joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4565f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x456672
movd xmm1, dword [ebp + 8]
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x549064]
call fcn.0046e3e0
mov ecx, dword [esi + 4]
mov esi, dword [esi + 0x4c]
cmp dword [esi + 4], 0
je 0x456672
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x456651
test al, 8
jne 0x456651
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x456651
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x456651
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x456667
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4

Function at 0x457040
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x894]
test edi, edi
jne 0x45706c
mov ecx, dword [esi + 0x7c0]
test ecx, ecx
je 0x457064
call fcn.00435a60
mov edi, eax
test edi, edi
je 0x457195
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
sete al
cmp dword [ebp - 4], 0
je 0x4570a4
test al, al
je 0x4570a4
cmp byte [esi + 0x67f], 0
jne 0x4570a4
mov ecx, dword [esi + 4]
call fcn.004b32c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x4c], 0
jne 0x457195
push 0x28
call fcn.004e204b
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.0046e1d0
mov ecx, dword [esi + 0x890]
push dword [esi + 4]
mov dword [esi + 0x4c], eax
movss xmm2, dword [ecx + 4]
mov ecx, eax
call fcn.0046e2e0
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4570f1
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi]
mov ecx, dword [esi + 0x4c]
call fcn.0046f2f0
push dword [edi + 0x10]
mov ecx, dword [esi + 0x4c]
push dword [edi + 0xc]
call fcn.0046f3c0
mov edx, dword [edi + 4]
mov ebx, dword [esi + 0x4c]
mov eax, dword [sym.imp.USER32.dll_GetParent]
cmp edx, 0x14
ja 0x457139
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x457139
test byte [ebx + 0xc], 2
mov byte [ebx + 0xe], dl
je 0x457139
push ecx
call eax
push eax
mov ecx, ebx
call fcn.0046e730
mov eax, dword [sym.imp.USER32.dll_GetParent]
movzx edx, byte [edi + 0xb]
mov ebx, dword [esi + 0x4c]
cmp edx, 0xff
ja 0x457163
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x457163
test byte [ebx + 0xc], 2
mov byte [ebx + 0xd], dl
je 0x457163
push ecx
call eax
push eax
mov ecx, ebx
call fcn.0046e730
mov ebx, dword [esi + 0x4c]
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x457188
test byte [ebx + 0xc], 2
mov eax, dword [edi + 8]
mov dword [ebx + 0x20], eax
je 0x457188
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, ebx
call fcn.0046e730
mov ecx, dword [esi + 0x4c]
push 0
push dword [esi + 4]
call fcn.0046f470
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460dd9
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0xe98
jmp method.ui::List.1.virtual_416

Function at 0x46af70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5248dc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5640a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0x14]
mov dword [ebp - 4], 0
push 0x1388
push eax
mov dword [edi], vtable.CNetResManager.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 2
cmp dword [ebp + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
je 0x46b017
push 0x70
call fcn.004e204b
mov esi, eax
mov dword [ebp - 0x14], esi
sub esp, 0x14
mov byte [ebp - 4], 3
mov ecx, esp
push dword [ebp + 8]
call fcn.00403170
mov ecx, esi
call fcn.004bb210
mov byte [ebp - 4], 2
mov dword [edi + 0xc], eax
push 0x3c
call fcn.004e204b
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004b8ca0
mov dword [edi + 0x10], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46b450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov ebx, ecx
mov dword [ebp - 4], esi
cmp dword [edi + 0x130], esi
je 0x46b486
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x46b4ab
mov eax, dword [ecx]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14]
mov esi, eax
mov dword [ebp - 4], esi
jmp 0x46b4ab
push edi
call fcn.0046b680
test al, al
jne 0x46b4ab
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x46b4ab
mov eax, dword [ecx]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14]
mov esi, eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0xc], 0
je 0x46b507
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x46b507
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x46b507
cmp eax, 0xffffffff
je 0x46b507
mov esi, dword [ebp + 0xc]
xor edi, edi
nop dword [eax]
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov eax, dword [ebp + 8]
push esi
add eax, edi
push eax
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp + 0xc]
cmp edi, esi
jae 0x46b4f8
test eax, eax
jne 0x46b4d0
add dword [ebx + 8], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46d400
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x10
mov edi, ecx
call fcn.004e204b
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
je 0x46d44a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46d44a
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 4], 0
jne 0x46d46a
push edi
mov dword [esi + 8], fcn.0046b770
mov dword [esi + 0xc], 0x46b7c0
call fcn.0046b770
add esp, 4
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46d590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46d5bd
xor al, al
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x46d5d4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
push esi
push edi
mov eax, dword [eax + 0x100]
mov dword [ebp + 0xc], eax
call fcn.004e2524
mov ecx, dword [ebp + 0xc]
add esp, 4
xor esi, esi
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edi
nop word [eax + eax]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov eax, dword [ecx + 8]
push edi
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add esi, ecx
cmp esi, edi
jae 0x46d62f
test eax, eax
je 0x46d62f
test ecx, ecx
mov ecx, dword [ebp + 0xc]
jne 0x46d600
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x46f470
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x46f4d8
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x46f4b7
test al, 8
jne 0x46f4b7
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
jne 0x46f4a3
cmp byte [ebp + 0xc], 0
je 0x46f4b7
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x46f4b7
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x46f4cd
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x472720
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x47272b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4727e7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
sub edi, 1
jne 0x472740
pop edi
test esi, esi
je 0x47280a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab20]
sub esi, 1
jne 0x4727f0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x472fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x473013
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x473005
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x473024
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.004fafb0
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x47308b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x473086
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x4730b8
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x47309c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.004fafb0
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x4730cc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x4730c3
cmp byte [esi + 8], 0
je 0x4730c3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474310
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x4743a8
cmp dword [esi + 4], 0xffffffff
jne 0x4743a8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x474340
cmp dword [ebp + 0x10], 1
mov eax, dword [0x53ca00]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x474373
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x474373
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00472e80
add esp, 8
test eax, eax
jne 0x474394
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.004733a0
mov dword [esi], eax
mov eax, dword [0x56e980]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x48dd00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xe74], 0
je 0x48dda2
cmp dword [ebp + 8], 0x100
jne 0x48dd81
cmp word [ebp + 0xc], 0xd
jne 0x48dd81
cmp byte [esi + 0xf08], 0
jne 0x48dd46
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x48dd81
cmp byte [esi + 0xf09], 0
je 0x48dd81
mov ecx, dword [esi + 0x188]
test ecx, ecx
je 0x48dd78
push esi
call fcn.0043de40
push ecx
mov ecx, dword [esi + 0x188]
push 0
push 0
push str.editreturn
push esi
call fcn.0043b0b0
push str.editreturn
mov ecx, esi
call fcn.00444cd0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0xe74]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4945b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
push edi
push 0xffffffffffffffff
mov dword [ebx + 0x50], eax
lea ecx, [ebx + 0x58]
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x54], eax
mov eax, dword [ebp + 8]
push 0x53cb08
mov dword [ebx + 0x930], eax
mov dword [ebx + 0x934], 0
call fcn.004526d0
lea eax, [ebx + 0x30]
mov dword [ebp + 8], eax
test eax, eax
je 0x494623
lea eax, [ebp + 8]
mov ecx, 0x565274
push eax
call fcn.00406f80
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov eax, dword [eax]
cmp eax, method.ReceiverImpl_int__struct_ui::ContextMenuParam_.virtual_0
jne 0x49469f
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x565270
push eax
add ecx, 4
call fcn.00406f80
mov ecx, dword [ebx + 0x930]
test ecx, ecx
jne 0x494632
mov eax, dword [ebx + 0x4c]
jmp 0x494644
mov eax, dword [ecx]
cmp eax, vtable.ui::MenuElement.2.0
jne 0x4946ab
mov eax, dword [ecx + 0x188]
mov eax, dword [eax + 8]
push ecx
push 0
push 0
push 0
push 0
push 0x88
push SysReAllocString
push 0
push eax
mov ecx, ebx
call fcn.00451730
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
test eax, eax
je 0x49467d
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x494671
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push 0x565270
call eax
jmp 0x494623
call dword [eax + 0x1c]
jmp 0x494641

Function at 0x495410
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, ecx
push edi
mov dword [eax], 0
mov eax, dword [esi + 0x93c]
test eax, eax
je 0x49543e
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x49543e
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x930]
test ecx, ecx
je 0x4954d5
mov eax, dword [ecx]
cmp eax, vtable.ui::MenuElement.2.0
jne 0x4954dd
mov edi, dword [ecx + 0x190]
mov edx, dword [esi + 0x930]
mov ecx, dword [edx]
mov eax, dword [ecx + 0x1c]
cmp ecx, vtable.ui::MenuElement.2.0
jne 0x4954e7
mov eax, dword [edx + 0x188]
mov ecx, dword [esi + 0x930]
push 0
push edi
push eax
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esi + 0x930]
mov eax, dword [ecx]
mov edx, dword [eax + 0x4c]
cmp eax, vtable.ui::MenuElement.2.0
jne 0x4954ed
lea eax, [ecx + 0x2a8]
mov ecx, dword [eax]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [esi + 0x930]
mov eax, dword [ecx]
call dword [eax + 0x50]
mov ecx, dword [esi + 0x930]
push 1
mov eax, dword [ecx]
call dword [eax + 0x15c]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [eax + 0x24]
mov edi, eax
jmp 0x49545f
mov ecx, edx
call eax
jmp 0x495478
call edx
jmp 0x49549f
Function at 0x4957b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x93c], 0
jne 0x495988
push 0x28
call fcn.004e204b
movss xmm2, dword [0x548f5c]
add esp, 4
mov ecx, eax
mov dword [ebp - 4], eax
mov dword [eax], vtable.CWndShadow.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov word [eax + 0xd], 0x864
mov byte [eax + 0xf], 0
mov word [eax + 0x11], 0x505
mov dword [eax + 0x18], 0
mov byte [eax + 0x1c], 0
mov dword [eax + 0x20], 0x505050
mov dword [eax + 0x24], 0x3f800000
push dword [esi + 4]
mov dword [esi + 0x93c], eax
call fcn.0046e2e0
mov eax, dword [esi + 0x93c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x495842
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 0x93c]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x49587e
test byte [edi + 0xc], 2
movss xmm0, dword [edi + 0x24]
mulss xmm0, dword [0x549038]
mov byte [edi + 0x10], 8
cvttss2si eax, xmm0
mov byte [edi + 0xf], al
je 0x49587e
push ecx
call ebx
push eax
mov ecx, edi
call fcn.0046e730
mov edi, dword [esi + 0x93c]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4958b9
test byte [edi + 0xc], 2
movss xmm0, dword [edi + 0x24]
mulss xmm0, dword [0x548fa0]
mov word [edi + 0x13], 0x202
cvttss2si eax, xmm0
mov byte [edi + 0x11], al
mov byte [edi + 0x12], al
je 0x4958b9
push ecx
call ebx
push eax
mov ecx, edi
call fcn.0046e730
mov edi, dword [esi + 0x93c]
mov eax, dword [edi + 4]
test eax, eax
je 0x4958db
test byte [edi + 0xc], 2
mov byte [edi + 0xe], 0xd
je 0x4958db
push eax
call ebx
push eax
mov ecx, edi
call fcn.0046e730
mov edi, dword [esi + 0x93c]
mov eax, dword [edi + 4]
test eax, eax
je 0x4958fd
test byte [edi + 0xc], 2
mov byte [edi + 0xd], 0x64
je 0x4958fd
push eax
call ebx
push eax
mov ecx, edi
call fcn.0046e730
mov edi, dword [esi + 0x93c]
mov eax, dword [edi + 4]
test eax, eax
je 0x495922
test byte [edi + 0xc], 2
mov dword [edi + 0x20], 0x505050
je 0x495922
push eax
call ebx
push eax
mov ecx, edi
call fcn.0046e730
mov edi, dword [esi + 0x93c]
mov ecx, dword [esi + 4]
cmp dword [edi + 4], 0
je 0x49597a
and byte [edi + 0xc], 9
mov al, byte [edi + 0xc]
test al, 1
je 0x495964
test al, 8
jne 0x495964
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x495964
or byte [edi + 0xc], 4
mov cl, byte [edi + 0xc]
test eax, 0x21000000
jne 0x495964
or cl, 2
mov byte [edi + 0xc], cl
test byte [edi + 0xc], 2
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
je 0x495973
push 8
jmp 0x495975
push 0
push dword [edi + 4]
call eax
push dword [esi + 4]
mov ecx, dword [esi + 0x93c]
call fcn.0046e730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x496b57
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0xe98
jmp method.ui::Menu.2.virtual_416
Function at 0x497c00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525292
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5640a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x7f8]
test eax, eax
je 0x497de2
cmp dword [eax + 0xe74], 0
je 0x497de2
mov ecx, dword [edi + 0x810]
test ecx, ecx
jne 0x497cae
push 0x88
call fcn.004e204b
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00461e70
mov dword [esi], vtable.ui::CTimeLineTween.0
mov eax, 1
mov dword [esi + 0x78], 0x564a8c
mov ecx, esi
mov dword [esi + 0x80], 0
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x810], esi
push 5
mov dword [esi + 0x80], 0x43960000
mov word [esi + 0x7c], ax
call fcn.0046ad50
jmp 0x497cdb
mov eax, dword [ecx]
push 0
call dword [eax + 0x18]
mov ecx, dword [edi + 0x810]
mov eax, dword [ecx]
cmp eax, vtable.ui::CTimeLineTween.0
jne 0x497cd8
mov byte [ecx + 0x3f], 0
mov dword [ecx + 0x38], 0x3f800000
mov dword [ecx + 0x30], 0
jmp 0x497cdb
call dword [eax + 0xc]
sub esp, 0x90
xor edx, edx
mov ecx, esp
lea eax, [ecx + 8]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0x437f0000
push 0xffffffffffffffff
mov dword [ecx], vtable.ui::CDuiString.0
mov dword [ecx + 4], eax
push 0x544edc
mov word [eax], dx
call fcn.004526d0
mov ecx, dword [edi + 0x810]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [edi + 0x7f8]
mov ecx, dword [eax + 0xe74]
mov eax, dword [ecx]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x10], eax
cmp eax, method.ui::Control.virtual_124
jne 0x497d57
mov eax, dword [ecx + 0x188]
movss xmm0, dword [ecx + 0x2e4]
mov eax, dword [eax + 0x728]
mulss xmm0, dword [eax + 4]
jmp 0x497d62
call dword [ebp - 0x10]
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
cvttss2si eax, xmm0
sub esp, 0x90
xor edx, edx
mov ecx, esp
mov dword [esp + 0x8c], 0x3f800000
mov dword [ecx], vtable.ui::CDuiString.0
movd xmm0, eax
lea eax, [ecx + 8]
cvtdq2ps xmm0, xmm0
mov dword [ecx + 4], eax
mov word [eax], dx
movss dword [esp + 0x88], xmm0
push 0xffffffffffffffff
push 0x53ed1c
call fcn.004526d0
mov ecx, dword [edi + 0x810]
mov eax, dword [ecx]
call dword [eax + 0x1c]
sub esp, 0x28
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_class__lambda_d027816fb4eadc9c5aa345bc6daa746a___class_std::allocator_int___bool__class_ui::CTimeLine__.0
mov dword [eax + 4], edi
mov dword [eax + 0x24], eax
lea eax, [edi + 0x30]
mov ecx, dword [edi + 0x810]
push eax
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x497dfa
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4995b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
test al, al
je 0x4995e2
push dword [esi + 8]
mov ecx, dword [esi + 4]
call fcn.00498420
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xe70]
test ecx, ecx
je 0x4995e2
pop esi
jmp fcn.00497190
pop esi
ret