joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef90
Capabilities:
Get local ipv4 addresses
Get socket information
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x486450
push 0x459ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4a4300]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x244], esi
xor eax, eax
mov word [ebp - 0x230], ax
xorps xmm0, xmm0
movq qword [ebp - 0x22e], xmm0
mov dword [ebp - 0x226], eax
mov word [ebp - 0x222], ax
mov word [ebp - 0x240], ax
movq qword [ebp - 0x23e], xmm0
mov dword [ebp - 0x236], eax
mov word [ebp - 0x232], ax
mov dword [ebp - 0x220], 0x10
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
neg eax
sbb eax, eax
inc eax
je 0x40f1c4
mov dword [ebp - 0x220], 0x10
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x240]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
neg eax
sbb eax, eax
inc eax
je 0x40f1c4
mov byte [ebp - 0x21c], 0
push 0x1ff
push 0
lea eax, [ebp - 0x21b]
push eax
call fcn.004523e0
add esp, 0xc
push 0
push esi
push dword [ebp - 0x22e]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
call ebx
movzx eax, ax
push eax
movzx eax, byte [ebp - 0x229]
push eax
movzx eax, byte [ebp - 0x22a]
push eax
movzx eax, byte [ebp - 0x22b]
push eax
movzx eax, byte [ebp - 0x22c]
push eax
push 0x4836d4
lea eax, [ebp - 0x21c]
push eax
call fcn.0045752f
add esp, 0x24
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x21c]
push eax
call fcn.00458229
add esp, 4
mov edi, dword [0x4ab868]
test edi, edi
jle 0x40f0f6
cmp edi, 0x1f4
jle 0x40f0fb
mov edi, 0x1f4
push 0x6b20ac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, edi
jg 0x40f13d
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040ee30
mov dword [ebp - 4], 0xfffffffe
jmp 0x40f13d
push 0x6b20ac
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [ebp - 0x21c], 0
push 0x1ff
push 0
lea eax, [ebp - 0x21b]
push eax
call fcn.004523e0
add esp, 0xc
push 0
push esi
push dword [ebp - 0x22e]
call ebx
movzx eax, ax
push eax
movzx eax, byte [ebp - 0x229]
push eax
movzx eax, byte [ebp - 0x22a]
push eax
movzx eax, byte [ebp - 0x22b]
push eax
movzx eax, byte [ebp - 0x22c]
push eax
push str._DEBUG__
lea eax, [ebp - 0x21c]
push eax
call fcn.0045752f
add esp, 0x24
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x21c]
push eax
call fcn.00458229
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40f270
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 8]
push 4
push eax
push 1
mov esi, ecx
mov dword [ebp - 8], 1
push 6
push esi
call edi
test eax, eax
je 0x40f2b4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0xffffff7f
push 0xffff
push esi
call edi
test eax, eax
jne 0x40f2a2
push ecx
mov ecx, esi
call fcn.0040aad0
add esp, 4
test eax, eax
je 0x40f2a2
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x40f2a2
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2000
push eax
push 0x1002
push 0xffff
push esi
call edi
test eax, eax
jne 0x40f2a2
mov edx, 0x2000
mov ecx, esi
call fcn.0040ab80
test eax, eax
je 0x40f2a2
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push esi
push 0x40f1e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40f356
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 8], eax
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40f520
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push edx
mov esi, ecx
call dword [sym.imp.WS2_32.dll_htons]
movzx edi, ax
test di, di
je 0x40f684
push 0
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, eax
test esi, esi
je 0x40f574
mov ecx, esi
lea edx, [ecx + 1]
jmp 0x40f560
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f560
sub ecx, edx
je 0x40f574
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, eax
cmp bl, 0x7f
jne 0x40f684
mov eax, 0x6b20c4
xor ecx, ecx
cmp dword [eax + 4], ebx
jne 0x40f58e
cmp word [eax], di
je 0x40f5c8
add ecx, 0xc
add eax, 0xc
cmp ecx, 0x5dc0
jb 0x40f584
mov esi, 0x6b20c0
xor eax, eax
cmp dword [esi], 0
je 0x40f5de
add eax, 0xc
add esi, 0xc
cmp eax, 0x5dc0
jb 0x40f5a3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov edx, edi
mov word [esi + 4], di
mov ecx, ebx
mov dword [esi + 8], ebx
call fcn.0040abc0
mov edi, eax
test edi, edi
jne 0x40f607
mov dword [esi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x10]
push 4
push eax
push 0x1002
push 0xffff
push edi
mov dword [ebp - 0x10], 0x2000
call ebx
test eax, eax
jne 0x40f671
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x2000
push eax
push 0x1001
push 0xffff
push edi
call ebx
test eax, eax
jne 0x40f671
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0xffff
push edi
call ebx
test eax, eax
jne 0x40f671
push 0x1e
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x40f67a
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
xor edi, edi
mov dword [esi], edi
test edi, edi
jne 0x40f5c8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x40fbb0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6b7eb4], 0
jne 0x40fc72
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x198], ax
lea eax, [ebp - 0x196]
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40fc72
call fcn.0040fd80
cmp dword [0x6b20bc], 0
mov dword [0x6b7eb8], eax
mov dword [0x6b7ebc], edx
jne 0x40fc46
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0x40f490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 8], 0
mov dword [0x6b20bc], eax
je 0x40fc72
cmp dword [0x6b7eb4], 0
jne 0x40fc72
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0x40fb20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6b7eb4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x41516a
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0xffffffffffffffec
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor eax, 0x80
push eax
push 0xffffffffffffffec
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor edi, edi
lea eax, [ebp - 0x14]
push edi
push eax
push edi
xorps xmm0, xmm0
push 0x30
movdqu xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push 0x96
sub eax, 0xa0
push 0x1c2
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
sub eax, 0x1cc
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
mov ecx, esi
call sym.STSGameSDK.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x4157e6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 4
push 0x4731c4
push 0x4731d0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x41582c
mov eax, dword [0x4a6508]
test eax, eax
je 0x41581b
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
and dword [0x4a6508], 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_CloseWindow]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebp
ret 4
Function at 0x415df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x4735b0
push 0xa8
xor edi, edi
mov dword [ebp - 0x8c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x415e2e
xor eax, eax
jmp 0x415ed0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x90], eax
push esi
test eax, eax
jne 0x415e49
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x415e27
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, 1
jae 0x415e5a
push esi
jmp 0x415e41
push ebx
push edi
call fcn.00452c03
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x415e73
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x415ecf
push edi
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call fcn.00451d90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp - 0x8c]
call sym.STSGameSDK.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetInstance_struct_HINSTANCE____
lea eax, [ebp - 0x88]
push eax
call sym.STSGameSDK.exe_public:_static_class_DuiLib::CDuiString___cdecl_DuiLib::CPaintManagerUI::GetInstancePath_void_
pop ecx
pop ecx
mov ecx, eax
call sym.STSGameSDK.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
call sym.STSGameSDK.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetCurrentPath_wchar_t_const__
pop ecx
lea ecx, [ebp - 0x88]
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
push edi
push ebx
call sym.STSGameSDK.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceZip_void___unsigned_int_
pop ecx
xor eax, eax
pop ecx
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x419bf1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x41a686
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x41a6a9
or esi, 1
push 1
call edi
test ax, ax
jns 0x41a6b5
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x41a6c1
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x41a6cd
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x41bd1b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x1c4]
call sym.STSGameSDK.exe_public_virtual:_int___thiscall_DuiLib::CListContainerElementUI::GetIndex_void_const
mov edi, dword [ebp + 8]
test eax, eax
jle 0x41bd71
push ebx
lea ecx, [esi + 0x1c4]
mov byte [ebp + 0xb], 0
call sym.STSGameSDK.exe_public:_void____thiscall_DuiLib::CStdPtrArray::operator___int_const
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x41bdcf
lea ecx, [esi + 0x1c4]
inc ebx
call sym.STSGameSDK.exe_public_virtual:_int___thiscall_DuiLib::CListContainerElementUI::GetIndex_void_const
cmp ebx, eax
jl 0x41bd3a
sub edi, 0x100
je 0x41be35
sub edi, 4
je 0x41bdd3
dec edi
dec edi
jne 0x41be2a
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.00454720
pop ecx
mov ecx, dword [esi + 0x144]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_ioctlsocket
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push sym.STSGameSDK.exe_private:_static_class_DuiLib::CControlUI____stdcall_DuiLib::CPaintManagerUI::__FindControlFromShortcut_class_DuiLib::CControlUI___void__
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x41be2a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x41be2c
cmp dword [esi + 0x148], 0
je 0x41be2a
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x158]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x15c]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.0041a686
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x41be2a
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x41be8e
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41be8e
mov ecx, dword [esi + 0x148]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x41be8e
mov ecx, dword [esi + 0x148]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004534e6
pop ecx
pop ecx
test eax, eax
je 0x41be8e
mov ecx, dword [esi + 0x148]
call sym.STSGameSDK.exe_public:_bool___thiscall_DuiLib::CRichEditUI::IsWantTab_void_
test al, al
jne 0x41be2a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call sym.STSGameSDK.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::SetNextTabControl_bool_
jmp 0x41bdcf
Function at 0x41c9c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx]
je 0x41c9e7
cmp esi, dword [ebx + 0x148]
je 0x41c9e7
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0x148]
cmp esi, eax
je 0x41cabe
push edi
test eax, eax
je 0x41ca46
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x148]
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov dword [ebx + 0x148], edi
test esi, esi
je 0x41cabd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x41cabd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x41cabd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x41cabd
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x148], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x148]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x148]
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41e204
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e236
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x4240e0
Capabilities:
Terminate process

Disassembly:
push 0x1e4
mov eax, 0x46e029
call fcn.00452d53
mov edi, ecx
push 0xfffffffffffffff0
call sym.STSGameSDK.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
mov ecx, edi
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
call sym.STSGameSDK.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call sym.STSGameSDK.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x14]
mov ecx, edi
sub eax, dword [ebp - 0x1c]
push 0x20
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
call sym.STSGameSDK.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [edi + 8]
lea ebx, [edi + 0x30]
mov ecx, ebx
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::Init_struct_HWND____
lea eax, [edi + 0x28]
mov ecx, ebx
push eax
call sym.STSGameSDK.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::AddPreMessageFilter_class_DuiLib::IMessageFilterUI__
lea ecx, [ebp - 0x1ec]
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CDialogBuilder::constructor_void_
mov eax, dword [edi]
lea ecx, [ebp - 0xa4]
and dword [ebp - 4], 0
lea esi, [edi + 0x2c]
push ecx
mov ecx, edi
call dword [eax + 0x24]
push 0
push ebx
push esi
push 0
mov ecx, eax
mov byte [ebp - 4], 1
call sym.STSGameSDK.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp - 0x1ec]
call sym.STSGameSDK.exe_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CDialogBuilder::Create_class_DuiLib::STRINGorID__wchar_t_const___class_DuiLib::IDialogBuilderCallback___class_DuiLib::CPaintManagerUI___class_DuiLib::CControlUI__
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0
mov esi, eax
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
test esi, esi
jne 0x4241db
push 0x10
push str.Duilib
push 0x474518
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
mov ecx, ebx
call sym.STSGameSDK.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::AttachDialog_class_DuiLib::CControlUI__
lea eax, [edi + 0x24]
mov ecx, ebx
push eax
call sym.STSGameSDK.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::AddNotifier_class_DuiLib::INotifyUI__
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ec]
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CMarkup::destructor_void_
xor eax, eax
call fcn.00452d11
ret 0x10
Function at 0x43178b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x1c], 0
je 0x4317f8
cmp dword [esi + 0x14], 0
je 0x4317f8
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00453fa0
mov ebx, esp
test ebx, ebx
je 0x4317f8
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x1b8
call fcn.0041623a
mov ecx, dword [esi + 0x14]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x437ab7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x109c], edi
je 0x437b21
cmp dword [ebp + 8], 0x100
jne 0x437b10
cmp word [ebp + 0xc], 0xd
jne 0x437b10
cmp byte [esi + 0x10a2], 0
je 0x437af7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x437b10
cmp byte [esi + 0x10a3], 0
jne 0x437b10
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x437b0c
push edi
push edi
push edi
push str.return
push esi
call sym.STSGameSDK.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x437b24
mov eax, dword [esi + 0x109c]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10