joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1e61
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e9742
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.006839e0
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1020], ecx
mov esi, dword [ebp + 8]
mov ecx, esi
mov ebx, dword [ebp + 0xc]
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
je 0x4f1eb1
xor eax, eax
jmp 0x4f1fd2
lea eax, [ebp - 0x101c]
push eax
call fcn.004d1bdc
mov dword [esp], str.resume.db
xor edi, edi
push eax
lea eax, [ebp - 0x1018]
mov dword [ebp - 4], edi
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
lea ecx, [ebp - 0x101c]
mov byte [ebp - 4], 2
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push 0x1000
lea eax, [ebp - 0x1010]
push edi
push eax
call fcn.00689b00
add esp, 0xc
mov ecx, esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
mov ecx, dword [ebp - 0x1020]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.004f22f5
lea ecx, [ebp - 0x1018]
mov esi, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push 0x7ff
lea eax, [ebp - 0x1010]
mov ecx, esi
push eax
push str.rex_____
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.Resume
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x1014]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea eax, [ebp - 0x1010]
push eax
push str.rex_____
call fcn.006aeefe
pop ecx
pop ecx
test eax, eax
je 0x4f1fc5
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1014]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_FS::ConvertToPureFile_wchar_t_const__
pop ecx
pop ecx
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x1014]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
cmp esi, 0xffffffff
je 0x4f1fc5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1010]
mov ecx, ebx
push eax
call sym.txupd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
inc edi
lea ecx, [ebp - 0x1018]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret 8
Function at 0x501185
Capabilities:
Create process on windows

Disassembly:
push 0x44
mov eax, 0x6eb563
call fcn.00682c5e
mov ecx, 0x7b66f0
call fcn.0047b2a8
push 0x3c
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00689b00
add esp, 0xc
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
push 0x5c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call sym.txupd.exe_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const
inc eax
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], 0x540
mov dword [ebp - 0x44], 0x700aa8
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x40], eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 0x14]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, esi
call fcn.00682c27
ret

Function at 0x501231
Capabilities:
Create process on windows

Disassembly:
push 0x250
mov eax, 0x6eb589
call fcn.00682c92
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push str.Bin_
push eax
call esi
lea eax, [ebp - 0x220]
push eax
call fcn.004ce7d7
mov ecx, eax
call fcn.004ce817
push str..exe
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x21c]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x220]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x25c]
push edi
push eax
call fcn.00689b00
add esp, 0xc
mov dword [ebp - 0x25c], esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x254], edi
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x258], 0x540
push eax
mov dword [ebp - 0x250], 0x700aa8
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.00682c3c
ret
Function at 0x503626
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ebe47
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x7b088c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esi + 0x30]
mov dword [esi], vtable.CUpgradeLogic.0
call fcn.004f8a69
push 0
lea ecx, [esi + 0x64]
call fcn.004eff6a
lea ecx, [esi + 0x90]
push 0
call fcn.004e5848
lea ecx, [esi + 0xe4]
push 0
call fcn.004eb5f5
lea ecx, [esi + 0x160]
push 0
call fcn.004e9dd0
lea ecx, [esi + 0x180]
push 0
call fcn.004f0d76
lea ecx, [esi + 0x1dc]
push 0
call fcn.004e72ef
lea ecx, [esi + 0x214]
push 0
call fcn.004f565e
mov ecx, dword [esi + 0x268]
test ecx, ecx
je 0x5036c6
push 0
call fcn.004ff7cb
lea ecx, [esi + 0x2bc]
call fcn.004e503d
lea ecx, [esi + 0x2b8]
call fcn.0050358f
lea ecx, [esi + 0x2b0]
call fcn.0050358f
lea ecx, [esi + 0x2a8]
call fcn.0050358f
lea ecx, [esi + 0x2a0]
call fcn.0050358f
lea ecx, [esi + 0x298]
call fcn.0050358f
lea ecx, [esi + 0x290]
call fcn.0050358f
lea ecx, [esi + 0x288]
call fcn.0050358f
lea ecx, [esi + 0x280]
call fcn.0050358f
lea ecx, [esi + 0x278]
call fcn.0050358f
lea ecx, [esi + 0x270]
call fcn.0050358f
mov ecx, dword [esi + 0x268]
test ecx, ecx
je 0x503750
mov eax, dword [ecx]
push 1
call dword [eax + 8]
lea ecx, [esi + 0x214]
call fcn.004f4e1b
lea ecx, [esi + 0x1dc]
call fcn.004e5e4a
lea ecx, [esi + 0x180]
call fcn.004f00b5
lea ecx, [esi + 0x160]
call fcn.004e951c
lea ecx, [esi + 0xe4]
call fcn.004ea36b
lea ecx, [esi + 0x90]
call fcn.004e5072
lea ecx, [esi + 0x64]
call fcn.004ee271
lea ecx, [esi + 0x30]
call fcn.004f5d86
lea ecx, [esi + 0x28]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x506ef1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x506f1b
push 0x26
push str.e:_fixreplayattackscoding_txupdate_servicepublic_configPublicConfigStorageLogic.h
push 0x6ff860
call sym.txupd.exe_int___cdecl_TXAssert_wchar_t_const___wchar_t_const___int_
add esp, 0xc
cmp eax, 1
jne 0x506f16
int3
push 2
pop eax
jmp 0x506f3e
push dword [ebp + 8]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x506f16
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 4
Function at 0x50841c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x2f0], 3
jne 0x508444
push 1
push 0
push 0
push str.http:__im.qq.com
push 0x700aa8
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx eax, word [ebp + 0xc]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x50845c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
mov esi, ecx
mov ecx, esp
push 0x70d694
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
mov ecx, esi
call fcn.00514776
push 2
call fcn.004d2ce7
pop ecx
test eax, eax
je 0x50848c
push 0
mov ecx, esi
call fcn.00514769
push 0x99
push 0x154
mov ecx, esi
call fcn.005147e8
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005129c1
push 0
push dword [esi + 0x120]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5084c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov eax, edi
movsx edx, di
shr eax, 0x10
cwde
push eax
push edx
lea eax, [esi + 0x2e0]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x508509
push 1
push 0
push 0
push str.http:__im.qq.com
push 0x700aa8
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x50851a
push dword [ebp + 0x14]
mov ecx, esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00512a84
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x509bc4
Capabilities:
Accept command line arguments

Disassembly:
push 0x448
mov eax, 0x6ecb82
call fcn.00682c92
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x454], ebx
cmp dword [ebp + 0x18], ebx
jne 0x509c07
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], bx
jne 0x509bf6
mov eax, ebx
jmp 0x509bfd
push esi
call fcn.006a37ec
pop ecx
push eax
push esi
lea ecx, [ebp + 8]
call fcn.00474507
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x454]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x509d96
cmp dword [ebp - 0x454], esi
jle 0x509c70
push dword [ebx + esi*4]
lea ecx, [ebp - 0x450]
call fcn.00473e20
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.004d0d30
push 0
push 1
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0
call fcn.0042292c
inc esi
cmp esi, dword [ebp - 0x454]
jl 0x509c34
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x424], 7
mov dword [ebp - 0x428], ebx
mov word [ebp - 0x438], ax
push 2
pop eax
mov byte [ebp - 4], al
cmp word [ebp - 0x218], bx
jne 0x509cce
mov eax, ebx
jmp 0x509cdb
lea eax, [ebp - 0x218]
push eax
call fcn.006a37ec
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00474507
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00689b00
mov eax, dword [edi]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x509d09
mov eax, dword [eax]
push ebx
lea ecx, [ebp - 0x420]
mov esi, 0x104
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push esi
lea eax, [ebp - 0x420]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov esi, dword [ebp + 0x18]
xor ecx, ecx
inc esi
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00682d64
push esi
mov ebx, eax
push 0
push ebx
call fcn.00689b00
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push ecx
push esi
push ebx
call fcn.006aee9a
add esp, 0x1c
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
test ebx, ebx
je 0x509d7a
push ebx
call fcn.00682d6d
pop ecx
mov eax, dword [edi + 4]
sub eax, dword [edi]
push 0x18
pop ecx
cdq
idiv ecx
push 0
push 1
lea ecx, [ebp - 0x438]
mov esi, eax
call fcn.0042292c
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0042292c
mov eax, esi
call fcn.00682c3c
ret 0x18
Function at 0x509fd0
Capabilities:
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.USER32.dll_GetShellWindow]
mov edi, eax
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [ebp - 0x24], eax
call esi
mov edi, eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x50a09e
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], eax
jne 0x50a09e
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp edi, eax
jne 0x50a09e
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
je 0x50a09e
cmp eax, dword [ebp - 0x20]
je 0x50a09e
push eax
mov esi, str.full_screen__pid:_lu_n
push esi
push 0x70daa4
push 2
push str.CGuiController::IsFullScreenMode
push 0x4a1
push 0x70dd48
call fcn.004ce9b9
push dword [ebp - 0x18]
push esi
call fcn.0047380a
add esp, 0x24
inc ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x50a1da
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x6ecbf7
call fcn.00682c5e
mov esi, ecx
and dword [ebp - 0x18], 0
push 3
pop ebx
push ebx
push str.UPDATE_STARTMODE
call fcn.004e492f
pop ecx
pop ecx
push ebx
call fcn.00503c5b
mov ecx, eax
call fcn.00504f60
push ebx
mov edi, str.TXUPD_Start_Mode:_d_n
push edi
push 0x70daa4
push 2
push str.CGuiController::ManualUpdate
push 0xb7
push 0x70dd48
call fcn.00509504
push ebx
push edi
call fcn.0047380a
add esp, 0x24
lea ecx, [ebp - 0x14]
xor ebx, ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
push 2
pop edi
push str.state_flag
mov dword [esi + 0x74], edi
mov dword [ebp - 0x10], ebx
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
call fcn.004d0eec
pop ecx
pop ecx
test eax, eax
je 0x50a27e
cmp dword [ebp - 0x10], 0x29
je 0x50a27c
cmp dword [ebp - 0x10], 0x47
jne 0x50a27e
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
test bl, bl
je 0x50a29e
push 1
call fcn.00503c5b
mov ecx, eax
call fcn.005061fa
jmp 0x50a2e9
push edi
call fcn.00503c5b
mov ecx, eax
call fcn.00504ca0
push 1
call fcn.00503c5b
mov ecx, eax
call fcn.00504c93
push 0
call fcn.00503c5b
mov ecx, eax
call fcn.005061fa
mov ecx, dword [esi + 0x20]
push 0
push 8
push 0x8000000
add ecx, 4
call fcn.0050a2ef
mov eax, dword [esi + 0x20]
push 1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00682c27
ret

Function at 0x50ce7c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x25c]
test ecx, ecx
je 0x50ce9d
push 1
call fcn.00511475
mov ecx, dword [esi + 0x25c]
push 0
call fcn.00511495
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50cebe
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret 4

Function at 0x50d06f
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x258]
pop esi
test ecx, ecx
je 0x50d08e
mov eax, dword [ecx]
push 1
call dword [eax]
xor eax, eax
ret 0x10
Function at 0x50ec6b
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, ecx
mov eax, dword [edi + 0x260]
cmp eax, 1
jne 0x50ecab
xor ebx, ebx
push ebx
push dword [edi + 0x348]
call esi
push ebx
push dword [edi + 0x1b4]
call esi
push dword [edi + 0x8c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.0050eba6
cmp eax, 2
jne 0x50ece7
push 8
push dword [edi + 0x348]
call esi
push dword [edi + 0x348]
call dword [sym.imp.USER32.dll_SetFocus]
push 8
push dword [edi + 0x1b4]
call esi
lea ecx, [edi + 0x264]
call fcn.004cdd81
push 0
push dword [edi + 0x268]
call esi
jmp 0x50ed1b
xor ebx, ebx
push ebx
push dword [edi + 0x348]
call esi
push ebx
push dword [edi + 0x1b4]
call esi
lea ecx, [edi + 0x264]
call fcn.004cdd81
push ebx
push dword [edi + 0x268]
call esi
push dword [edi + 0x8c]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
ret
Function at 0x510223
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x110
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x510284
cmp dword [ebp - 0x114], 5
jae 0x510287
cmp dword [ebp - 0x114], 4
jne 0x510284
cmp dword [ebp - 0x110], 0x5a
jae 0x510287
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00682c16
mov esp, ebp
pop ebp
ret
Function at 0x511266
Capabilities:
Check os version

Disassembly:
add ecx, 0x3d4
jmp fcn.005107e5

Function at 0x511976
Capabilities:
Enumerate gui resources

Disassembly:
push 0xc
mov eax, 0x6ed738
call fcn.00682c5e
mov edi, ecx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
push ebx
push dword [edi + 0x304]
mov dword [edi + 0x2fc], 1
call esi
push ebx
push dword [edi + 0x8c]
call esi
push 8
push dword [edi + 0x260]
call esi
lea ecx, [edi + 0x25c]
call fcn.004cd13a
push ebx
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
lea ecx, [edi + 0x394]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.004cf3b6
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x511a3d
mov esi, str.clicked_restart_button__qq_instance_id:_u_n
push dword [ecx + ebx*4]
push esi
push str.TXUPD
push 2
push str.CTrayTipsDlg::OnBtnClickRestart
push 0x9d
push str.E:FixReplayAttackscodingTXUpdate_serviceuiengineTrayTipsDlg.cpp
call fcn.004ce9b9
mov eax, dword [ebp - 0x18]
push dword [eax + ebx*4]
push esi
call fcn.0047380a
mov eax, dword [ebp - 0x14]
add esp, 0x24
mov ecx, dword [ebp - 0x18]
inc ebx
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x5119ff
lea eax, [ebp - 0x18]
push eax
push 0x5118d3
call dword [sym.imp.USER32.dll_EnumWindows]
lea ecx, [ebp - 0x18]
call fcn.00512258
xor eax, eax
call fcn.00682c27
ret 0x10
Function at 0x511f18
Capabilities:
Hide graphical window

Disassembly:
push 0x44
mov eax, 0x6ed7e4
call fcn.00682c92
mov esi, ecx
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x120]
call ebx
push 0
push dword [esi + 0x1b4]
call ebx
mov eax, dword [ebp - 0x18]
mov ecx, esi
sub eax, dword [ebp - 0x20]
push 0xd
mov dword [ebp - 0x4c], eax
call fcn.00512c1f
push 0xd
mov ecx, esi
mov ebx, eax
call fcn.00512c11
push 8
mov ecx, esi
mov edi, eax
call fcn.00512c1f
mov ecx, dword [ebp - 0x50]
mov esi, eax
push 0x17
call fcn.00512c11
mov ecx, dword [ebp - 0x4c]
push 0x54
push ebx
mov ebx, dword [ebp - 0x50]
sub ecx, eax
push edi
push esi
push ecx
push 0
push dword [ebx + 0x8c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 0x18]
mov ecx, ebx
sub eax, dword [ebp - 0x20]
push eax
call fcn.00512cb8
sub eax, 0x69
mov ecx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
call fcn.00512cc6
sub eax, 0x1c
mov ecx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
call fcn.00512cb8
sub eax, 0xb
mov ecx, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
call fcn.00512cc6
push 1
push 0
sub eax, 6
push 0x3f7
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push ecx
mov ecx, esp
push 0x70e9d4
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
push dword [ebx + 0x74]
lea esi, [ebx + 0x300]
push dword [ebx + 0x78]
mov ecx, ebx
push dword [ebx + 0x70]
push esi
call fcn.00512cd4
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push dword [ebx + 0x304]
call edi
push 0xff000000
push 0
call fcn.00477363
push eax
mov ecx, ebx
call fcn.00512c11
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004772f3
pop ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x512063
mov eax, dword [eax]
push ecx
mov ecx, esp
push eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
mov ecx, esi
call fcn.00479a37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
xor esi, esi
push esi
push 1
call fcn.0042292c
push esi
push ecx
mov eax, esp
push esi
push 0x50004000
push esi
push ecx
mov dword [eax], 0x3f6
mov eax, esp
mov dword [eax], esi
lea esi, [ebx + 0x25c]
push dword [ebx + 4]
mov ecx, esi
call fcn.0050cec2
push 0x70e568
push 0x11c
mov ecx, esi
call fcn.004cd8cb
test eax, eax
je 0x5120f5
push 0x3b
mov ecx, ebx
call fcn.00512c1f
push 0xe5
mov ecx, ebx
mov esi, eax
call fcn.00512c11
push 5
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push ecx
push dword [ebx + 0x260]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push dword [ebx + 0x260]
call edi
call fcn.00682c3c
ret

Function at 0x512976
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10
Function at 0x512986
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10