joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e3a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
xor eax, eax
mov ebx, 1
push str.ChatBorder_framedata
push 8
mov dword [esp + 0x20], eax
mov dword [esi], 0x504ca4
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatBorder_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x24]
push eax
mov word [ecx + 2], dx
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x44ec60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4fc219
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046b880
xor ebx, ebx
mov ebp, 1
push str.ChatScrollBar_framedata
push 8
mov dword [esp + 0x28], ebx
mov dword [esi], 0x504fdc
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatScrollBar_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
push 0xf0
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov dword [esi + 0xa8], ebx
mov byte [esi + 0xb0], bl
call fcn.004ed8ee
add esp, 0x14
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x44ed81
push ebx
push 0xfb
push 0xfa
push fcn.004a1490
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.0043ba10
jmp 0x44ed83
xor eax, eax
mov dword [esi + 0xa0], eax
mov dword [eax + 0xa8], ebx
mov eax, dword [esi + 0xa0]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [eax + 0xc4], ebp
mov ecx, dword [esi + 0xa0]
call fcn.0046af30
push 0xf0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x44ede5
push ebx
push 0xfd
push 0xfc
push fcn.004a1490
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.0043ba10
jmp 0x44ede7
xor eax, eax
mov dword [esi + 0xa4], eax
mov dword [eax + 0xa8], ebp
mov ecx, dword [esi + 0xa4]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [ecx + 0xc4], ebp
mov ecx, dword [esi + 0xa4]
call fcn.0046af30
push 0xc0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 3
je 0x44ee3d
push 0xfe
push esi
push ebx
push ebp
push ebx
push ebx
mov ecx, eax
call fcn.0043c280
jmp 0x44ee3f
xor eax, eax
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x28], bl
mov dword [esi + 0xac], eax
call fcn.0046af30
mov edx, dword [esp + 0x28]
push ebp
push edx
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x44f0a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [esi + 0xa0], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xa4], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xa8], ecx
mov ecx, dword [esp + 0x34]
xor eax, eax
mov ebx, 1
push str.ChatTextBox_framedata
push 8
mov dword [esp + 0x20], eax
mov dword [esi + 0xac], edx
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], 0xffffffff
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi], 0x505178
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatTextBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + 4]
mov dx, word [esi + 0x24]
mov eax, dword [esp + 0x20]
mov word [ecx + 2], dx
push ebx
push eax
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x453fc0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4fc3c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
call fcn.0046b880
xor edi, edi
mov dword [esi], 0x50567c
mov dword [0x80bedc], edi
push esi
mov dword [esp + 0x30], edi
mov dword [esi + 8], str.generic_drag_gump
mov dword [esi + 0x64], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xa0], edi
call fcn.004bb6e0
push str.framedata_for_CDragGump
push 8
mov dword [esi + 0x38], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 1
call fcn.004b9f50
xor ecx, ecx
mov dword [esi + 0x40], eax
mov dword [eax], ecx
add esp, 0xc
mov dword [eax + 4], ecx
mov al, byte [0x55ff7c]
test al, al
je 0x454059
mov dword [esi + 0xa4], edi
mov eax, dword [esp + 0x34]
lea ebp, [esi + 0x24]
lea ebx, [esi + 0x20]
and eax, 0xffff
push ebp
push ebx
push eax
mov dword [esp + 0x40], eax
call fcn.004a9760
mov eax, dword [ebx]
mov edx, dword [ebp]
imul edx, eax
mov dword [esi + 0x1c], eax
push str.drag_gump
lea eax, [edx + edx + 4]
push eax
call fcn.004b9f50
mov ecx, dword [esi + 0x40]
mov dword [ecx + 4], eax
mov edx, dword [esi + 0x40]
mov cx, word [ebx]
mov eax, dword [edx + 4]
mov word [eax], cx
mov edx, dword [esi + 0x40]
mov cx, word [ebp]
mov eax, dword [edx + 4]
mov word [eax + 2], cx
mov ecx, dword [ebp]
imul ecx, dword [ebx]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp]
mov edx, dword [esi + 0x40]
mov ecx, dword [ebx]
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x50]
add eax, 4
push eax
push 0
push 0
push ecx
push fcn.004d52c0
call fcn.004a97c0
lea edx, [esp + 0x44]
lea eax, [esp + 0x40]
push edx
push eax
call fcn.004bbc30
mov eax, dword [ebx]
mov ecx, dword [esp + 0x48]
cdq
sub eax, edx
add esp, 0x38
sar eax, 1
sub ecx, eax
mov eax, dword [ebp]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
mov dword [esi + 0x30], ecx
sub edx, eax
push 1
push 0
mov ecx, esi
mov dword [esi + 0x34], edx
call fcn.0046af30
push 0
call fcn.004e77c0
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ecx
push edx
push eax
mov ecx, esi
call fcn.0046a4b0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.00454290
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x457b40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fc62b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
test edi, edi
mov dword [esp + 0xc], 0
jne 0x457b71
lea ebx, [ecx + 0xc4]
jmp 0x457be4
mov ebx, dword [ecx + 0xc4]
test ebx, ebx
je 0x457c68
cmp dword [ebx + 0x10], edi
je 0x457bcd
mov esi, dword [ebx + 0x2c]
test esi, esi
je 0x457bb2
cmp dword [esi + 0x10], edi
je 0x457bac
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x457ba3
push edi
mov ecx, esi
call fcn.004588a0
test eax, eax
jne 0x457bd3
mov esi, dword [esi + 0x30]
test esi, esi
jne 0x457b8b
jmp 0x457bb2
mov eax, esi
test eax, eax
jne 0x457bd3
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x457b7f
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
mov dword [esp + 0xc], ebx
jmp 0x457bd9
mov dword [esp + 0xc], eax
mov ebx, eax
test ebx, ebx
je 0x457c68
add ebx, 0x2c
mov eax, dword [ebx]
test eax, eax
je 0x457bf4
lea ebx, [eax + 0x30]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x457bea
push ebp
mov ebp, dword [esp + 0x2c]
xor esi, esi
xor edi, edi
lea eax, [ebp + 0x4000]
push eax
call fcn.004d4c60
add esp, 4
test eax, eax
je 0x457c18
mov si, word [eax + 4]
mov di, word [eax + 6]
push 0x4c
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x457c63
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push 0
push ebp
push edi
push esi
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push 2
push ecx
mov ecx, eax
call fcn.00458750
jmp 0x457c65
xor eax, eax
mov dword [ebx], eax
pop ebp
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x45a960
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
xor eax, eax
mov ebx, 1
push str.ChatBorder_framedata
push 8
mov dword [esp + 0x20], eax
mov dword [esi], 0x505ea8
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatBorder_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x24]
push eax
mov word [ecx + 2], dx
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x45ae00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046b880
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [esi + 0xa0], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xa4], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xa8], ecx
mov ecx, dword [esp + 0x34]
xor eax, eax
mov ebx, 1
push str.ChatTextBox_framedata
push 8
mov dword [esp + 0x20], eax
mov dword [esi + 0xac], edx
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], 0xffffffff
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi], 0x506044
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatTextBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + 4]
mov dx, word [esi + 0x24]
mov eax, dword [esp + 0x20]
mov word [ecx + 2], dx
push ebx
push eax
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x45bdd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4fc8e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046b880
xor ebx, ebx
mov ebp, 1
push str.ChatScrollBar_framedata
push 8
mov dword [esp + 0x28], ebx
mov dword [esi], 0x5061e0
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatScrollBar_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
push 0xf0
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov dword [esi + 0xa8], ebx
mov byte [esi + 0xb0], bl
call fcn.004ed8ee
add esp, 0x14
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x45bef1
push ebx
push 0xfb
push 0xfa
push fcn.004a1490
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.0043ba10
jmp 0x45bef3
xor eax, eax
mov dword [esi + 0xa0], eax
mov dword [eax + 0xa8], ebx
mov eax, dword [esi + 0xa0]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [eax + 0xc4], ebp
mov ecx, dword [esi + 0xa0]
call fcn.0046af30
push 0xf0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x45bf55
push ebx
push 0xfd
push 0xfc
push fcn.004a1490
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.0043ba10
jmp 0x45bf57
xor eax, eax
mov dword [esi + 0xa4], eax
mov dword [eax + 0xa8], ebp
mov ecx, dword [esi + 0xa4]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [ecx + 0xc4], ebp
mov ecx, dword [esi + 0xa4]
call fcn.0046af30
push 0xc0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 3
je 0x45bfad
push 0xfe
push esi
push ebx
push ebp
push ebx
push ebx
mov ecx, eax
call fcn.0043c280
jmp 0x45bfaf
xor eax, eax
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x28], bl
mov dword [esi + 0xac], eax
call fcn.0046af30
mov edx, dword [esp + 0x28]
push ebp
push edx
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x462600
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fcda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045c280
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
lea ebx, [esi + 0x2c]
lea ebp, [esi + 0x28]
mov dword [esi + 0xf50], ecx
mov ecx, dword [esp + 0x2c]
push ebx
xor eax, eax
push ebp
push 0xfa1
mov dword [esp + 0x28], eax
mov dword [esi], 0x50709c
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 2
call fcn.004a9760
mov edx, dword [esi + 0x18]
mov eax, 1
shl edx, 3
push str.ChatGump_framedata
push edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.ChatGump_frame1
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx]
imul eax, dword [ebp]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
mov dword [edx + 0xc], eax
mov ecx, dword [ebx]
imul ecx, dword [ebp]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 0xc]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [ebp]
mov ecx, dword [eax + 0xc]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [ebx]
mov ecx, dword [eax + 0xc]
mov word [ecx + 2], dx
mov eax, dword [ebx]
mov edx, dword [esi + 0x40]
mov ecx, dword [ebp]
push eax
push ecx
mov eax, dword [edx + 0xc]
add eax, 4
push eax
push 0
push 0
push 0xfa1
push fcn.004d52c0
call fcn.004a97c0
mov ecx, dword [esp + 0x74]
push pe_nt_image_headers32
lea edx, [esi + 0x31a]
push ecx
push edx
call fcn.004d9a90
add esp, 0x44
mov ecx, esi
push 1
push 3
call fcn.0045c470
push 5
push 4
mov ecx, esi
call fcn.0045c470
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
test eax, eax
mov dword [esi + 0xf34], 0x96
mov dword [esi + 0xf38], 0x64
jg 0x46276b
mov eax, dword [esi + 0x20]
test ecx, ecx
jg 0x462772
mov ecx, dword [esi + 0x24]
cmp eax, 0x96
jge 0x46277e
mov eax, 0x96
cmp ecx, 0x64
jge 0x462788
mov ecx, 0x64
mov dword [esi + 0x24], ecx
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
call fcn.0045cbb0
mov ecx, esi
call fcn.0045d320
mov eax, dword [esp + 0x24]
push 1
push eax
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c