joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8e4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x4b9084
mov eax, dword [ecx]
push esi
call dword [eax + 0x30]
push eax
lea ecx, [ebp - 0xc]
call fcn.004177e7
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00418dea
pop ecx
lea esi, [eax + 0x10]
mov eax, dword [edi + 0x14]
cmp dword [esi - 0xc], 0
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x18]
mov edi, dword [ebp - 0xc]
mov dword [ebp + 8], eax
jle 0x4b9073
push 0x699740
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8ed1
push 0x685708
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8ed1
add ebx, 0xffffffec
push eax
mov ecx, ebx
call fcn.005c105a
push ebx
jmp 0x4b902f
push 0x69a09c
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f02
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f02
push 1
lea ecx, [ebx - 0x14]
call fcn.005c11ef
jmp 0x4b9073
push 0x6b2860
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f34
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f34
lea eax, [ebx - 0x14]
push eax
push 0
push 0x4e922f
jmp 0x4b9036
push str.messagecenter.allread
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f66
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f66
lea eax, [ebx - 0x14]
push eax
push 0
push 0x4b32f1
jmp 0x4b9036
push str.messagecenter.system
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f9e
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8f9e
push dword [ebp + 8]
lea ecx, [ebx - 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004d3743
jmp 0x4b9073
push str.messagecenter.personal
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8fd6
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b8fd6
push dword [ebp + 8]
lea ecx, [ebx - 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004cb9dc
jmp 0x4b9073
push str.systembroadcast.nextpage
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b9003
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b9003
lea eax, [ebx - 0x14]
inc dword [eax + 0x2c4]
jmp 0x4b902e
push str.personalbroadcast.nextpage
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b9040
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b9040
lea eax, [ebx - 0x14]
inc dword [eax + 0x2c8]
push eax
push 0
push 0x48550b
call fcn.006423a8
add esp, 0xc
jmp 0x4b9073
push str.messagecenter.item
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b9073
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4b9073
push dword [ebp + 8]
lea ecx, [ebx - 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004cac92
lea ecx, [esi - 0x10]
call fcn.00419521
lea ecx, [edi - 0x10]
call fcn.00419521
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ba4b7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4ba5be
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x30]
push eax
lea ecx, [ebp - 0xc]
call fcn.004177e7
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00418dea
pop ecx
lea esi, [eax + 0x10]
mov eax, dword [edi + 0x14]
cmp dword [esi - 0xc], 0
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x18]
mov edi, dword [ebp - 0xc]
mov dword [ebp + 8], eax
jle 0x4ba5ad
push 0x699740
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4ba53f
push 0x685708
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4ba53f
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
push dword [ebp - 8]
push ebx
lea ecx, [ecx - 0x14]
call fcn.004da53f
jmp 0x4ba5ad
push 0x699b0c
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4ba575
push str.lclick
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4ba575
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
push dword [ebp - 8]
push ebx
lea ecx, [ecx - 0x14]
call fcn.004c1ebe
jmp 0x4ba5ad
push str.groupshare.authority
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4ba5ad
push str.checkchanged
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x4ba5ad
mov eax, dword [ebp - 4]
add eax, 0xffffffec
push eax
push 0
push 0x460155
call fcn.006423a8
add esp, 0xc
lea ecx, [esi - 0x10]
call fcn.00419521
lea ecx, [edi - 0x10]
call fcn.00419521
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bc6fd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [eax], edi
call fcn.004a1afe
push edi
push edi
push 0x576
push dword [0x735624]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
push edi
push 0x47606d
call fcn.006423a8
add esp, 0xc
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4bfae7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
push ecx
mov dword [ebp - 8], ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push 0x6bf9e0
call fcn.004177e7
mov ecx, 0x736918
call fcn.004ef41e
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax + 0x16c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
mov esi, eax
mov eax, dword [ebx]
pop ecx
mov ecx, ebx
call dword [eax + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x16c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
mov edi, eax
mov eax, dword [ebx]
pop ecx
mov ecx, ebx
call dword [eax + 0x38]
push eax
lea ecx, [ebp + 8]
call fcn.004177e7
call fcn.00418f81
push eax
lea ecx, [ebp - 0x10]
call fcn.0041775d
push ecx
mov eax, esi
mov ebx, esp
push eax
mov dword [ebp - 0xc], eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [ebx], eax
call fcn.004b57d7
pop ecx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call fcn.00418bac
push ecx
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.00446216
lea eax, [ebp - 4]
push eax
call fcn.0045b981
push 8
call fcn.00609934
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4bfbde
call fcn.00418f81
push eax
lea ecx, [ebx + 4]
call fcn.0041775d
jmp 0x4bfbe0
xor ebx, ebx
push ecx
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.004b57d7
pop ecx
mov dword [ebx], eax
lea ecx, [ebx + 4]
lea eax, [ebp - 4]
push eax
call fcn.00418bac
push ebx
xor ebx, ebx
push ebx
push 0x506986
call fcn.006423a8
pop ecx
pop ecx
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.004b57d7
pop ecx
mov ecx, dword [ebp - 8]
push eax
call fcn.0047a3ff
test eax, eax
je 0x4bfc98
lea esi, [eax + 8]
push str.card_trafficlimit_todaytomorrow
mov ecx, esi
call fcn.005d83b1
test eax, eax
je 0x4bfc53
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x180]
push str.card_trafficlimit_nocity
mov ecx, esi
call fcn.005d83b1
test eax, eax
je 0x4bfc6e
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x180]
push str.card_trafficlimit_citylist
mov ecx, esi
call fcn.005d83b1
test eax, eax
je 0x4bfc89
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x180]
mov eax, dword [esi]
mov ecx, esi
push 0x92
call dword [eax + 0xf8]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, edi
call fcn.00419521
mov ecx, dword [ebp - 0xc]
call fcn.00419521
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bfcd1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
push ecx
mov edi, ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push 0x6bf9fc
call fcn.004177e7
mov ecx, 0x736918
call fcn.004ef41e
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax + 0x180]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x16c]
push ecx
mov esi, esp
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
push eax
mov dword [ebp - 0xc], eax
call fcn.00418dea
pop ecx
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.004b57d7
pop ecx
mov esi, eax
mov ecx, edi
push esi
call fcn.0047a3ff
test eax, eax
je 0x4bfe9c
lea ebx, [eax + 8]
push str.card_trafficlimit_cancle
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4bfd70
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x180]
push str.card_trafficlimit_citylist
mov ecx, ebx
xor edi, edi
call fcn.005d83b1
test eax, eax
je 0x4bfd9f
lea edi, [eax - 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
test eax, eax
jne 0x4bfd9f
push esi
push eax
push 0x48bb8b
call fcn.006423a8
add esp, 0xc
push str.card_trafficlimit
mov ecx, ebx
call fcn.005d83b1
mov ecx, eax
mov dword [ebp - 4], eax
mov edx, dword [eax]
call dword [edx + 0x16c]
mov ecx, dword [eax]
sub ecx, 0x10
push ecx
call fcn.00418dea
mov esi, esp
mov dword [ebp - 8], eax
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.004b57d7
mov ecx, ebx
mov dword [esp], str.card_trafficlimit_todaytomorrow
call fcn.005d83b1
test eax, eax
je 0x4bfdf7
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x180]
push str.card_trafficlimit_citylist
mov ecx, ebx
call fcn.005d83b1
mov esi, eax
push 0x46
pop ecx
mov dword [ebp + 8], ecx
test edi, edi
je 0x4bfe4b
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xc]
push ecx
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x6c2688]
movsd qword [esp], xmm0
call fcn.00641eb0
fmul qword [0x6c2700]
pop ecx
pop ecx
fadd qword [0x6c26e8]
fstp qword [ebp - 0x14]
cvttsd2si ecx, qword [ebp - 0x14]
mov dword [ebp + 8], ecx
test esi, esi
je 0x4bfe66
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0xf8]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x180]
push str.card_trafficlimit_nocity
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4bfe82
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x180]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, 0x5a
push eax
mov edx, dword [ecx]
call dword [edx + 0xf8]
mov ecx, dword [ebp - 8]
call fcn.00419521
mov ecx, dword [ebp - 0xc]
call fcn.00419521
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c006d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
push ecx
mov ebx, ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push 0x6bfc04
call fcn.004177e7
mov ecx, 0x736918
call fcn.004ef41e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x16c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
mov esi, eax
pop ecx
cmp dword [esi + 4], 0
je 0x4c0216
push ecx
mov edi, esp
push esi
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.004b57d7
pop ecx
push eax
mov ecx, ebx
call fcn.0047a3ff
test eax, eax
je 0x4c0216
lea ebx, [eax + 8]
push str.card_worldclock_set
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4c0102
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x180]
push str.card_worldclock_add_ok
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4c011e
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x180]
push str.card_worldclock_add_cancle
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4c013a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x180]
push str.card_worldclock_list
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4c0156
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0x180]
mov edi, 0x6bfaa0
mov ecx, ebx
push edi
call fcn.005d83b1
test eax, eax
je 0x4c0173
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x180]
push edi
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4c0216
lea ecx, [eax - 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jne 0x4c0216
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x16c]
push ecx
mov edi, esp
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [edi], eax
call fcn.004b57d7
mov edi, eax
mov eax, dword [0x736808]
sub eax, dword [0x736804]
pop ecx
push 0x60
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x4c01df
push edi
push eax
push 0x478541
call fcn.006423a8
add esp, 0xc
jmp 0x4c0216
push 0x6bfaa0
mov ecx, ebx
call fcn.005d83b1
test eax, eax
je 0x4c01f4
lea ecx, [eax - 8]
jmp 0x4c01f6
xor ecx, ecx
test ecx, ecx
je 0x4c0216
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jne 0x4c0216
push edi
push eax
push 0x57a
push dword [0x735624]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esi]
call fcn.00419521
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4c051e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push ecx
mov ebx, ecx
mov ecx, esp
push 0x6809b0
call fcn.004177e7
push ecx
mov ecx, esp
push 0x6bfb28
call fcn.004177e7
mov ecx, 0x736918
call fcn.004ef41e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x16c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
mov esi, esp
mov dword [ebp - 0xc], eax
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.004b57d7
pop ecx
mov edi, eax
mov ecx, ebx
push edi
call fcn.0047a3ff
test eax, eax
je 0x4c0704
push 0x6bfaa0
lea ecx, [eax + 8]
call fcn.005d83b1
test eax, eax
je 0x4c05ae
lea esi, [eax - 8]
jmp 0x4c05b0
xor esi, esi
mov eax, dword [0x736808]
sub eax, dword [0x736804]
push 0x60
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x4c05d6
push edi
push eax
push 0x478541
call fcn.006423a8
add esp, 0xc
jmp 0x4c05f8
test esi, esi
je 0x4c05f8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
jne 0x4c05f8
push edi
push eax
push 0x57a
push dword [0x735624]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp eax, 2
jne 0x4c06b6
lea eax, [ebx - 0x3ec]
neg ebx
lea ecx, [esi + 8]
sbb ebx, ebx
and ebx, eax
mov eax, dword [ecx]
mov dword [ebp - 8], ebx
call dword [eax + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc4]
mov esi, eax
lea edi, [ebp - 0x1c]
push 0x2d8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00609934
pop ecx
test eax, eax
je 0x4c0653
mov ecx, eax
call fcn.00440ee8
mov ebx, eax
jmp 0x4c0655
xor ebx, ebx
push 0
mov eax, SysReAllocString
mov ecx, ebx
push eax
push eax
mov eax, dword [ebp - 8]
push 0
push 0
push 0
push 0x80880000
push str.Toast
push dword [eax + 4]
call fcn.005c122f
mov eax, dword [ebp - 8]
lea esi, [ebp - 0x1c]
sub esp, 0x10
mov ecx, ebx
mov edi, esp
push dword [eax + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004f7c9e
push ecx
mov ecx, esp
push 0x6bfb44
call fcn.004177e7
mov ecx, ebx
call fcn.004fd7ed
push 0x3e8
mov ecx, ebx
call fcn.00502228
jmp 0x4c0704
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x16c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
pop ecx
push 0
push ecx
mov edi, eax
mov esi, esp
push edi
call fcn.00418dea
add eax, 0x10
mov dword [esi], eax
mov esi, esp
push dword [ebp - 0xc]
call fcn.00418dea
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00453700
mov ecx, edi
call fcn.00419521
mov ecx, dword [ebp - 0xc]
call fcn.00419521
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c1155
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi - 8]
neg esi
sbb esi, esi
and esi, eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0xc]
xor edi, edi
mov dword [ebp - 4], eax
test eax, eax
jle 0x4c11d1
push ebx
mov edx, dword [esi]
mov ecx, esi
push edi
call dword [edx]
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x30]
push eax
lea ecx, [ebp + 8]
call fcn.004177e7
push str.cityitem_itemedit
lea ecx, [ebp + 8]
call fcn.004334a5
test eax, eax
je 0x4c11b3
push str.cityitem_itemdel
lea ecx, [ebp + 8]
call fcn.004334a5
test eax, eax
jne 0x4c11bf
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0x180]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00419521
inc edi
cmp edi, dword [ebp - 4]
jl 0x4c1178
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4c11d9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi - 8]
neg esi
sbb esi, esi
and esi, eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0xc]
xor edi, edi
mov dword [ebp - 4], eax
test eax, eax
jle 0x4c1255
push ebx
mov edx, dword [esi]
mov ecx, esi
push edi
call dword [edx]
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x30]
push eax
lea ecx, [ebp + 8]
call fcn.004177e7
push str.cityitem_itemedit
lea ecx, [ebp + 8]
call fcn.004334a5
test eax, eax
je 0x4c1237
push str.cityitem_itemdel
lea ecx, [ebp + 8]
call fcn.004334a5
test eax, eax
jne 0x4c1243
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0x180]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00419521
inc edi
cmp edi, dword [ebp - 4]
jl 0x4c11fc
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c125d
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edi
neg ebx
sbb ebx, ebx
lea eax, [edi - 0x364]
and ebx, eax
cmp dword [edi + 0x84], 0xffffffff
mov dword [ebp - 8], ebx
je 0x4c128f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
call fcn.004d9066
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x16c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
add eax, 0x10
mov esi, esp
mov dword [ebp + 8], eax
add eax, 0xfffffff0
push eax
mov dword [ebp - 0xc], eax
call fcn.00418dea
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00461200
lea esi, [edi + 0x74]
and dword [ebp + 0x10], 0
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0x24
pop ecx
cdq
idiv ecx
mov dword [ebp - 4], ecx
test eax, eax
je 0x4c132f
xor ecx, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [esi]
push 0
push dword [ecx + eax + 4]
lea ecx, [ebp + 8]
call fcn.004713d7
test eax, eax
jns 0x4c131d
mov ecx, dword [ebp + 0xc]
push 0x24
pop eax
add ecx, eax
inc dword [ebp + 0x10]
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv dword [ebp - 4]
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x10], eax
jb 0x4c12eb
jmp 0x4c132f
imul eax, dword [ebp + 0x10], 0x24
mov ecx, esi
add eax, dword [esi]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00511128
mov ecx, dword [edi + 0x68]
mov eax, dword [ecx]
call dword [eax + 0xc]
xor esi, esi
mov dword [ebp - 4], eax
mov byte [ebp + 0x13], 0
mov dword [ebp + 8], esi
test eax, eax
jle 0x4c13a2
mov ebx, eax
call fcn.00418f81
push eax
lea ecx, [ebp + 0xc]
call fcn.0041775d
xor byte [ebp + 0x13], 1
push 0
pop eax
sete al
push eax
lea eax, [ebp + 0xc]
push str.IDB_countdown_bg_d
push eax
call fcn.0041a1e9
mov ecx, dword [edi + 0x68]
add esp, 0xc
mov eax, dword [ecx]
push esi
call dword [eax]
mov esi, dword [ebp + 0xc]
mov ecx, eax
push esi
mov edx, dword [eax]
call dword [edx + 0x84]
lea ecx, [esi - 0x10]
call fcn.00419521
mov esi, dword [ebp + 8]
inc esi
mov dword [ebp + 8], esi
cmp esi, ebx
jl 0x4c1349
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x4c1404
cmp byte [edi + 0x1c], 0
jne 0x4c1404
mov esi, 0x6809b0
mov ecx, 0x735b1c
push esi
call fcn.004195af
push esi
mov ecx, 0x735b04
call fcn.004195af
push esi
mov ecx, 0x735b08
call fcn.004195af
push esi
mov ecx, 0x735b0c
call fcn.004195af
push esi
mov ecx, 0x735b14
call fcn.004195af
push esi
mov ecx, 0x735b18
call fcn.004195af
push ebx
push 0
push 0x499981
call fcn.006423a8
add esp, 0xc
mov ecx, dword [ebp - 0xc]
call fcn.00419521
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c18d9
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov esi, 0x6809b0
push esi
push str.Shell_TrayWnd
mov ebx, ecx
call edi
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push str.TrayNotifyWnd
push 0
push eax
call esi
push 0
push str.TrayClockWClass
push 0
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x4c1924
push 0
push 0
push 5
push eax
call esi
mov ecx, ebx
call fcn.0048c18c
xor ebx, ebx
mov dword [0x735620], eax
push ebx
push ebx
push 0x46d
push eax
call esi
push ebx
push str._PCMaster6
call edi
test eax, eax
je 0x4c1953
push ebx
push 2
push 0x709
push eax
call esi
push ebx
push str._Pcmaster_LunarCalendar_MytimeWeb
call edi
test eax, eax
je 0x4c1966
push ebx
push ebx
push 0x10
push eax
call esi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
push str.mytimemain.exe
call fcn.004177e7
call fcn.004a95b5
mov eax, dword [ebp + 0x14]
pop ecx
push ebx
mov dword [eax], ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x4c2c7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x33c], 0xffffffff
je 0x4c2c9e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004d4224
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x16c]
push ecx
mov esi, esp
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
push eax
mov dword [ebp - 4], eax
call fcn.00418dea
pop ecx
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00460d3f
mov ecx, dword [edi + 0x338]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp + 8], eax
mov esi, ebx
mov dword [ebp + 0xc], esi
test eax, eax
jle 0x4c2d42
call fcn.00418f81
push eax
lea ecx, [ebp + 0x10]
call fcn.0041775d
push 0
pop eax
xor bl, 1
sete al
push eax
lea eax, [ebp + 0x10]
push str.IDB_countdown_bg_d
push eax
call fcn.0041a1e9
mov ecx, dword [edi + 0x338]
add esp, 0xc
mov eax, dword [ecx]
push esi
call dword [eax]
mov esi, dword [ebp + 0x10]
mov ecx, eax
push esi
mov edx, dword [eax]
call dword [edx + 0x84]
lea ecx, [esi - 0x10]
call fcn.00419521
mov esi, dword [ebp + 0xc]
inc esi
mov dword [ebp + 0xc], esi
cmp esi, dword [ebp + 8]
jl 0x4c2cec
mov ecx, dword [ebp - 4]
call fcn.00419521
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc