joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c600
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x100], 0
je 0x45c63a
push dword [esi + 0x100]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x45c63a
mov dword [esi + 0x100], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x45c664
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45c682
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xffffffff
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xffffffff
push eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00498e40
test eax, eax
je 0x45c6e6
push edi
mov edi, dword [ebp - 8]
mov ecx, esi
push edi
call fcn.00418db0
mov ecx, esi
test eax, eax
jne 0x45c6cf
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call fcn.0045d770
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push eax
push edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], eax
call fcn.0045a8a0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45ce40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
xor ecx, ecx
lea eax, [edi + 0x24]
test eax, eax
cmove edi, ecx
cmp byte [eax + 0x1c], cl
je 0x45ce86
push 0xe801
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, 2
jne 0x45ce77
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45ce8b
test esi, esi
jne 0x45ce86
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45ce8b
cmp esi, 1
je 0x45cea1
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [edi + 0x24]
push eax
call fcn.004bb130
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x45cfb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x58a710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x6c], 0
je 0x45cfd3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x45cffb
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45d019
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [esi + 0x24], 0
je 0x45d03e
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0x10], eax
jmp 0x45d045
mov dword [ebp - 0x10], 0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 8
ja case.default.0x45d05e
jmp dword [eax*4 + 0x45d13c]
xor edi, edi
jmp 0x45d0ec
mov eax, edi
xor edi, edi
sub eax, dword [esi + 0x9c]
test eax, eax
cmovg edi, eax
jmp 0x45d0ec
sub edi, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add eax, edi
xor edi, edi
test eax, eax
cmovg edi, eax
jmp 0x45d0ec
mov edi, dword [esi + 0x378]
imul edi, dword [esi + 0x9c]
jmp 0x45d0ec
add edi, dword [esi + 0x9c]
jmp 0x45d0ec
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
add edi, eax
jmp 0x45d0ec
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 1
push dword [esi + 4]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x30], 0x1c
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je case.default.0x45d05e
mov eax, dword [ebp - 0x18]
cmp eax, edi
je case.default.0x45d05e
mov edi, eax
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
push 0
push edi
push 1
mov ecx, esi
call fcn.00428e80
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005193a0
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 0x70], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005193a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45d210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x45d3da
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
cmp edi, 0x110
jne 0x45d263
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 1
push eax
push ebx
push dword [ebp + 0x10]
lea ecx, [esi + 0x44]
push 0x110
call fcn.0045b1e0
cmp dword [ebp + 0x1c], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x45d266
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x18]
cmp edi, 0x110
jne 0x45d28f
lea eax, [ebp + 0x1c]
mov ecx, esi
push eax
push ebx
push dword [ebp + 0x10]
push edi
call fcn.0045b310
mov ecx, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, 1
pop ebp
ret 0x18
cmp edi, 2
jne 0x45d2c4
lea eax, [ebp + 0x1c]
mov dword [ebp + 0x1c], 1
push eax
push ebx
push dword [ebp + 0x10]
mov ecx, esi
push edi
call fcn.004feee0
cmp dword [ebp + 0x1c], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x45d3da
lea eax, [edi - 1]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp edi, 5
jne 0x45d2e8
lea eax, [ebp + 0x1c]
mov ecx, esi
push eax
push ebx
push dword [ebp + 0x10]
push edi
call fcn.0045ce40
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
lea eax, [edi - 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp edi, 0x24
jne 0x45d317
cmp dword [esi + 0x38], 0xffffffff
je 0x45d305
cmp dword [esi + 0x3c], 0xffffffff
je 0x45d305
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x1c], eax
pop edi
pop esi
mov dword [ecx], 0
mov eax, 1
pop ebx
pop ebp
ret 0x18
cmp edi, 0x4e
jne 0x45d377
mov eax, dword [ebx + 8]
cmp eax, 0xfffffa87
jne 0x45d344
lea eax, [ebp + 0x1c]
mov ecx, esi
push eax
push ebx
push dword [ebp + 0x10]
call fcn.0045b470
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
lea eax, [edi - 0x4d]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp eax, 0xfffffa84
jne 0x45d3da
lea ecx, [esi + 0x44]
call fcn.00459510
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov eax, 1
pop edi
pop esi
pop ebx
mov dword [ecx], 0
pop ebp
ret 0x18
cmp edi, 0x111
jne 0x45d3da
mov eax, dword [ebp + 0x10]
mov edi, 1
cmp di, ax
jne 0x45d3ab
lea ecx, [ebp + 0x1c]
shr eax, 0x10
push ecx
push ebx
push edi
push eax
mov ecx, esi
call fcn.0045c6f0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov ecx, 2
cmp cx, ax
jne 0x45d3da
lea ecx, [esi + 0x44]
call fcn.00459510
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword [ecx], 0
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18

Function at 0x45d980
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xa8], edx
mov dword [ecx + 0xac], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], edx
pop ebp
jmp fcn.0045a8a0
Function at 0x4619b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 4], ebx
mov dword [ebx + 0xb8], 0xffffffff
mov dword [ebx + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebx + 0x1e8]
jne 0x4619e3
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [ebx + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x461a01
push 0
push dword [ebx + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetScrollPos]
push edi
push 0
push dword [ebx + 4]
call esi
push 1
push dword [ebx + 4]
mov edi, eax
call esi
mov esi, dword [ebp + 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add esi, edi
mov ecx, esi
lea edi, [eax + 0x8c]
push edi
mov edx, dword [eax + 0x84]
cmp edx, esi
cmovl ecx, edx
cmovg esi, edx
mov edx, dword [ebp + 0xc]
add edx, ebx
mov dword [edi], ecx
mov ebx, eax
mov dword [eax + 0x94], esi
mov eax, edx
mov ecx, dword [ebx + 0x88]
cmp ecx, edx
cmovl eax, ecx
cmovg edx, ecx
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x98], edx
call dword [sym.imp.USER32.dll_IsRectEmpty]
pop edi
test eax, eax
je 0x461a79
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0045f830
push 0
push 0x14
push 0x3eb
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov ecx, esi
sub ecx, dword [ebx + 0xfc]
cmp ecx, 0xa
jbe 0x461ac4
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call fcn.004669e0
test eax, eax
je 0x461ac4
mov dword [ebx + 0xfc], esi
push 0x105
push 0
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x462720
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x58a710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x100], 0
je 0x462765
push dword [esi + 0x100]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x462765
mov dword [esi + 0x100], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [esi + 0x6c], 0
je 0x462781
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x4627a9
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4627c7
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 7
ja case.default.0x4627f4
jmp dword [eax*4 + 0x4628b4]
xor edx, edx
jmp 0x462889
lea edx, [edi - 5]
xor eax, eax
test edx, edx
cmovle edx, eax
jmp 0x462889
mov eax, dword [ebp - 0x14]
xor edx, edx
sub eax, dword [ebp - 0xc]
add eax, edi
test eax, eax
cmovg edx, eax
jmp 0x462889
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
jmp 0x462889
mov edx, dword [esi + 0xc4]
lea eax, [edi + 5]
dec edx
cmp eax, edx
cmovl edx, eax
jmp 0x462889
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov edx, dword [esi + 0xc4]
add ecx, edi
dec edx
cmp ecx, edx
cmovl edx, ecx
jmp 0x462889
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 0
push dword [esi + 4]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x30], 0x1c
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je case.default.0x4627f4
mov edx, dword [ebp - 0x18]
cmp edx, edi
je case.default.0x4627f4
push 0
push edx
push 0
mov ecx, esi
call fcn.004644b0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005193a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x463860
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x46388f
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4638ad
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x6c], 0
je 0x4638bc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
movsx ecx, word [ebp + 0xc]
mov eax, 0x88888889
imul ecx, dword [esi + 0xc0]
push 1
push dword [esi + 4]
imul ecx
add edx, ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edx, eax
test edi, edi
jle 0x4638ff
mov ecx, dword [esi + 0x9c]
xor edx, edx
imul ecx, edi
sub eax, ecx
test eax, eax
cmovg edx, eax
jmp 0x46390a
mov eax, dword [esi + 0x9c]
imul eax, edi
sub edx, eax
push 0
push edx
push 1
mov ecx, esi
call fcn.004644b0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x463aa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x100], 0
je 0x463ada
push dword [esi + 0x100]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x463ada
mov dword [esi + 0x100], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x463b04
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x463b22
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xffffffff
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xffffffff
push eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00461ae0
test eax, eax
je 0x463b86
push edi
mov edi, dword [ebp - 8]
mov ecx, esi
push edi
call fcn.00418db0
mov ecx, esi
test eax, eax
jne 0x463b6f
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call fcn.004647d0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push eax
push edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], eax
call fcn.00460c40
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x463d10
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x463d27
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x463d45
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x370], 0
pop esi
ret 0xc
Function at 0x463e60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x58a710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x6c], 0
je 0x463e83
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x463eab
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x463ec9
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [esi + 0x24], 0
je 0x463eee
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0x10], eax
jmp 0x463ef5
mov dword [ebp - 0x10], 0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 8
ja case.default.0x463f0e
jmp dword [eax*4 + 0x463fec]
xor edi, edi
jmp 0x463f9c
mov eax, edi
xor edi, edi
sub eax, dword [esi + 0x9c]
test eax, eax
cmovg edi, eax
jmp 0x463f9c
sub edi, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add eax, edi
xor edi, edi
test eax, eax
cmovg edi, eax
jmp 0x463f9c
mov edi, dword [esi + 0x388]
imul edi, dword [esi + 0x9c]
jmp 0x463f9c
add edi, dword [esi + 0x9c]
jmp 0x463f9c
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
add edi, eax
jmp 0x463f9c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 1
push dword [esi + 4]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x30], 0x1c
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x2c], 0x10
call dword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je case.default.0x463f0e
mov eax, dword [ebp - 0x18]
cmp eax, edi
je case.default.0x463f0e
mov edi, eax
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
push 0
push edi
push 1
mov ecx, esi
call fcn.004644b0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005193a0
mov esp, ebp
pop ebp
ret 0xc
mov dword [esi + 0x70], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005193a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4645f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x58a710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0xb8], 0xffffffff
mov dword [esi + 0xbc], 0xffffffff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x46462d
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46464b
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx edi, ax
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0xc4]
mov ebx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xc]
dec ebx
add ebx, ecx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x18], ebx
je 0x464733
cmp dword [esi + 0x3c], 0
je 0x464705
cmp dword [esi + 0x58], 0
je 0x464705
mov eax, edi
sub eax, dword [esi + 0xec]
test eax, eax
jg 0x464705
cmp edi, dword [esi + 0xf4]
jge 0x4647bb
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
cmp eax, ebx
jl 0x4647bb
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004ae9e0
mov ecx, edi
sub ecx, dword [esi + 0xec]
add eax, ecx
test eax, eax
jle 0x4646f7
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004ae9e0
sub edi, dword [esi + 0xec]
add eax, edi
mov dword [esi + 0xf0], eax
push eax
jmp 0x4647ae
xor eax, eax
mov dword [esi + 0xf0], eax
push eax
jmp 0x4647ae
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0xf4], edi
pop edi
mov dword [esi + 0x60], 0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005193a0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xf0]
xor ebx, ebx
sub eax, dword [esi + 0xf4]
add eax, edi
test eax, eax
cmovg ebx, eax
cmp dword [esi + 0x58], 0
je 0x4647a7
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetScrollPos]
cmp eax, dword [ebp - 0x18]
jl 0x4647a7
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004ae9e0
cmp ebx, eax
jge 0x4647a7
cmp dword [esi + 0x60], 0
jne 0x4647bb
push 0
push 0x14
push 0x3e9
push dword [esi + 4]
mov dword [esi + 0x60], 1
mov dword [esi + 0xec], edi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005193a0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x60], 0
jne 0x4647bb
push ebx
push dword [esi + 0xdc]
mov ecx, esi
call fcn.004ccf30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005193a0
mov esp, ebp
pop ebp
ret 4

Function at 0x464b00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xa8], edx
mov dword [ecx + 0xac], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], edx
pop ebp
jmp fcn.00460c40
Function at 0x469ea0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0x100], 0
je 0x469eda
push dword [esi + 0x100]
call dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x469eda
mov dword [esi + 0x100], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x1e8]
jne 0x469f04
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x469f22
push 0
push dword [esi + 0x1e8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xffffffff
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xffffffff
push eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00498e40
test eax, eax
je 0x469f86
push edi
mov edi, dword [ebp - 8]
mov ecx, esi
push edi
call fcn.00418db0
mov ecx, esi
test eax, eax
jne 0x469f6f
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call fcn.0046a9e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
push eax
push edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], eax
call fcn.00468700
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x469f90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [ecx - 0x28]
neg esi
push edi
mov edi, dword [ebp + 0xc]
sbb esi, esi
and esi, eax
cmp byte [ecx + 0x1c], 0
je 0x469fd6
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x469fc7
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x469fdb
test edi, edi
jne 0x469fd6
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x469fdb
cmp edi, 1
je 0x469ff1
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [esi + 0x28]
push eax
call fcn.00467420
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x46ac40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xa8], edx
mov dword [ecx + 0xac], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], edx
pop ebp
jmp fcn.00468700
Function at 0x4753c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5435aa
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x58a710]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0xffffffff
mov dword [edi + 0x3c], 0xffffffff
lea esi, [edi + 0x44]
mov dword [edi + 0x20], vtable.WTL::CMessageFilter.0
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [edi], vtable.CHookcfgDlg.0
mov dword [edi + 0x20], vtable.CHookcfgDlg.1.0
mov dword [ebp - 0x14], esi
call fcn.0047ca50
mov dword [esi + 0x374], 0
mov dword [esi + 0x378], 0
mov dword [esi + 0x37c], 0
mov dword [esi], vtable.CHkPidlist.0
lea esi, [edi + 0x3c4]
mov byte [ebp - 4], 2
push 0
mov dword [ebp - 0x14], esi
mov ecx, esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00436360
mov dword [esi], eax
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3e0], 0
push dword [ebp - 0x14]
mov eax, dword [edi + 0x64]
lea ecx, [edi + 0x64]
push ecx
push 0x5885a0
push 0x593dd4
push 0x594af8
mov byte [ebp - 4], 4
mov dword [0x5885a8], eax
call fcn.00411840
add esp, 0x14
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret