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0x10

Function at 0x503a90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62c3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x6d8314]
xor eax, esp
mov dword [esp + 0x90], eax
push esi
mov eax, dword [0x6d8314]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x30], 0xf
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], eax
mov word [esp + 0x4c], ax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
mov byte [esp + 0x7c], 1
movupd xmmword [esp + 0x84], xmm0
mov dword [esp + 0xa8], eax
lea ecx, [esp + 0x1c]
movdqu xmm0, xmmword [ebp + 8]
push eax
push 0x65ee88
movdqu xmmword [esp + 0x14], xmm0
call fcn.00431010
lea eax, [esp + 0xc]
push eax
push ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [esi]
add ecx, 0x528
mov eax, dword [ecx]
call dword [eax + 0x2c]
lea ecx, [esp + 0xc]
call fcn.0049b200
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x504080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62c4bb
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x6d8314]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
mov eax, dword [0x6d8314]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x30], 7
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], eax
mov word [esp + 0x34], ax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], eax
mov word [esp + 0x4c], ax
mov byte [esp + 0x64], 1
movupd xmmword [esp + 0x6c], xmm0
mov dword [esp + 0x90], eax
sub esp, 0x70
movdqu xmm0, xmmword [ebp + 8]
lea eax, [esp + 0x7c]
mov ecx, esp
push eax
movdqu xmmword [esp + 0x80], xmm0
call fcn.004ca730
mov ecx, dword [esi]
add ecx, 0x528
mov eax, dword [ecx]
call dword [eax + 0x14]
lea ecx, [esp + 0xc]
call fcn.004ca6b0
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0x10

Function at 0x504160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62c4fb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x6d8314]
xor eax, esp
mov dword [esp + 0x90], eax
push esi
mov eax, dword [0x6d8314]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.004ca900
mov dword [esp + 0xa8], 0
lea eax, [esp + 0xc]
movdqu xmm0, xmmword [ebp + 8]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x24], 1
xor ecx, ecx
mov dword [esp + 0x34], 0xf4240
movdqu xmmword [esp + 0x14], xmm0
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0xf4240
mov dword [esp + 0x30], 0
mov dword [eax], ecx
mov ecx, dword [esi]
add ecx, 0x528
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [esp + 0xc]
call fcn.004ca970
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0x10