joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486ee0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e62e4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
xor edi, edi
lea ecx, [esi + 0x2dc]
push edx
mov dword [esp + 0x20], edi
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.ReceiverImpl_int__struct_SkinChangedParam_.0
call fcn.004b57e0
mov dword [esi + 0x2fc], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x300], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x304], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x308], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x310], ecx
push edx
lea ecx, [esi + 0x314]
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.CUIExpandDistrict.5.0
mov dword [esi + 0x10], vtable.CUIExpandDistrict.4.0
mov dword [esi + 0x20], vtable.CUIExpandDistrict.3.0
mov dword [esi + 0x24], vtable.CUIExpandDistrict.2.0
mov dword [esi + 0x28], vtable.CUIExpandDistrict.1.0
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.CUIExpandDistrict.0
mov dword [esi + 0x30c], eax
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__]
mov eax, dword [esp + 0x38]
mov dword [esi + 0x398], eax
xor ecx, ecx
mov dword [esi + 0x3b4], 7
mov dword [esi + 0x3b0], edi
mov word [esi + 0x3a0], cx
lea ecx, [esi + 0x3d4]
mov byte [esp + 0x18], 3
mov dword [esi + 0x3b8], edi
call fcn.004b5960
mov dword [esi + 0x3c0], edi
mov dword [esi + 0x3c4], edi
mov dword [esi + 0x3c8], edi
mov dword [esi + 0x410], edi
mov dword [esi + 0x7420c], edi
mov dword [esi + 0x3d0], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x1c
Function at 0x488c40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5eb1e6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
xor edi, edi
lea ecx, [esi + 0x2dc]
push edx
mov dword [esp + 0x20], edi
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.ReceiverImpl_int__struct_SkinChangedParam_.0
call fcn.004b57e0
mov dword [esi + 0x2fc], edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x304], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x300], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x308], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x30c], eax
mov dword [esi + 0x310], ecx
push edx
lea ecx, [esi + 0x314]
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.CUIFeedback.5.0
mov dword [esi + 0x10], vtable.CUIFeedback.4.0
mov dword [esi + 0x20], vtable.CUIFeedback.3.0
mov dword [esi + 0x24], vtable.CUIFeedback.2.0
mov dword [esi + 0x28], vtable.CUIFeedback.1.0
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.CUIFeedback.0
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__]
mov eax, dword [esp + 0x38]
lea ecx, [esi + 0x3a0]
mov byte [esp + 0x18], 2
mov dword [esi + 0x398], eax
mov dword [esi + 0x39c], edi
call fcn.004b5960
mov dword [esi + 0x828], 7
mov dword [esi + 0x824], edi
push 0x104
xor ecx, ecx
mov word [esi + 0x814], cx
lea edx, [esi + 0x400]
push edi
push edx
mov dword [esi + 0x3dc], edi
mov dword [esi + 0x3e0], edi
mov dword [esi + 0x3e4], edi
mov dword [esi + 0x3e8], edi
mov dword [esi + 0x3ec], edi
call fcn.004e9ba0
push 0x104
lea eax, [esi + 0x608]
push edi
push eax
call fcn.004e9ba0
add esp, 0x18
mov dword [esi + 0x3fc], edi
mov dword [esi + 0x3f4], edi
mov dword [esi + 0x3f8], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x1c
Function at 0x489440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5eb1e6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
xor ebx, ebx
lea ecx, [esi + 0x2dc]
push edx
mov dword [esp + 0x20], ebx
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.ReceiverImpl_int__struct_SkinChangedParam_.0
call fcn.004b57e0
mov dword [esi + 0x2fc], ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x300], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x304], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x308], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x310], ecx
push edx
lea ecx, [esi + 0x314]
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.CUIFeedBackTip.5.0
mov dword [esi + 0x10], vtable.CUIFeedBackTip.4.0
mov dword [esi + 0x20], vtable.CUIFeedBackTip.3.0
mov dword [esi + 0x24], vtable.CUIFeedBackTip.2.0
mov dword [esi + 0x28], vtable.CUIFeedBackTip.1.0
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.CUIFeedBackTip.0
mov dword [esi + 0x30c], eax
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__]
mov eax, dword [esp + 0x38]
lea ecx, [esi + 0x39c]
mov byte [esp + 0x18], 2
mov dword [esi + 0x398], eax
call fcn.004b5960
mov dword [esi + 0x408], 7
mov dword [esi + 0x404], ebx
xor ecx, ecx
mov word [esi + 0x3f4], cx
mov dword [esi + 0x3d8], ebx
mov dword [esi + 0x3dc], ebx
mov dword [esi + 0x3e0], ebx
mov dword [esi + 0x3e4], ebx
mov dword [esi + 0x3e8], ebx
mov byte [esi + 0x3ec], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x1c
Function at 0x48ae30
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x48ae10
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x8fc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x48b4c0
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x5eb465
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x4b4], eax
push ebp
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x4c8]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 0x30c]
lea ecx, [eax + 0x4a0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov eax, dword [ebp + 0x2e8]
mov ecx, dword [eax + 0x414]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x14]
push eax
call edx
mov ecx, eax
mov dword [esp + 0x4d0], 0
call dword [sym.imp.DuiLib32.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
xor ecx, ecx
mov word [esp + 0x9c], cx
mov ecx, eax
mov dword [esp + 0xb0], 7
mov dword [esp + 0xac], 0
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x48b0f0
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xa0]
call fcn.00401c70
lea ecx, [esp + 0x14]
mov byte [esp + 0x4d0], 2
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
xor edi, edi
mov eax, dword [ebp + 0x2e8]
mov ecx, dword [eax + 0x310]
lea edx, [esp + 0xb4]
push edx
lea edx, [ecx + edi + 0x31c]
push edx
call fcn.004a60c0
mov eax, dword [esp + 0xa4]
add esp, 8
cmp dword [esp + 0xb0], 8
jae 0x48b15d
lea eax, [esp + 0x9c]
lea ecx, [esp + 0xb4]
push ecx
push eax
call fcn.004e9ae0
add esp, 8
test eax, eax
jne 0x48b1ff
mov eax, dword [ebp + 0x2e8]
mov edx, dword [eax + 0x310]
cmp byte [edi + edx + 0x394], 0
jne 0x48b1ff
lea ecx, [esp + 0x2bc]
push ecx
lea eax, [edi + edx + 0x33a]
push eax
call fcn.004a60c0
push 0x4b4
call fcn.004ca5aa
mov esi, eax
add esp, 0xc
mov dword [esp + 0x10], esi
mov byte [esp + 0x4d0], 3
test esi, esi
je 0x48b1d0
mov ecx, esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CListLabelElementUI::constructor_void_]
mov dword [esi], vtable.DuiLib::CListLabelElementUI.0
jmp 0x48b1d2
xor esi, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 0x2bc]
push eax
mov ecx, esi
mov byte [esp + 0x4d4], 2
call edx
mov eax, dword [ebp + 0x30c]
lea ecx, [eax + 0x4a0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push esi
call edx
add edi, 0x96
cmp edi, 0x73de8
jl 0x48b121
cmp dword [esp + 0xb0], 8
jb 0x48b22b
mov eax, dword [esp + 0x9c]
push eax
call fcn.004ca5d9
add esp, 4
mov ecx, dword [esp + 0x4c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.004e8c89
add esp, 0x4c4
ret
push esi
mov esi, ecx
push str.city_list
lea ecx, [esi + 0x2c]
call dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov dword [esi + 0x30c], eax
mov ecx, esi
pop esi
jmp 0x48b050
Function at 0x48bcf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5e8459
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea edi, [esi + 0x2d8]
mov ecx, edi
mov dword [esp + 0x18], 0
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CListUI::constructor_void_]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc40], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc44], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc48], edx
mov dword [esi + 0xc4c], eax
mov dword [esi], vtable.CUIListMonth.7.0
mov dword [esi + 0x10], vtable.CUIListMonth.6.0
mov dword [esi + 0x20], vtable.CUIListMonth.5.0
mov dword [esi + 0x24], vtable.CUIListMonth.4.0
mov dword [esi + 0x28], vtable.CUIListMonth.3.0
mov dword [edi], vtable.CUIListMonth.2.0
mov dword [esi + 0x778], 0x60f97c
mov dword [esi + 0x7cc], 0x60f950
mov dword [esi + 0xc50], ecx
mov dword [esi + 0xc54], 0
xor edx, edx
mov dword [esi + 0xc70], 7
mov dword [esi + 0xc6c], 0
mov word [esi + 0xc5c], dx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14
Function at 0x48f0b2
Capabilities:
Read .ini file

Disassembly:
push ecx
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp], eax
push ebx
mov ebx, dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2c]
push str.LockDeskTop
mov ecx, edi
call ebx
push str.LockAndAlwaysTop
mov ecx, edi
mov dword [esi + 0x368], eax
call ebx
push str.UnLock
mov ecx, edi
mov dword [esi + 0x36c], eax
call ebx
mov dword [esi + 0x370], eax
call fcn.00409730
mov ecx, eax
call fcn.004a3a70
test eax, eax
je 0x48f12d
call fcn.00409730
mov ecx, eax
call fcn.004a3a70
test eax, eax
je 0x48f11b
push eax
push 0
push 0x6012c4
push 0x5ff194
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x48f11d
xor eax, eax
push 1
push eax
mov ecx, esi
mov dword [esi + 0x328], eax
call fcn.0048ea30
mov ecx, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e8c89
pop ecx
ret 4
Function at 0x4933e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, ecx
call fcn.00409730
mov ecx, eax
call fcn.004a3a60
lea edx, [esp + 0x20c]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x493410
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.004e9ba0
add esp, 0xc
lea edx, [esp + 0x20c]
push edx
push 0x104
lea eax, [esp + 0xc]
push eax
push 0x5ff1a4
push str.NickName
push str.UserData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esi + 0x3b4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 4]
push eax
call edx
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.004e8c89
add esp, 0x414
ret
push esi
mov esi, ecx
mov eax, 1
lea ecx, [esi + 0x314]
mov dword [esi + 0x3ac], eax
mov dword [esi + 0x3a8], eax
call dword [sym.imp.DuiLib32.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
mov ecx, esi
call fcn.004932e0
push str.ui_user_name
lea ecx, [esi + 0x2c]
call dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov dword [esi + 0x3b4], eax
mov ecx, esi
pop esi
jmp 0x4933e0

Function at 0x493540
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, ecx
call fcn.00409730
mov ecx, eax
call fcn.004a3a60
lea edx, [esp + 0x20c]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x493410
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.004e9ba0
add esp, 0xc
lea edx, [esp + 0x20c]
push edx
push 0x104
lea eax, [esp + 0xc]
push eax
push 0x5ff1a4
push str.NickName
push str.UserData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esi + 0x3b4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 4]
push eax
call edx
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.004e8c89
add esp, 0x414
ret
push esi
mov esi, ecx
mov eax, 1
lea ecx, [esi + 0x314]
mov dword [esi + 0x3ac], eax
mov dword [esi + 0x3a8], eax
call dword [sym.imp.DuiLib32.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
mov ecx, esi
call fcn.004932e0
push str.ui_user_name
lea ecx, [esi + 0x2c]
call dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov dword [esi + 0x3b4], eax
mov ecx, esi
pop esi
jmp 0x4933e0
Function at 0x4938f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ebe67
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
xor edi, edi
lea ecx, [esi + 0x2dc]
push edx
mov dword [esp + 0x20], edi
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.ReceiverImpl_int__struct_SkinChangedParam_.0
call fcn.004b57e0
mov dword [esi + 0x2fc], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x300], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x304], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x308], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x310], ecx
push edx
lea ecx, [esi + 0x314]
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.CUIUserInfo.5.0
mov dword [esi + 0x10], vtable.CUIUserInfo.4.0
mov dword [esi + 0x20], vtable.CUIUserInfo.3.0
mov dword [esi + 0x24], vtable.CUIUserInfo.2.0
mov dword [esi + 0x28], vtable.CUIUserInfo.1.0
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.CUIUserInfo.0
mov dword [esi + 0x30c], eax
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__]
mov eax, dword [esp + 0x38]
mov dword [esi + 0x398], eax
mov dword [esi + 0x3a4], edi
mov dword [esi + 0x3a8], edi
mov dword [esi + 0x3ac], edi
mov dword [esi + 0x3b0], 1
mov dword [esi + 0x3b4], edi
mov dword [esi + 0x3b8], edi
xor ecx, ecx
mov dword [esi + 0x3d4], 7
mov dword [esi + 0x3d0], edi
mov word [esi + 0x3c0], cx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x1c
Function at 0x497c10
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x497bf0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x648], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x499250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ec3e5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
xor ebx, ebx
lea ecx, [esi + 0x2dc]
push edx
mov dword [esp + 0x20], ebx
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.ReceiverImpl_int__struct_SkinChangedParam_.0
call fcn.004b57e0
mov dword [esi + 0x2fc], ebx
lea ecx, [esi + 0x300]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.CUIWorldCitySearch.5.0
mov dword [esi + 0x10], vtable.CUIWorldCitySearch.4.0
mov dword [esi + 0x20], vtable.CUIWorldCitySearch.3.0
mov dword [esi + 0x24], vtable.CUIWorldCitySearch.2.0
mov dword [esi + 0x28], vtable.CUIWorldCitySearch.1.0
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.CUIWorldCitySearch.0
call fcn.004b5960
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
push ecx
lea ecx, [esi + 0x348]
mov byte [esp + 0x1c], 2
mov dword [esi + 0x33c], eax
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_class_DuiLib::CDuiString_const__]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x3d8], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x3d4], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x3dc], ecx
mov dword [esi + 0x3e0], edx
mov dword [esi + 0x3e4], eax
mov dword [esi + 0x408], 7
mov dword [esi + 0x404], ebx
xor ecx, ecx
mov word [esi + 0x3f4], cx
mov dword [esi + 0x344], ebx
mov dword [esi + 0x340], ebx
mov dword [esi + 0x3cc], ebx
mov byte [esi + 0x3d0], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x1c
Function at 0x49eab0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5ecdcb
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiRect::constructor_void_]
cmp dword [esi], 0
jne 0x49eb6f
push 0x540
call fcn.004ca5aa
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov dword [esp + 0x4c], 0
test edi, edi
je 0x49eb39
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.004058e0
push eax
mov ecx, edi
call fcn.0049e510
jmp 0x49eb3b
xor eax, eax
push 0
push 0
push 0
push 0
push 0
push 0x188
push 0x90ce0000
push 0x613788
push 0
mov ecx, eax
mov dword [esp + 0x70], 0xffffffff
mov dword [esi], eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
mov ecx, dword [esi]
call fcn.00499910
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edx
cdq
sub eax, edx
sar eax, 1
sub eax, 0xc8
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
sub esp, 0x10
sub eax, 0x118
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], esp
mov eax, esp
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esi]
call fcn.0040b4e0
mov ecx, dword [esi]
call fcn.0049cf80
mov ecx, dword [esi]
mov edi, dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 5
call edi
push eax
call ebx
mov ecx, dword [esi]
call fcn.00499b80
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x4a1190
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ed0df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::WindowImplBase::constructor_void_]
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x24]
xor edi, edi
lea ecx, [esi + 0x2dc]
push edx
mov dword [esp + 0x20], edi
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.ReceiverImpl_int__struct_SkinChangedParam_.0
call fcn.004b57e0
mov dword [esi + 0x2fc], edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x304], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x300], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x308], edx
mov dword [esi + 0x30c], eax
mov dword [esi + 0x310], ecx
lea ecx, [esi + 0x314]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.CUserChangePic.5.0
mov dword [esi + 0x10], vtable.CUserChangePic.4.0
mov dword [esi + 0x20], vtable.CUserChangePic.3.0
mov dword [esi + 0x24], vtable.CUserChangePic.2.0
mov dword [esi + 0x28], vtable.CUserChangePic.1.0
mov dword [esi + method.ReceiverImpl_int__struct_SkinChangedParam_.virtual_0], vtable.CUserChangePic.0
call fcn.004b5960
mov eax, 7
xor edx, edx
mov dword [esi + 0x368], eax
mov dword [esi + 0x364], edi
mov word [esi + 0x354], dx
xor ecx, ecx
mov dword [esi + 0x798], eax
mov dword [esi + 0x794], edi
mov word [esi + 0x784], cx
mov dword [esi + 0x7b4], eax
mov dword [esi + 0x7b0], edi
mov word [esi + 0x7a0], dx
lea ecx, [esi + 0x7d0]
mov byte [esp + 0x18], 5
mov dword [esi + 0x7b8], 0xffffffff
call fcn.0041db40
push 0x104
lea eax, [esi + 0x370]
push edi
push eax
mov dword [esi + 0x7c0], edi
mov dword [esi + 0x7c4], edi
mov dword [esi + 0x7c8], edi
mov dword [esi + 0x7cc], edi
call fcn.004e9ba0
push 0x104
lea ecx, [esi + 0x578]
push edi
push ecx
call fcn.004e9ba0
add esp, 0x18
mov dword [esi + 0x7ec], edi
mov dword [esi + 0x7bc], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14