joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x456382
movd xmm1, dword [ebp + 8]
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x549034]
call fcn.0046e0e0
mov ecx, dword [esi + 4]
mov esi, dword [esi + 0x4c]
cmp dword [esi + 4], 0
je 0x456382
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x456361
test al, 8
jne 0x456361
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x456361
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x456361
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x456377
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4

Function at 0x456d50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x894]
test edi, edi
jne 0x456d7c
mov ecx, dword [esi + 0x7c0]
test ecx, ecx
je 0x456d74
call fcn.004357b0
mov edi, eax
test edi, edi
je 0x456ea5
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
sete al
cmp dword [ebp - 4], 0
je 0x456db4
test al, al
je 0x456db4
cmp byte [esi + 0x67f], 0
jne 0x456db4
mov ecx, dword [esi + 4]
call fcn.004b30b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x4c], 0
jne 0x456ea5
push 0x28
call fcn.004e1dfa
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.0046ded0
mov ecx, dword [esi + 0x890]
push dword [esi + 4]
mov dword [esi + 0x4c], eax
movss xmm2, dword [ecx + 4]
mov ecx, eax
call fcn.0046dfe0
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x456e01
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi]
mov ecx, dword [esi + 0x4c]
call fcn.0046eff0
push dword [edi + 0x10]
mov ecx, dword [esi + 0x4c]
push dword [edi + 0xc]
call fcn.0046f0c0
mov edx, dword [edi + 4]
mov ebx, dword [esi + 0x4c]
mov eax, dword [sym.imp.USER32.dll_GetParent]
cmp edx, 0x14
ja 0x456e49
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x456e49
test byte [ebx + 0xc], 2
mov byte [ebx + 0xe], dl
je 0x456e49
push ecx
call eax
push eax
mov ecx, ebx
call fcn.0046e430
mov eax, dword [sym.imp.USER32.dll_GetParent]
movzx edx, byte [edi + 0xb]
mov ebx, dword [esi + 0x4c]
cmp edx, 0xff
ja 0x456e73
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x456e73
test byte [ebx + 0xc], 2
mov byte [ebx + 0xd], dl
je 0x456e73
push ecx
call eax
push eax
mov ecx, ebx
call fcn.0046e430
mov ebx, dword [esi + 0x4c]
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x456e98
test byte [ebx + 0xc], 2
mov eax, dword [edi + 8]
mov dword [ebx + 0x20], eax
je 0x456e98
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, ebx
call fcn.0046e430
mov ecx, dword [esi + 0x4c]
push 0
push dword [esi + 4]
call fcn.0046f170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ac70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52467c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5640a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0x14]
mov dword [ebp - 4], 0
push 0x1388
push eax
mov dword [edi], vtable.CNetResManager.0
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 2
cmp dword [ebp + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
je 0x46ad17
push 0x70
call fcn.004e1dfa
mov esi, eax
mov dword [ebp - 0x14], esi
sub esp, 0x14
mov byte [ebp - 4], 3
mov ecx, esp
push dword [ebp + 8]
call fcn.00403170
mov ecx, esi
call fcn.004bafe0
mov byte [ebp - 4], 2
mov dword [edi + 0xc], eax
push 0x3c
call fcn.004e1dfa
add esp, 4
mov dword [ebp + 8], eax
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004b8a70
mov dword [edi + 0x10], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x46b150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov ebx, ecx
mov dword [ebp - 4], esi
cmp dword [edi + 0x130], esi
je 0x46b186
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x46b1ab
mov eax, dword [ecx]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14]
mov esi, eax
mov dword [ebp - 4], esi
jmp 0x46b1ab
push edi
call fcn.0046b380
test al, al
jne 0x46b1ab
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x46b1ab
mov eax, dword [ecx]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14]
mov esi, eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0xc], 0
je 0x46b207
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x46b207
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x46b207
cmp eax, 0xffffffff
je 0x46b207
mov esi, dword [ebp + 0xc]
xor edi, edi
nop dword [eax]
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov eax, dword [ebp + 8]
push esi
add eax, edi
push eax
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
add edi, dword [ebp + 0xc]
cmp edi, esi
jae 0x46b1f8
test eax, eax
jne 0x46b1d0
add dword [ebx + 8], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46d100
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x10
mov edi, ecx
call fcn.004e1dfa
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
je 0x46d14a
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46d14a
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [esi + 4], 0
jne 0x46d16a
push edi
mov dword [esi + 8], fcn.0046b470
mov dword [esi + 0xc], 0x46b4c0
call fcn.0046b470
add esp, 4
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46d290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46d2bd
xor al, al
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x46d2d4
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor al, al
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
push esi
push edi
mov eax, dword [eax + 0x100]
mov dword [ebp + 0xc], eax
call fcn.004e22d3
mov ecx, dword [ebp + 0xc]
add esp, 4
xor esi, esi
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edi
nop word [eax + eax]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov eax, dword [ecx + 8]
push edi
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ecx, dword [ebp + 8]
add esi, ecx
cmp esi, edi
jae 0x46d32f
test eax, eax
je 0x46d32f
test ecx, ecx
mov ecx, dword [ebp + 0xc]
jne 0x46d300
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop edi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x46f170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x46f1d8
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x46f1b7
test al, 8
jne 0x46f1b7
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
jne 0x46f1a3
cmp byte [ebp + 0xc], 0
je 0x46f1b7
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x46f1b7
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x46f1cd
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x472420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x47242b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4724e7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
sub edi, 1
jne 0x472440
pop edi
test esi, esi
je 0x47250a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x53ab30]
sub esi, 1
jne 0x4724f0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x472cd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x472d13
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x472d05
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x472d24
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.004fad50
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x472d8b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x472d86
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x472db8
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x472d9c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.004fad50
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x472dcc
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x472dc3
cmp byte [esi + 8], 0
je 0x472dc3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x474010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x4740a8
cmp dword [esi + 4], 0xffffffff
jne 0x4740a8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x474040
cmp dword [ebp + 0x10], 1
mov eax, dword [0x53ca10]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x474073
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x474073
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.00472b80
add esp, 8
test eax, eax
jne 0x474094
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.004730a0
mov dword [esi], eax
mov eax, dword [0x56e8a4]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x48da20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xe74], 0
je 0x48dac2
cmp dword [ebp + 8], 0x100
jne 0x48daa1
cmp word [ebp + 0xc], 0xd
jne 0x48daa1
cmp byte [esi + 0xf08], 0
jne 0x48da66
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x48daa1
cmp byte [esi + 0xf09], 0
je 0x48daa1
mov ecx, dword [esi + 0x188]
test ecx, ecx
je 0x48da98
push esi
call fcn.0043db60
push ecx
mov ecx, dword [esi + 0x188]
push 0
push 0
push str.editreturn
push esi
call fcn.0043add0
push str.editreturn
mov ecx, esi
call fcn.004449f0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0xe74]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x492cb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp method.ui::List.1.virtual_416

Function at 0x4942e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
push edi
push 0xffffffffffffffff
mov dword [ebx + 0x50], eax
lea ecx, [ebx + 0x58]
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x54], eax
mov eax, dword [ebp + 8]
push 0x53cb10
mov dword [ebx + 0x930], eax
mov dword [ebx + 0x934], 0
call fcn.004523e0
lea eax, [ebx + 0x30]
mov dword [ebp + 8], eax
test eax, eax
je 0x494353
lea eax, [ebp + 8]
mov ecx, 0x565274
push eax
call fcn.00406f80
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov eax, dword [eax]
cmp eax, method.ui::CMenuWnd.virtual_0
jne 0x4943cf
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x565270
push eax
add ecx, 4
call fcn.00406f80
mov ecx, dword [ebx + 0x930]
test ecx, ecx
jne 0x494362
mov eax, dword [ebx + 0x4c]
jmp 0x494374
mov eax, dword [ecx]
cmp eax, vtable.ui::MenuElement.1.0
jne 0x4943db
mov eax, dword [ecx + 0x188]
mov eax, dword [eax + 8]
push ecx
push 0
push 0
push 0
push 0
push 0x88
push Ordinal_1
push 0
push eax
mov ecx, ebx
call fcn.00451440
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
test eax, eax
je 0x4943ad
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x4943a1
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push 0x565270
call eax
jmp 0x494353
call dword [eax + 0x1c]
jmp 0x494371

Function at 0x495140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, ecx
push edi
mov dword [eax], 0
mov eax, dword [esi + 0x93c]
test eax, eax
je 0x49516e
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x49516e
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x930]
test ecx, ecx
je 0x495205
mov eax, dword [ecx]
cmp eax, vtable.ui::MenuElement.1.0
jne 0x49520d
mov edi, dword [ecx + 0x190]
mov edx, dword [esi + 0x930]
mov ecx, dword [edx]
mov eax, dword [ecx + 0x1c]
cmp ecx, vtable.ui::MenuElement.1.0
jne 0x495217
mov eax, dword [edx + 0x188]
mov ecx, dword [esi + 0x930]
push 0
push edi
push eax
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [esi + 0x930]
mov eax, dword [ecx]
mov edx, dword [eax + 0x4c]
cmp eax, vtable.ui::MenuElement.1.0
jne 0x49521d
lea eax, [ecx + 0x2a8]
mov ecx, dword [eax]
sub esp, 0x10
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [esi + 0x930]
mov eax, dword [ecx]
call dword [eax + 0x50]
mov ecx, dword [esi + 0x930]
push 1
mov eax, dword [ecx]
call dword [eax + 0x15c]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
call dword [eax + 0x24]
mov edi, eax
jmp 0x49518f
mov ecx, edx
call eax
jmp 0x4951a8
call edx
jmp 0x4951cf
Function at 0x4954e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x93c], 0
jne 0x4956b8
push 0x28
call fcn.004e1dfa
movss xmm2, dword [0x548f2c]
add esp, 4
mov ecx, eax
mov dword [ebp - 4], eax
mov dword [eax], vtable.CWndShadow.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov word [eax + 0xd], 0x864
mov byte [eax + 0xf], 0
mov word [eax + 0x11], 0x505
mov dword [eax + 0x18], 0
mov byte [eax + 0x1c], 0
mov dword [eax + 0x20], 0x505050
mov dword [eax + 0x24], 0x3f800000
push dword [esi + 4]
mov dword [esi + 0x93c], eax
call fcn.0046dfe0
mov eax, dword [esi + 0x93c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x495572
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 0x93c]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4955ae
test byte [edi + 0xc], 2
movss xmm0, dword [edi + 0x24]
mulss xmm0, dword [0x549008]
mov byte [edi + 0x10], 8
cvttss2si eax, xmm0
mov byte [edi + 0xf], al
je 0x4955ae
push ecx
call ebx
push eax
mov ecx, edi
call fcn.0046e430
mov edi, dword [esi + 0x93c]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4955e9
test byte [edi + 0xc], 2
movss xmm0, dword [edi + 0x24]
mulss xmm0, dword [0x548f70]
mov word [edi + 0x13], 0x202
cvttss2si eax, xmm0
mov byte [edi + 0x11], al
mov byte [edi + 0x12], al
je 0x4955e9
push ecx
call ebx
push eax
mov ecx, edi
call fcn.0046e430
mov edi, dword [esi + 0x93c]
mov eax, dword [edi + 4]
test eax, eax
je 0x49560b
test byte [edi + 0xc], 2
mov byte [edi + 0xe], 0xd
je 0x49560b
push eax
call ebx
push eax
mov ecx, edi
call fcn.0046e430
mov edi, dword [esi + 0x93c]
mov eax, dword [edi + 4]
test eax, eax
je 0x49562d
test byte [edi + 0xc], 2
mov byte [edi + 0xd], 0x64
je 0x49562d
push eax
call ebx
push eax
mov ecx, edi
call fcn.0046e430
mov edi, dword [esi + 0x93c]
mov eax, dword [edi + 4]
test eax, eax
je 0x495652
test byte [edi + 0xc], 2
mov dword [edi + 0x20], 0x505050
je 0x495652
push eax
call ebx
push eax
mov ecx, edi
call fcn.0046e430
mov edi, dword [esi + 0x93c]
mov ecx, dword [esi + 4]
cmp dword [edi + 4], 0
je 0x4956aa
and byte [edi + 0xc], 9
mov al, byte [edi + 0xc]
test al, 1
je 0x495694
test al, 8
jne 0x495694
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x495694
or byte [edi + 0xc], 4
mov cl, byte [edi + 0xc]
test eax, 0x21000000
jne 0x495694
or cl, 2
mov byte [edi + 0xc], cl
test byte [edi + 0xc], 2
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4956a3
push 8
jmp 0x4956a5
push 0
push dword [edi + 4]
call eax
push dword [esi + 4]
mov ecx, dword [esi + 0x93c]
call fcn.0046e430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525032
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5640a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x7f8]
test eax, eax
je 0x497b22
cmp dword [eax + 0xe74], 0
je 0x497b22
mov ecx, dword [edi + 0x810]
test ecx, ecx
jne 0x4979ee
push 0x88
call fcn.004e1dfa
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00461b80
mov dword [esi], vtable.ui::CTimeLineTween.0
mov eax, 1
mov dword [esi + 0x78], 0x564a8c
mov ecx, esi
mov dword [esi + 0x80], 0
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x810], esi
push 5
mov dword [esi + 0x80], 0x43960000
mov word [esi + 0x7c], ax
call fcn.0046aa50
jmp 0x497a1b
mov eax, dword [ecx]
push 0
call dword [eax + 0x18]
mov ecx, dword [edi + 0x810]
mov eax, dword [ecx]
cmp eax, vtable.ui::CTimeLineTween.0
jne 0x497a18
mov byte [ecx + 0x3f], 0
mov dword [ecx + 0x38], 0x3f800000
mov dword [ecx + 0x30], 0
jmp 0x497a1b
call dword [eax + 0xc]
sub esp, 0x90
xor edx, edx
mov ecx, esp
lea eax, [ecx + 8]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0x437f0000
push 0xffffffffffffffff
mov dword [ecx], vtable.ui::CDuiString.0
mov dword [ecx + 4], eax
push 0x544ed0
mov word [eax], dx
call fcn.004523e0
mov ecx, dword [edi + 0x810]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [edi + 0x7f8]
mov ecx, dword [eax + 0xe74]
mov eax, dword [ecx]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x10], eax
cmp eax, method.ui::Control.virtual_124
jne 0x497a97
mov eax, dword [ecx + 0x188]
movss xmm0, dword [ecx + 0x2e4]
mov eax, dword [eax + 0x728]
mulss xmm0, dword [eax + 4]
jmp 0x497aa2
call dword [ebp - 0x10]
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
cvttss2si eax, xmm0
sub esp, 0x90
xor edx, edx
mov ecx, esp
mov dword [esp + 0x8c], 0x3f800000
mov dword [ecx], vtable.ui::CDuiString.0
movd xmm0, eax
lea eax, [ecx + 8]
cvtdq2ps xmm0, xmm0
mov dword [ecx + 4], eax
mov word [eax], dx
movss dword [esp + 0x88], xmm0
push 0xffffffffffffffff
push 0x53ecec
call fcn.004523e0
mov ecx, dword [edi + 0x810]
mov eax, dword [ecx]
call dword [eax + 0x1c]
sub esp, 0x28
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_class__lambda_d027816fb4eadc9c5aa345bc6daa746a___class_std::allocator_int___bool__class_ui::CTimeLine__.0
mov dword [eax + 4], edi
mov dword [eax + 0x24], eax
lea eax, [edi + 0x30]
mov ecx, dword [edi + 0x810]
push eax
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x497b3a
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497dc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00496ed0
push dword [esi + 0x7f8]
mov ecx, esi
call fcn.004969c0
mov ecx, dword [esi + 0x808]
mov byte [esi + 0x805], 1
test ecx, ecx
je 0x497e61
movd xmm1, dword [ebp + 8]
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x549034]
call fcn.0046e0e0
mov ecx, dword [esi + 4]
mov esi, dword [esi + 0x808]
cmp dword [esi + 4], 0
je 0x497e61
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x497e40
test al, 8
jne 0x497e40
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x497e40
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x497e40
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x497e56
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4

Function at 0x4993a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
test al, al
je 0x4993d2
push dword [esi + 8]
mov ecx, dword [esi + 4]
call fcn.00498210
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xe70]
test ecx, ecx
je 0x4993d2
pop esi
jmp fcn.00496ed0
pop esi
ret