joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cf90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a1b18
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 1
call fcn.00460850
mov esi, eax
lea eax, [esp + 0xc]
push eax
call fcn.0049d3a8
add esp, 4
mov byte [esp + 0x18], 2
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x14]
push edx
mov edx, dword [esp + 0x24]
push edx
push eax
push str.res.qhcdn.com_360mobilemgr
push str.http:___s_stat.php_resurlhttp:__intf1.zsall.mobilem.360.cn_Stat_floatWindowStartclient_ver_smod_saction_s
push esi
call ecx
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x18
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45d01c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d041
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d069
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x45d120
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5a24d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
push str._FloatingWnd::Show_entry
call fcn.0049d036
mov eax, dword [ebx + 4]
add esp, 4
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x45d180
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4
cmp dword [esp + 0x24], 0
je 0x45d231
push 1
push str.FloatingWndDisplayOption
mov dword [ebx + 0x7c], 0
call fcn.004094f0
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x45d1c3
call fcn.0045da40
test eax, eax
je 0x45d21d
mov eax, dword [ebx + 4]
push 5
push eax
call esi
mov ecx, dword [ebx + 4]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebx + 4]
push 5
push edx
call esi
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push eax
mov ecx, str.Bjh_show
call fcn.004066b0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, str.flwnd
mov dword [esp + 0x28], 0
call fcn.004066b0
mov dword [esp + 0x24], 0xffffffff
call fcn.0045cf90
add esp, 8
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4
push ebx
call fcn.0045ec60
test eax, eax
jne 0x45d19e
push str._FloatingWnd::Show_CanShowFloatingWnd_fail
call fcn.0049d036
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4

Function at 0x45d320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x59da38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edx, dword [ecx + 4]
lea eax, [esp + 0x18]
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x6285c4]
mov edx, dword [eax + 0xc]
mov ecx, 0x6285c4
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push str._d__d__d__d
lea edi, [esp + 0x24]
call fcn.00407710
mov esi, dword [esp + 0x24]
add esp, 0x10
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004073f0
add eax, 0x10
mov dword [edi], eax
call fcn.004097a0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d3d6
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x45d3f0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push edi
push str._FloatingWnd::Hide_entry
call fcn.0049d036
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 4
push eax
call edi
test eax, eax
je 0x45d463
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
push ecx
call ebx
test eax, eax
je 0x45d463
call fcn.004607e0
mov edx, dword [eax + 4]
push edx
call edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x45d454
call fcn.004607e0
mov eax, dword [eax + 4]
push eax
call ebx
test eax, eax
je 0x45d454
call fcn.004607e0
mov ecx, dword [eax + 4]
add eax, 4
push 0
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push edx
call edi
mov ecx, esi
call fcn.0045d320
pop edi
pop ebx
pop ecx
ret
Function at 0x45db10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
push ebp
push edi
mov edi, dword [esi + 0x64]
xor ebx, ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp edi, ebx
jne 0x45dbf4
xor eax, eax
mov dword [esp + 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call ebx
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, eax
lea ecx, [ecx]
mov eax, dword [esi + 4]
push 1
push 0
push 0
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
je 0x45db95
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x14], 0x203
je 0x45dbbf
call ebx
sub eax, ebp
cmp eax, 0xc8
jbe 0x45db60
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
cmp dword [esi + 0x1bc], edx
jne 0x45dbd7
cmp dword [esi + 0x1c0], edi
jne 0x45dbd7
mov eax, 1
jmp 0x45dbd9
or ecx, 0xffffffff
mov dword [esi + 0x1bc], ecx
mov dword [esi + 0x1c0], ecx
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 8
xor eax, eax
or ecx, 0xffffffff
mov dword [esi + 0x1bc], ecx
mov dword [esi + 0x1c0], ecx
test eax, eax
je 0x45dbf4
push edi
push edx
push esi
call fcn.0045dc00
pop edi
pop ebp
pop ebx
add esp, 0x20
ret 8

Function at 0x45dce0
Capabilities:
Hide graphical window

Disassembly:
push ecx
call fcn.004607e0
mov eax, dword [eax + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0042d4e0
mov ecx, dword [eax + 4]
push 0
push 0
add eax, 4
push 0x4d0
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call fcn.0045ea00
pop ecx
ret
Function at 0x45ef00
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push ebx
push edi
mov edi, eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45ef28
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x45ef28
call fcn.00496ea0
call fcn.0042d470
lea edx, [esp + 8]
push edx
push eax
call fcn.004428b0
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
test ecx, 0xfffffffc
sete bl
test eax, eax
je 0x45ef58
push eax
call fcn.004f6734
add esp, 4
mov edx, dword [esp + 8]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.004f6734
add esp, 4
call fcn.004607e0
mov ecx, eax
test bl, bl
je 0x45ef97
mov eax, 1
pop edi
pop ebx
add esp, 0x1c
jmp 0x46b230
xor eax, eax
pop edi
pop ebx
add esp, 0x1c
jmp 0x46b230
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, eax
lea eax, [esp + 0x10]
push eax
mov edi, ecx
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetLastInputInfo]
mov edx, dword [edi + 4]
mov ecx, dword [esp + 0x14]
push edx
mov dword [edi + 0x124], ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
je 0x46b2a8
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46b2a8
call fcn.0046b080
mov ecx, dword [edi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 4]
push 0x105
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x46b2d8
call fcn.0046b080
xor eax, eax
xor ecx, ecx
push edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call fcn.0046bc80
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push 0x41
push 0
push 0
push eax
mov eax, dword [edi + 4]
push ecx
push 0xffffffffffffffff
push eax
call ebp
mov ecx, dword [edi + 4]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push ecx
call ebp
mov edx, dword [edi + 4]
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x45fda0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push 0x5d74e0
push 0x5e1068
xor esi, esi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45fe62
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
lea ecx, [esp + 0x14]
push ecx
push esi
push 0x30
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x45fe0b
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
call ebx
push 1
mov dword [esp + 0x1c], eax
call ebx
jmp 0x45fe0f
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
cmp ecx, esi
jne 0x45fe34
cmp ebx, dword [esp + 0x18]
jne 0x45fe34
mov edx, dword [esp + 0x24]
mov esi, edx
neg esi
sbb esi, esi
add esi, 4
jmp 0x45fe4a
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x45fe4a
cmp ebp, eax
jne 0x45fe4a
xor eax, eax
test ecx, ecx
setne al
inc eax
mov esi, eax
mov eax, esi
test edi, edi
je 0x45fe64
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebp
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x466e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59fe50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov dword [edi + 0x5c], eax
mov dword [edi], vtable.VWindowImpl_class_CHalfActivateFunMgrWnd__struct_VWindow__class_ATL::CWinTraits_1442840576__0__.1.0
mov dword [edi + 0x38], vtable.VWindowImpl_class_CHalfActivateFunMgrWnd__struct_VWindow__class_ATL::CWinTraits_1442840576__0__.0
mov dword [esp + 0x14], eax
lea esi, [edi + 0x6c]
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
mov dword [edi + 0x60], vtable.CVirtualMsgHandler.0
call fcn.00457610
mov dword [edi + 0xdc], vtable.IListBoxOwner.0
lea eax, [edi + 0xdc]
mov dword [eax], vtable.CHalfActivateFunMgrWnd.5.0
push eax
lea eax, [edi + 0xe0]
mov dword [edi], vtable.CHalfActivateFunMgrWnd.0
mov dword [edi + 0x38], vtable.CHalfActivateFunMgrWnd.1.0
mov dword [edi + 0x60], vtable.CHalfActivateFunMgrWnd.2.0
mov dword [esi], vtable.CHalfActivateFunMgrWnd.3.0
mov dword [edi + 0x70], vtable.CHalfActivateFunMgrWnd.4.0
call fcn.00466bb0
lea edx, [edi + 0x150]
push edx
mov byte [esp + 0x18], 2
call fcn.0048dda0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x467b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x596e58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [edi + 0x160]
add edi, 0x150
cmp dword [edi + 0xc], ebx
jbe 0x467bbf
call fcn.004f825e
mov esi, dword [edi + 0xc]
mov ebp, dword [edi]
cmp esi, dword [edi + 0x10]
jbe 0x467bce
call fcn.004f825e
mov eax, dword [edi]
push ebx
push ebp
push esi
push eax
lea eax, [esp + 0x24]
push eax
push edi
call fcn.00469050
xor ebp, ebp
lea ecx, [esp + 0x1c]
push ecx
call fcn.00466c20
mov dword [esp + 0x38], 0
mov edx, dword [ebp + 0x65f0c0]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp + 0x5d5c44]
test edx, edx
jne 0x467c0b
xor eax, eax
jmp 0x467c1f
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467c10
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
lea eax, [esp + 0x24]
call fcn.004072f0
mov edx, dword [ebp + 0x5d5c54]
test edx, edx
jne 0x467c39
xor eax, eax
jmp 0x467c4f
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467c40
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
lea eax, [esp + 0x28]
call fcn.004072f0
mov edx, dword [ebp + 0x5d5c64]
test edx, edx
jne 0x467c69
xor eax, eax
jmp 0x467c7f
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467c70
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
lea eax, [esp + 0x2c]
call fcn.004072f0
mov edx, dword [ebp + 0x5d5c74]
test edx, edx
jne 0x467c99
xor eax, eax
jmp 0x467caf
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467ca0
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
lea eax, [esp + 0x30]
call fcn.004072f0
lea eax, [esp + 0x1c]
push eax
call fcn.00468b20
lea esi, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0041bd40
add ebp, 4
cmp ebp, 0x10
jl 0x467be1
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x46a850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59fe13
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebp, ebp
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], ebp
mov dword [edi + 0x20], ebp
mov dword [edi + 0x24], ebp
mov dword [edi + 0x28], ebp
mov dword [edi + 0x2c], ebp
mov dword [edi + 0x30], ebp
mov dword [edi + 0x34], ebp
mov dword [edi + 0x48], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x50], ebp
mov dword [edi + 0x54], eax
mov dword [edi + 0x5c], ebp
mov dword [edi], vtable.VWindowImpl_class_CHalfActivateMainWnd__struct_VWindow__class_ATL::CWinTraits_1442840576__0__.1.0
mov dword [edi + 0x38], vtable.VWindowImpl_class_CHalfActivateMainWnd__struct_VWindow__class_ATL::CWinTraits_1442840576__0__.0
mov dword [esp + 0x18], ebp
mov dword [edi + 0x64], ebp
mov dword [edi + 0x68], ebp
mov dword [edi + 0x60], vtable.CVirtualMsgHandler.0
lea esi, [edi + 0x6c]
mov dword [edi + 0xe0], 1
call fcn.00457610
lea ecx, [edi + 0xe4]
push ecx
mov byte [esp + 0x1c], 1
call fcn.0043e280
mov dword [edi + 0xdc], vtable.WTL::CMessageFilter.0
mov dword [edi], vtable.CHalfActivateMainWnd.0
mov dword [edi + 0x38], vtable.CHalfActivateMainWnd.1.0
mov dword [edi + 0x60], vtable.CHalfActivateMainWnd.2.0
mov dword [esi], vtable.CHalfActivateMainWnd.3.0
mov dword [edi + 0x70], vtable.CHalfActivateMainWnd.4.0
mov dword [edi + 0xdc], vtable.CHalfActivateMainWnd.5.0
mov dword [edi + 0x120], ebp
mov dword [edi + 0x12c], ebp
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x46b080
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5a2380
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
cmp dword [edi + 0x120], ebx
jne 0x46b0b9
cmp dword [edi + 0x12c], 0
jne 0x46b211
mov eax, dword [edi + 0x12c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x1c
mov dword [esp + 0x18], 0x10c
mov dword [esp + 0x1c], 0x172
mov dword [edi + 0x120], ebx
test eax, eax
je 0x46b0f2
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebx
sub eax, 0
je 0x46b147
sub eax, 1
jne 0x46b18a
call fcn.0042d550
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x46b137
call fcn.0042d550
mov ecx, dword [edi + 4]
push ecx
mov edx, esp
push ecx
mov dword [edx], 0
mov edx, esp
lea esi, [esp + 0x18]
mov dword [edx], esi
push ecx
mov esi, eax
call fcn.00468ac0
call fcn.0042d550
mov ecx, dword [eax + 4]
mov dword [edi + 0x12c], ecx
jmp 0x46b18a
call fcn.0046bfc0
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x46b17c
call fcn.0046bfc0
mov ecx, dword [edi + 4]
push ecx
mov edx, esp
push ecx
mov dword [edx], 0
mov edx, esp
lea esi, [esp + 0x18]
mov dword [edx], esi
push ecx
mov esi, eax
call fcn.0046e350
call fcn.0046bfc0
mov eax, dword [eax + 4]
mov dword [edi + 0x12c], eax
mov eax, dword [edi + 0x12c]
test eax, eax
je 0x46b19d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 4]
push 0x105
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_RedrawWindow]
test ebx, ebx
jne 0x46b1d4
push ecx
mov edx, esp
mov dword [esp + 0xc], esp
push edx
mov ecx, 0x5e1cac
call fcn.004066b0
push ecx
mov dword [esp + 0x30], ebx
mov eax, esp
mov dword [esp + 0x14], esp
push eax
jmp 0x46b1f7
cmp ebx, 1
jne 0x46b211
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
mov ecx, str.Bjh_glsjshow
call fcn.004066b0
push ecx
mov dword [esp + 0x30], ebx
mov edx, esp
mov dword [esp + 0x10], esp
push edx
mov ecx, str.flwnd
call fcn.004066b0
mov dword [esp + 0x30], 0xffffffff
call fcn.0045cf90
add esp, 8
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
Function at 0x46c670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59fd83
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x61e69c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x4c], edi
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x5c], edi
mov dword [ebx], vtable.VWindowImpl_class_CHalfActivateUpdateListWnd__struct_VWindow__class_ATL::CWinTraits_1442840576__0__.1.0
mov dword [ebx + 0x38], vtable.VWindowImpl_class_CHalfActivateUpdateListWnd__struct_VWindow__class_ATL::CWinTraits_1442840576__0__.0
mov dword [esp + 0x1c], edi
lea esi, [ebx + 0x6c]
mov dword [ebx + 0x64], edi
mov dword [ebx + 0x68], edi
mov dword [ebx + 0x60], vtable.CVirtualMsgHandler.0
call fcn.00457610
mov dword [ebx + 0xdc], vtable.IListBoxOwner.0
mov dword [ebx + 0xe0], vtable.IApkInfoListener.0
mov dword [ebx + 0xe4], vtable.IDownloadMgrListener.0
lea eax, [ebx + 0xdc]
mov dword [eax], vtable.CHalfActivateUpdateListWnd.5.0
push eax
lea eax, [ebx + 0xe8]
mov dword [ebx], vtable.CHalfActivateUpdateListWnd.0
mov dword [ebx + 0x38], vtable.CHalfActivateUpdateListWnd.1.0
mov dword [ebx + 0x60], vtable.CHalfActivateUpdateListWnd.2.0
mov dword [esi], vtable.CHalfActivateUpdateListWnd.3.0
mov dword [ebx + 0x70], vtable.CHalfActivateUpdateListWnd.4.0
mov dword [ebx + 0xe0], vtable.CHalfActivateUpdateListWnd.6.0
mov dword [ebx + 0xe4], vtable.CHalfActivateUpdateListWnd.7.0
call fcn.00466bb0
lea esi, [ebx + 0x158]
mov byte [esp + 0x1c], 2
call fcn.0046c490
lea ecx, [ebx + 0x22c]
push ecx
mov byte [esp + 0x20], 3
call fcn.0048dda0
lea eax, [ebx + 0x244]
push eax
mov byte [esp + 0x20], 4
call fcn.0040d5c0
mov dword [ebx + 0x264], edi
push 0x41c236
mov byte [esp + 0x20], 6
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x24
mov dword [ebx + 0x264], eax
call fcn.004f78be
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 7
cmp eax, edi
je 0x46c7e2
push 4
push 1
push eax
mov edi, str.resHalfActivateFwWnd_btn_zanting.png
call fcn.00445fc0
mov dword [ebx + 0x268], eax
jmp 0x46c7e8
mov dword [ebx + 0x268], edi
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x46c960
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push ecx
mov eax, esp
mov dword [ebp + 0x14c], 0x48
mov dword [eax], 0x8019
push ecx
mov eax, esp
mov dword [eax], 0x620ce8
mov eax, dword [ebp + 4]
push eax
lea esi, [ebp + 0xe8]
call fcn.00468990
mov ecx, dword [ebp + 0xec]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
mov eax, esp
lea ebx, [ebp + 0x158]
mov dword [ebx + 0x48], 0x6644dc
mov dword [ebx + 0x44], 0x664508
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], 0
mov edx, dword [ebp + 4]
push edx
mov esi, ebx
call fcn.0046e2c0
mov edi, dword [ebp + 0xec]
lea esi, [ebx + 0xa0]
call fcn.0046e260
push ebx
mov ebx, edi
call fcn.004975b0
mov eax, dword [0x6644dc]
mov edx, dword [eax + 0xc]
mov ecx, 0x6644dc
call edx
mov eax, dword [0x6644ec]
lea esi, [ebp + 0xe0]
mov dword [ebp + 0x1e0], eax
mov dword [esp + 0x20], esi
call fcn.0042d470
test esi, esi
je 0x46ca2e
lea ecx, [esp + 0x20]
push ecx
add eax, 0x5c
push eax
lea ebx, [esp + 0x18]
call fcn.00499420
add ebp, 0xe4
mov dword [esp + 0x20], ebp
call fcn.0042d400
lea edx, [esp + 0x20]
push edx
add eax, 0x2c
push eax
lea ebx, [esp + 0x18]
call fcn.00499420
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4