joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df220
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.004172d0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4df24e
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4df245
push esi
xor bl, bl
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4df298
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4df298
push dword [ebp + 0xc]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00417220
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8

Function at 0x4df2b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov ebx, dword [eax + edi + 4]
test ebx, ebx
jne 0x4df2d3
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4df2fd
mov ecx, dword [edi]
push ebx
mov ecx, dword [ecx + 4]
push dword [ecx + edi + 0x10]
push eax
call fcn.004f13c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, dword [ebp - 4]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4df345
cmp byte [ebp + 0x10], 0
je 0x4df320
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
push esi
call dword [eax + 4]
pop esi
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4df360
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4df376
xor al, al
pop ebp
ret 8
lea eax, [ebp + 8]
push esi
push eax
call fcn.00409800
mov esi, eax
add esp, 4
test esi, esi
jne 0x4df396
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
pop esi
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
je 0x4df3a2
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
pop esi
pop ebp
ret 8
Function at 0x4df3c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4df43f
mov esi, edi
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4df3d1
sub esi, edx
test esi, esi
jle 0x4df43f
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4df43f
cmp byte [ebp + 0xc], 0
je 0x4df3f7
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
lea ebx, [esi + 1]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4df430
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4df420
push ebx
push edi
push eax
call fcn.004f13c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 8
pop edi
xor al, al
pop esi
pop ebp
ret 8

Function at 0x4df450
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4df4d9
mov esi, edi
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4df461
sub esi, edx
sar esi, 1
test esi, esi
jle 0x4df4d9
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4df4d9
cmp byte [ebp + 0xc], 0
je 0x4df48d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
lea ebx, [esi*2 + 2]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4df4ca
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4df4ba
push ebx
push edi
push eax
call fcn.004f13c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 8
pop edi
xor al, al
pop esi
pop ebp
ret 8
Function at 0x4e4800
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
push 0x11
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
push 0x10
shr ebx, 0xf
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
and bl, 1
je 0x4e482e
movss xmm2, dword [0x548f58]
jmp 0x4e4836
movss xmm2, dword [0x51ea44]
cmp byte [edi + 0xc0], 0
movss xmm4, dword [0x548f30]
movss xmm3, dword [0x51ea50]
je 0x4e487e
test al, al
je 0x4e4869
movss xmm0, dword [edi + 0x88]
addss xmm0, xmm3
movss dword [edi + 0x88], xmm0
jmp 0x4e487e
movss xmm0, dword [edi + 0x7c]
movaps xmm1, xmm2
mulss xmm1, xmm4
subss xmm0, xmm1
movss dword [edi + 0x7c], xmm0
cmp byte [edi + 0xbe], 0
je 0x4e48b2
test al, al
je 0x4e48a1
movss xmm0, dword [edi + 0x88]
subss xmm0, xmm3
movss dword [edi + 0x88], xmm0
jmp 0x4e48b2
movaps xmm0, xmm2
mulss xmm0, xmm4
addss xmm0, dword [edi + 0x7c]
movss dword [edi + 0x7c], xmm0
cmp byte [edi + 0xbd], 0
je 0x4e48ea
test al, al
je 0x4e48d5
movss xmm0, dword [edi + 0x8c]
subss xmm0, xmm3
movss dword [edi + 0x8c], xmm0
jmp 0x4e48ea
movss xmm0, dword [edi + 0x78]
movaps xmm1, xmm2
mulss xmm1, xmm4
subss xmm0, xmm1
movss dword [edi + 0x78], xmm0
cmp byte [edi + 0xbf], 0
je 0x4e491e
test al, al
je 0x4e490d
movss xmm0, dword [edi + 0x8c]
addss xmm0, xmm3
movss dword [edi + 0x8c], xmm0
jmp 0x4e491e
movaps xmm0, xmm2
mulss xmm0, xmm4
addss xmm0, dword [edi + 0x78]
movss dword [edi + 0x78], xmm0
cmp byte [edi + 0xb9], 0
movss xmm4, dword [0x548f2c]
je 0x4e4964
test al, al
je 0x4e4949
movss xmm0, dword [edi + 0x90]
addss xmm0, xmm3
movss dword [edi + 0x90], xmm0
jmp 0x4e4964
movss xmm0, dword [edi + 0x80]
movaps xmm1, xmm2
mulss xmm1, xmm4
subss xmm0, xmm1
movss dword [edi + 0x80], xmm0
cmp byte [edi + 0xba], 0
je 0x4e499b
test al, al
je 0x4e4987
movss xmm0, dword [edi + 0x90]
subss xmm0, xmm3
movss dword [edi + 0x90], xmm0
jmp 0x4e499b
mulss xmm2, xmm4
addss xmm2, dword [edi + 0x80]
movss dword [edi + 0x80], xmm2
movss xmm0, dword [edi + 0x88]
push ecx
movss dword [esp], xmm0
call fcn.00402d10
fstp dword [edi + 0x88]
movss xmm0, dword [edi + 0x8c]
movss dword [esp], xmm0
call fcn.00402d10
fstp dword [edi + 0x8c]
movss xmm0, dword [edi + 0x90]
movss dword [esp], xmm0
call fcn.00402d10
fstp dword [edi + 0x90]
add esp, 4
pop edi
pop ebx
ret
Function at 0x4e68f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ac59
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x57b728]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00417d90
push 0
push 0
push 0xe
push dword [ebx + 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x4e6975
lea esi, [eax + 0x10]
push esi
mov ecx, edi
call fcn.0041a210
push dword [edi + 4]
push esi
push 0xd
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
mov ecx, edi
call fcn.0041a410
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e7060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x57b728]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.004e5e20
test al, al
je 0x4e70e8
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call dword [eax + 0x4c]
mov eax, dword [ebp - 8]
push 0
push 0
add eax, 0xffffffe6
push 0x40000000
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0x3f3
push dword [esi + 0x14]
lea ecx, [esi + 0x5c]
call fcn.004ee660
push 0xa2
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8080
test cx, ax
je 0x4e70cd
mov ecx, dword [esi + 0x9c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 0x9c]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test al, al
je 0x4e70f9
mov ecx, esi
call fcn.004e5fb0
test al, al
jne 0x4e7126
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
call dword [eax + 8]
cmp eax, 2
jne 0x4e7114
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x130]
jmp 0x4e7119
cmp eax, 1
je 0x4e7126
mov eax, dword [esi + 0x4c]
mov dword [eax + 0xc4], 1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.004eff68
mov esp, ebp
pop ebp
ret
Function at 0x4ea900
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x57b728]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 4
cmp dword [edi + 0x88], 0
jne 0x4ea92d
call fcn.004eae00
mov ebx, 0x24
mov eax, dword [edi]
lea ecx, [ebp - 0x34]
push ecx
mov ecx, edi
call dword [eax + 0x48]
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
push 0xfffffffffffffff0
push dword [edi + 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x88]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x15
test al, 1
mov eax, dword [ebp - 0x28]
je 0x4ea96b
add eax, dword [0x57f910]
mov dword [ebp - 0x28], eax
push dword [edi + 0x60]
cmp esi, eax
jge 0x4eaa08
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
je 0x4ea98c
push 5
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0xc8]
cmp ecx, esi
jge 0x4ea9ad
mov eax, dword [edi + 0xc4]
test eax, eax
jle 0x4ea9ad
sub eax, esi
add eax, ecx
mov dword [edi + 0xc4], eax
or ebx, 0x20
mov eax, dword [ebp - 0x28]
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0xc4]
movq qword [ebp - 0x20], xmm0
mov ecx, dword [ebp - 0x1c]
movq qword [ebp - 0x10], xmm0
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
or ecx, 1
push eax
or ecx, 4
push 2
push dword [edi + 0x60]
or ecx, 2
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x4eaa34
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x4eaa34
push 0
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [edi + 0xc4], 0
jle 0x4eaa34
mov dword [edi + 0xc4], 0
or ebx, 0x20
push dword [edi + 0x60]
mov dword [edi + 0xc8], esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
mov eax, dword [ebp - 0x24]
jne 0x4eaa54
sub eax, dword [0x57f90c]
mov dword [ebp - 0x24], eax
mov ecx, dword [edi + 0xc4]
mov dword [edi + 0xc0], eax
mov eax, ebx
or eax, 0x14
push eax
push dword [0x57f908]
lea eax, [ecx + esi]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
push 0
neg ecx
push ecx
push 0
push dword [edi + 0x5c]
call esi
mov ecx, dword [0x57f908]
mov eax, ebx
or eax, 0x16
push eax
mov eax, dword [ebp - 0x24]
sub eax, ecx
push eax
push dword [ebp - 0x2c]
push ecx
push 0
push 0
push dword [edi + 0x38]
call esi
push 0xfffffffffffffff0
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [ebp - 0x2c]
shr eax, 0x15
push 0x14
push dword [0x57f90c]
and al, 1
mov eax, 0
cmovne eax, dword [0x57f910]
sub ecx, eax
push ecx
push dword [ebp - 0x24]
push 0
push 0
push dword [edi + 0x60]
call esi
test bl, 0x20
je 0x4eaae9
push 1
push 0
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ec1d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x57b728]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x4ec288
cmp byte [esi + 0x44], 0
je 0x4ec208
mov byte [esi + 0x44], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x48]
mov dword [esi + 0x4c], eax
lea eax, [ebp - 0x14]
push eax
mov byte [esi + 0x45], 0
call dword [sym.imp.USER32.dll_SetRectEmpty]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x14]
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 1
push 0x86
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x4ec2a4
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetCapture]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 0x14]
jne 0x4ec299
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004eff68
mov esp, ebp
pop ebp
ret 4
Function at 0x4ec700
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x57b728]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x57f94c], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
jne 0x4ec764
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x57f94c
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call sub.gdiplus.dll_GdiplusStartup
test eax, eax
je 0x4ec764
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
push ebx
push edi
mov ecx, 0x57f9d0
call fcn.00417e70
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x44], eax
mov eax, dword [0x57f9c0]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x57f9c4]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x15c]
mov edx, dword [0x57f9bc]
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x57f9b8]
add eax, edx
push eax
mov eax, dword [ebp - 0x1c]
add eax, ecx
push eax
push edx
push ecx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
movzx ebx, word [ebp + 0x10]
push ebx
push dword [0x57f9cc]
call dword [sym.imp.USER32.dll_LoadMenuA]
push edi
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
mov ecx, esi
mov dword [esi + 0x34], eax
call fcn.004ee660
test al, al
jne 0x4ec7f6
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
push ebx
push dword [0x57f9cc]
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [esi + 0x4c], eax
mov dword [0x57f944], esi
mov eax, dword [esi + 0x14]
mov dword [0x57f940], eax
mov eax, dword [esi + 0x14]
push 5
mov dword [0x57b3a8], eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x32
push 0x80
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ecd00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x57b728]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
cmp eax, 1
jne 0x4ecd71
test ebx, ebx
jne 0x4ecd71
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
mov dword [ebp - 0x34], eax
call fcn.004ecc50
add esp, 4
test eax, eax
je 0x4ecd6e
cmp eax, esi
je 0x4ecd6e
movzx eax, di
push ebx
or eax, 0x10000
push eax
push 0x111
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
or eax, 1
cmp eax, 1
jne 0x4ecec4
test ebx, ebx
jne 0x4ecec4
mov eax, dword [esi]
push ebx
push ebx
mov ecx, esi
call dword [eax + 0x108]
cmp edi, 0xe140
jne 0x4ecdc8
push ebx
push 0x4ec5b0
push dword [esi + 0x14]
push 0x80
push dword [0x57f9cc]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x12
je 0x4ece96
cmp edi, 0xe141
je 0x4ece96
cmp edi, 0xe401
jne 0x4ece04
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x16c]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edi - 0xe201]
cmp eax, 0xfd
ja 0x4ecec4
push edi
push 2
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004e1300
mov esi, eax
add esp, 8
test esi, esi
je 0x4eceaf
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
push eax
push esi
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x2c], xmm0
movq qword [ebp - 0x24], xmm0
movq qword [ebp - 0x1c], xmm0
movq qword [ebp - 0x14], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [ebp - 0x28], 2
jne 0x4ece68
push 9
jmp 0x4ece6a
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x32
push 0x82
push esi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x144]
call eax
test al, al
je 0x4eceaf
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0xe100
jb 0x4ecf0e
push 0x65
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4ecf0e
mov eax, dword [ebp + 8]
movzx edx, ax
movzx ecx, di
push ebx
shl edx, 0x10
or edx, ecx
push edx
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004eff68
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ed940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jg 0x4ed95d
mov eax, dword [esi]
push 0
push 0
call dword [eax + 0x108]
pop esi
pop ebp
ret 8
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4ed988
push 5
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0xc]
push 0
push 0x406
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push dword [ebp + 8]
push 0x402
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop ebp
ret 8
Function at 0x4ffdeb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x57b728]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004f80b5
mov dword [ebp - 0x14], eax
cmp dword [0x580a54], edi
jne 0x4ffedc
push 0x800
push edi
push 0x54d9d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4ffe69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4fffbc
push 0x54d9d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4fffbc
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4fffbc
push eax
call ebx
push 0x54d9fc
push esi
mov dword [0x580a54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x580a58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x580a5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x580a64], eax
test eax, eax
je 0x4ffed9
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x580a60], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4fff01
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4ffef4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4fff16
push 4
pop eax
jmp 0x4fffbe
cmp dword [ebp - 0x14], edi
je 0x4fff16
push dword [0x580a54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4ffefb
mov eax, dword [0x580a60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4fff74
cmp dword [0x580a64], esi
je 0x4fff74
push eax
call ebx
push dword [0x580a64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4fff74
test eax, eax
je 0x4fff74
call ecx
test eax, eax
je 0x4fff69
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4fff69
test byte [ebp - 8], 1
jne 0x4fff74
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4fffa4
mov eax, dword [0x580a58]
cmp eax, esi
je 0x4fffa1
push eax
call ebx
test eax, eax
je 0x4fffa1
call eax
mov edi, eax
test edi, edi
je 0x4fffa1
mov eax, dword [0x580a5c]
cmp eax, esi
je 0x4fffa1
push eax
call ebx
test eax, eax
je 0x4fffa1
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x580a54]
call ebx
test eax, eax
je 0x4fffbc
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4fffbe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004eff68
leave
ret