joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca4d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
push esi
mov esi, eax
cmp dword [esi + 0x394], 1
push edi
jne 0x4ca59b
push 0x5a1d74
lea eax, [esi + 0x24]
mov ecx, 0xd7a
call fcn.0046ea90
push 0
mov dword [esi + 0x394], 0
call dword [sym.imp.MSVCR80.dll__time64]
mov ebx, dword [sym.imp.MSVCR80.dll__localtime64_s]
add esp, 4
add eax, 0x1e
lea edi, [esi + 0x384]
mov dword [edi], eax
lea eax, [esp + 0x1c]
adc edx, 0
push edi
push eax
mov dword [edi + 4], edx
call ebx
add esp, 8
test eax, eax
jne 0x4ca53f
mov eax, dword [esp + 0x24]
jmp 0x4ca542
or eax, 0xffffffff
lea ecx, [esp + 0x1c]
push edi
push ecx
mov dword [esi + 0x370], eax
call ebx
add esp, 8
test eax, eax
jne 0x4ca55d
mov eax, dword [esp + 0x20]
jmp 0x4ca560
or eax, 0xffffffff
mov edx, dword [esi + 4]
push 0
push 0
push 0xf
push edx
mov dword [esi + 0x374], eax
mov dword [esi + 0x380], 2
call ebp
mov eax, dword [esi + 4]
push 0
push 0
push 0x8100
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 4]
push 0
push 0
push 0xf
push ecx
call ebp
lea edi, [esi + 4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push edi
call fcn.00456dc0
mov edx, dword [edi]
push 0
push 0
push 0xf
push edx
call ebp
mov eax, dword [edi]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esi + 0x380], 0
jne 0x4ca5e4
push 0xffffffffffffffff
push 0xffffffffffffffff
jmp 0x4ca60b
push 0
call dword [sym.imp.MSVCR80.dll__time64]
mov ecx, eax
lea eax, [esi + 0x384]
mov esi, dword [eax]
add esp, 4
sub esi, ecx
mov ecx, dword [eax + 4]
sbb ecx, edx
mov dword [esp + 0x14], ecx
call fcn.004c8e80
push eax
push esi
mov edx, dword [esp + 0x4c]
push edx
push 0
call fcn.0051f670
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4

Function at 0x4ca630
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREkingsoftkwifiKSetting
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4ca685
mov dword [esp + 4], eax
mov eax, dword [esp]
test eax, eax
je 0x4ca693
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0
push 0x5a1da8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
test eax, eax
je 0x4ca693
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x4ca6d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov ecx, dword [edi + 0x3c]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi]
cmp dword [edx - 0xc], 0
je 0x4ca6f2
mov eax, dword [edi + 0x3c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov ecx, dword [edi + 0x3c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4cc5b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 0x394]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call esi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4cc5d6
mov ecx, dword [edi + 0x394]
push 0
push ecx
call ebx
mov edx, dword [edi + 0x414]
push edx
call esi
test eax, eax
je 0x4cc5ee
mov eax, dword [edi + 0x414]
push 0
push eax
call ebx
mov eax, dword [edi + 0x4d4]
test eax, eax
je 0x4cc624
mov ecx, dword [eax + 4]
push ecx
call esi
test eax, eax
je 0x4cc624
mov eax, dword [edi + 0x4d4]
mov edx, dword [eax + 4]
add eax, 4
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4cc624
mov esi, dword [edi + 0x4d4]
call fcn.004d63b0
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0xea
push eax
mov dword [edi + 0x4a4], 0
call esi
mov ecx, dword [edi + 4]
push 0xec
push ecx
call esi
mov edx, dword [edi + 4]
push 0
push edx
call ebx
pop esi
pop ebx
ret

Function at 0x4ccff0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x574728
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
lea eax, [esp + 8]
push eax
call fcn.0040ff50
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0x3cc]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 8]
cmp dword [eax - 0xc], 0
je 0x4cd04b
mov ecx, dword [esi + 0x3cc]
push 5
push ecx
jmp 0x4cd054
mov edx, dword [esi + 0x3cc]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0x1c], 0
je 0x4cd0b6
lea edi, [esi + 0x38c]
lea eax, [esp + 8]
mov dword [esi + 0x4bc], 2
call fcn.004101e0
mov eax, dword [esi + 0x3cc]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 0xc]
mov edx, dword [esi + 0x3cc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push eax
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x3cc]
push 0
push 0
push 0xb7
push eax
call edi
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4cd0de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 4
Function at 0x4ce580
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ce5b3
mov ecx, dword [esi + 4]
push 0xd5
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 4]
push 0
push edx
mov dword [esi + 0x378], 0
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4ce5c0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
mov dword [esi + 0x370], 0
mov dword [esi + 0x378], 0
call fcn.004ce760
mov ebx, esi
call fcn.0049e940
mov eax, dword [esi + 4]
push 0
push 0
push 0xf
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 4]
push 8
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push 0
push 0x3e8
push 0xd5
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop esi
pop ebx
pop ecx
ret
Function at 0x4d1b10
Capabilities:
Hide graphical window

Disassembly:
cmp dword [eax + 8], 1
jne 0x4d1b3d
cmp dword [eax + 0xc], 0x64
jne 0x4d1b3d
mov eax, dword [esi + 0x380]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push ecx
call edi
mov eax, 1
pop edi
ret
mov dword [esi + 0x374], 0
xor eax, eax
ret

Function at 0x4d1d70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ebx + 4]
push esi
push edi
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 0xfffbffff
or ecx, 0x80
cmp eax, ecx
je 0x4d1d9d
push ecx
mov ecx, dword [ebx + 4]
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebx + 4]
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov edx, esp
lea esi, [ebx + 0x37c]
mov eax, 0x90010000
push ecx
mov edi, esi
mov dword [edx], 0
call fcn.004dc450
test eax, eax
je 0x4d1dd5
mov dword [esi + 0x5c], 0xfdfcfb
call fcn.004dc260
lea eax, [ebx + 0x36c]
mov dword [ebx + 0x3cc], eax
lea eax, [ebx + 0x370]
mov ecx, esi
mov dword [ebx + 0x3d0], eax
call fcn.004dbd40
mov edx, dword [ebx + 0x380]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x4d1e80
Capabilities:
Hide graphical window

Disassembly:
push ecx
test eax, eax
push ebx
push esi
mov ebx, ecx
jne 0x4d1e9a
lea eax, [ebx + 4]
push eax
mov eax, dword [ebx + 0x378]
call fcn.00456dc0
jmp 0x4d1ea4
cmp eax, 1
jne 0x4d1ea4
call fcn.0049e940
mov ecx, dword [ebx + 0x380]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d1ee7
cmp dword [ebx + 0x3f4], 0
je 0x4d1ee7
mov edx, dword [ebx + 0x380]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push edx
call esi
mov eax, dword [ebx + 4]
push 1
push eax
call esi
mov ecx, dword [ebx + 4]
push 0
push 0
push 0xf
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
pop ecx
ret
Function at 0x4d28a0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x579e70
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x37c]
push ecx
call fcn.004d2240
mov dword [esp + 0x28], 0
cmp dword [esi + 0x374], 0
mov edi, dword [sym.imp.MSVCR80.dll__wtoi]
je 0x4d28fe
mov edx, dword [esp + 0x18]
push edx
call edi
add esp, 4
mov dword [esi + 0x3ec], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x3b4]
push ecx
call fcn.004d2240
mov byte [esp + 0x28], 1
cmp dword [esi + 0x378], 0
je 0x4d292d
mov edx, dword [esp + 0x14]
push edx
call edi
add esp, 4
mov dword [esi + 0x3f0], eax
mov edx, 1
mov ecx, str.first_show_limit_rate_dlg
call fcn.0048b4f0
mov edx, dword [esi + 0x378]
test edx, edx
mov dword [esp + 0x1c], eax
je 0x4d2952
mov eax, dword [esi + 0x3f0]
jmp 0x4d2954
xor eax, eax
mov ebp, dword [esi + 0x374]
test ebp, ebp
je 0x4d2966
mov edi, dword [esi + 0x3ec]
jmp 0x4d2968
xor edi, edi
cmp dword [esi + 0x400], 0
je 0x4d2982
xor ecx, ecx
cmp dword [esi + 0x404], ecx
setne cl
lea ecx, [ecx + ecx + 1]
jmp 0x4d298f
mov ecx, dword [esi + 0x404]
neg ecx
sbb ecx, ecx
and ecx, 2
mov ebx, dword [esi + 0x3fc]
push ebx
push ecx
mov ecx, dword [esp + 0x24]
push ecx
push eax
mov eax, dword [esi + 0x3f8]
push edx
mov edx, dword [esi + 0x370]
push edi
push ebp
push edx
push eax
call fcn.0051f9f0
mov ecx, dword [esi + 0x380]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call edi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4d29d7
mov edx, dword [esi + 0x380]
push 0
push edx
call ebx
mov eax, dword [esi + 0x3b8]
push eax
call edi
test eax, eax
je 0x4d29ef
mov ecx, dword [esi + 0x3b8]
push 0
push ecx
call ebx
mov ecx, esi
mov dword [esi + 0x538], 1
call fcn.00481b40
mov dword [esi + 0x50c], eax
mov eax, dword [esi + 4]
push 0
lea ecx, [esi + 0x4dc]
call fcn.004cee20
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4d2a3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d2a63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4d46f0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov esi, eax
call fcn.004d4750
mov ecx, esi
call fcn.004d43c0
push esi
call fcn.004d2a80
call fcn.004d47d0
call fcn.004d4690
mov eax, dword [esi + 0x380]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov ecx, dword [esi + 0x3b8]
push 5
push ecx
call edi
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 4]
push 0
push 0
push 0xf
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4d4a30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x538]
push 0
push 0
push 0
mov dword [esi + 0x31c], ecx
mov dword [esi + 0x318], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
xor eax, eax
ret

Function at 0x4d4e30
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x374], 0
push esi
push edi
je 0x4d4ea1
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
push eax
xor edi, edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4d4e6f
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4d4e6f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
call fcn.00456dc0
mov edi, 1
mov edx, dword [ebx + 0x374]
push edx
call fcn.004d4eb0
mov eax, dword [esi]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push 0
push 0xf
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp edi, 1
jne 0x4d4ea1
mov esi, dword [esi]
call fcn.00439e50
pop edi
pop esi
pop ebx
ret

Function at 0x4d5270
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 1
push 0x4fb
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push 0x1ff
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x370], 1
ret
Function at 0x4d5590
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x5712a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov edi, dword [esp + 0x20]
lea esi, [ebx + 0x24]
push edi
mov ecx, 0x65
mov eax, esi
call fcn.0046ea90
push edi
mov ecx, 0xc9
mov eax, esi
call fcn.0046ea90
call fcn.00456410
add eax, 0x90
push eax
mov ecx, 0x591ae8
call fcn.004133e0
add esp, 4
test al, al
jne 0x4d563b
call fcn.00456410
add eax, 0x90
push eax
mov ecx, str.Microsoft_YaHei
call fcn.004133e0
add esp, 4
test al, al
jne 0x4d563b
push 0x591f2c
push 0x65
push esi
mov ecx, 0x5a2f9c
call fcn.0044fd30
push 0x591f2c
push 0xc9
push esi
mov ecx, str.242_73__0_103
call fcn.0044fd30
cmp dword [esp + 0x24], 1
mov ecx, 0x3e8
mov eax, esi
jne 0x4d5654
push 1
call fcn.0046ebd0
push 0
jmp 0x4d565d
push 0
call fcn.0046ebd0
push 1
mov ecx, 0x7d0
mov eax, esi
call fcn.0046ebd0
lea esi, [ebx + 4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
call fcn.00456dc0
mov eax, dword [esi]
push 0
push 0
push 0xf
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4d56b4
mov edx, dword [esi]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d56d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x4d63b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push 0
push eax
mov dword [esi + 0x374], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x923
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
ret

Function at 0x4d6e60
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
add esi, 4
push esi
xor eax, eax
call fcn.00456dc0
mov eax, dword [esi]
push 0
push 0
push 0xf
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x4d7110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57db4d
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ebp, dword [esp + 0x128]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x120], 0
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x120], 1
mov eax, dword [0x5e736c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5e736c
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
lea ebx, [ebp + 0x3b8]
lea edi, [esp + 0x1c]
mov byte [esp + 0x120], 2
call fcn.0048c390
lea ebx, [ebp + 0x438]
lea edi, [esp + 0x14]
call fcn.0048c390
lea ebx, [ebp + 0x4b8]
lea edi, [esp + 0x18]
call fcn.0048c390
lea edi, [esp + 0x30]
call fcn.00439120
mov byte [esp + 0x120], 3
call fcn.00438ee0
mov ecx, edi
mov edx, eax
call fcn.0043c840
lea esi, [esp + 0x54]
call fcn.00440f60
mov eax, dword [esp + 0x12c]
mov edi, dword [esp + 0x18]
push eax
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x30], esp
mov esi, esp
call fcn.00410660
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x128], 4
mov ebx, dword [esp + 0x1c]
push ecx
add ebx, 0xfffffff0
mov eax, ebx
mov dword [esp + 0x2c], esp
mov esi, esp
call fcn.00410660
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x12c], 5
mov ecx, dword [ebp + 0x378]
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x40], esp
push edx
lea ecx, [esp + 0x90]
call fcn.0040ff50
mov byte [esp + 0x134], 6
mov eax, dword [esp + 0x44]
push eax
push ecx
mov ebp, dword [esp + 0x38]
add ebp, 0xfffffff0
mov eax, ebp
mov dword [esp + 0x40], esp
mov esi, esp
call fcn.00410660
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x13c], 3
call fcn.00521870
lea esi, [esp + 0x30]
call fcn.00439060
mov byte [esp + 0x120], 1
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d72c9
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov byte [esp + 0x120], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4d72ea
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov dword [esp + 0x120], 0xffffffff
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d730f
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00569ed6
add esp, 0x110
ret 8
Function at 0x4d7610
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
call fcn.004d7940
mov ebx, esi
call fcn.004d7690
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
lea edx, [esp + 0x10]
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
mov esi, dword [sym.imp.USER32.dll_SetCursorPos]
push edi
call esi
push 0
push 0
push 0
push 0
push 1
call dword [sym.imp.USER32.dll_mouse_event]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4d77b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [esi + 0x380], 0
push 0
push 1
je 0x4d77c7
push 9
jmp 0x4d77c9
push 8
call fcn.00520ec0
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4d77e8
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x4d7870
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4d788a
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x380], 0
push 0
push 7
je 0x4d789f
push 9
call fcn.00520ec0
ret
push 8
call fcn.00520ec0
ret
Function at 0x4d8240
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, edx
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [esi + 0x2c], ecx
je 0x4d825e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edi, [esi + 0x40]
mov dword [edi], edx
mov edx, dword [esp + 0x1c]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 0xc], edx
mov eax, dword [edi]
add eax, 0x258
push ecx
mov dword [esi + 0x48], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4d82ab
push ecx
mov eax, esp
mov dword [eax], ebx
push ecx
mov eax, esp
mov dword [eax], edi
mov edx, dword [esi + 0x24]
push edx
call fcn.004d8af0
cmp eax, ebx
je 0x4d831f
mov eax, dword [esi + 4]
push ebx
push ebx
push 0xf
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x44]
mov edx, dword [edi]
mov eax, dword [esi + 4]
push 0x53
push ebx
push ebx
push ecx
push edx
push ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x18
mov dword [esi + 0x28], 1
mov edi, 0x4d8330
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
jne 0x4d82fe
xor eax, eax
mov dword [esi + 0x3c], eax
pop edi
pop esi
pop ebx
ret 0x10
push ebx
push ebx
push eax
push 0x4f9150
push ebx
push ebx
mov dword [eax], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebx
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x3c], eax
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x4d8400
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x34]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x619cc4]
cmp edi, 0x11
jle 0x4d8446
cmp dword [esi + 0x34], 0xf
jle 0x4d8423
mov dword [esi + 0x34], 0xf
cmp edi, 0x19
jle 0x4d8439
fild dword [esi + 0x34]
fsub qword [0x5b28a0]
call fcn.0056a730
mov dword [esi + 0x34], eax
cmp dword [esi + 0x34], 0
jg 0x4d8446
mov dword [esi + 0x34], 0
mov ecx, dword [esi + 4]
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xf
push ecx
call edi
mov eax, dword [0x619cc4]
add eax, 1
cmp eax, dword [esi + 0x38]
mov dword [0x619cc4], eax
jl 0x4d84a0
mov edx, dword [esi + 0x24]
push 0
push 0
push 0x402
push edx
mov dword [0x619cc4], 0
mov dword [esi + 0x34], 0x1e
mov dword [esi + 0x28], 0
call edi
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
ret
mov eax, 1
pop edi
ret