joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b164
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b2d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045a8c0
xor eax, eax
push ebp
push 0x45b2b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x45b1c9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x45b1c9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x45b2a2
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x45b1dc
call fcn.00404168
jmp 0x45b2bf
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x45b203
cmp dword [ebp - 0x10], 0
jle 0x45b203
cmp ebx, dword [ebp - 0x10]
jle 0x45b203
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x45b2a2
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x45b2a2
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403a5c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x45b2a2
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0040b710
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x45b2f0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x52135c]
mov dl, 1
mov eax, dword [0x459724]
call fcn.0040c040
call fcn.004040bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b2bf
mov eax, dword [ebp - 4]
call fcn.0045a8cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b2dc
lea eax, [ebp - 0x2c]
call fcn.00404728
ret
Function at 0x40f2e6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonSize], eax
call fcn.0040c549
pop ecx
mov ecx, dword [sym.TestWeakPtr.exe_gMozillaPoisonSize]
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40f31e
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestWeakPtr.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x105a3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105a31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105a307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105a306a
add dl, dl
jne 0x105a3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105a30dc
xor eax, eax
add dl, dl
jne 0x105a3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105a317d
add dl, dl
jne 0x105a30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105a30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105a30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105a30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105a30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105a3075
mov eax, 1
add dl, dl
jne 0x105a30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105a30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105a30e1
sub eax, ebx
mov ebx, 1
jne 0x105a3128
mov ecx, 1
add dl, dl
jne 0x105a310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105a3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105a3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105a3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105a313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105a314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105a3136
cmp eax, 0x7d00
jae 0x105a316d
cmp eax, 0x500
jb 0x105a3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105a3075
cmp eax, 0x7f
ja 0x105a3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105a3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105a319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105a3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x7e5a3b25
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, str.LgSq
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x53271cc1
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4ddee8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xffffffec
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 0
je 0x4ddf26
test byte [ebp - 0xa], 4
je 0x4ddf43
cmp byte [ebp - 5], 0
jne 0x4de006
mov eax, dword [ebp - 0xc]
and eax, 0x40000
cmp eax, 0x40000
jne 0x4de006
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
or al, byte [ebp - 0xe]
je 0x4ddf7a
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 5], 0
je 0x4ddfae
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xffffffec
mov eax, dword [ebp - 0xc]
or eax, 0x40000
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [ebp - 0x2c], eax
jmp 0x4ddfda
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0xffffffec
mov eax, dword [ebp - 0xc]
and eax, 0xfffbffff
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [ebp - 0x3c], eax
mov al, byte [ebp - 6]
and al, byte [ebp - 0xd]
jne 0x4ddfe8
cmp byte [ebp - 0xe], 0
je 0x4de006
cmp byte [ebp - 0xe], 0
je 0x4ddffb
push 6
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4de006
push 5
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret

Function at 0x4de374
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], al
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
cmp byte [ebp - 1], 0
je 0x4de39f
lea eax, [ebp - 0xc]
push eax
push 0x4de330
call sub.user32.dll_EnumWindows
jmp 0x4de3b3
lea eax, [ebp - 0xc]
push eax
push 0x4de304
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
mov al, byte [ebp - 8]
mov byte [ebp - 2], al
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret
Function at 0x4de4c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov ax, word [0x4de52c]
mov word [ebp - 4], ax
test byte [ebp - 2], 4
je 0x4de4e5
or word [ebp - 4], 1
test byte [ebp - 2], 8
je 0x4de4f0
or word [ebp - 4], 4
test byte [ebp - 2], 1
je 0x4de4fb
or word [ebp - 4], 8
test byte [ebp - 2], 2
je 0x4de506
or word [ebp - 4], 0x10
test byte [ebp - 2], 0x10
je 0x4de511
or word [ebp - 4], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4de522
or word [ebp - 4], 2
mov ax, word [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x4de530
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov ax, word [0x4de578]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4de554
or word [ebp - 6], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4de565
or word [ebp - 6], 4
test byte [ebp - 1], 0x20
je 0x4de570
or word [ebp - 6], 2
mov ax, word [ebp - 6]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4e95a8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x4e95ba
add esp, 0xfffffff0
call fcn.00405f98
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00452798
mov eax, dword [0x558988]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x4e9c80
mov eax, dword [0x558998]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x4e9ca0
mov eax, dword [ebp - 4]
call fcn.004e9cd0
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov dl, 1
mov eax, dword [0x437ee4]
call fcn.0040595c
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x437ee4]
call fcn.0040595c
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x437ee4]
call fcn.0040595c
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], eax
mov dl, 1
mov eax, dword [0x437ee4]
call fcn.0040595c
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], eax
mov dl, 1
mov eax, dword [0x437ee4]
call fcn.0040595c
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
push eax
mov eax, 0x4e2f14
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x461450]
call fcn.00467630
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x461450]
call fcn.00467630
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x461450]
call fcn.00467630
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dl, 1
mov eax, dword [0x461450]
call fcn.00467630
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov dl, 1
mov eax, dword [0x461450]
call fcn.00467630
mov edx, dword [ebp - 4]
mov dword [edx + 0x90], eax
mov eax, dword [ebp - 4]
call fcn.004ea4d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4ea1d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4ea1d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4ea1d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4ea1d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4ea1d4
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4e9794
call fcn.00405ff0
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4e9f48
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc58
push ebx
xor edx, edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ea113
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x4ea0f1
mov dl, 1
mov eax, dword [0x43b658]
call fcn.00449b38
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00407614
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4ea0da
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.00529f8c
test al, al
je 0x4ea0ce
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 0x3a0], 0
lea ecx, [ebp - 0x3a4]
mov edx, 0x4ea124
lea eax, [ebp - 0x39c]
call fcn.00420360
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4ea0ce
xor eax, eax
push ebp
push 0x4ea0c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x200
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x4ea194
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4ea0b0
lea eax, [ebp - 0x3a8]
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.004082b8
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x4ea0b0
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.004082b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea0ce
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x4e9fbd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dl, 1
call fcn.00449a74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea11a
lea eax, [ebp - 0x3a8]
call fcn.00407614
ret
Function at 0x4eaf6c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x55e280]
cmp byte [eax + 0xb1], 0
jne 0x4eafe4
cmp dword [0x55e2a0], 0
jne 0x4eafa1
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x558358]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x55e2a0], eax
cmp dword [0x55e29c], 0
jne 0x4eafbc
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x55e29c], eax
cmp dword [0x55e2a4], 0
jne 0x4eafe4
lea eax, [ebp - 4]
push eax
push 0
push 0
mov eax, dword [0x558354]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x55e2a4], eax
pop ecx
pop ebp
ret

Function at 0x4eb0e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.004eb07c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4eb105
xor eax, eax
call fcn.004eb0b4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x4eb11f
mov al, 1
call fcn.004eb0b4
mov esp, ebp
pop ebp
ret

Function at 0x4ebd44
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x178], 0
je 0x4ebe26
mov eax, dword [ebp - 4]
cmp dword [eax + 0x98], 0
jne 0x4ebe1d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x4ebc44
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
cmp dword [eax + 8], 0
je 0x4ebe1d
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xffffffec
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetWindowLongW
mov dword [ebp - 0x20], eax
test byte [ebp - 0x20], 8
je 0x4ebdd7
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4ebe1d
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0044550c
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ebdec
mov eax, dword [ebp - 4]
inc dword [eax + 0x98]
mov esp, ebp
pop ebp
ret
Function at 0x4ec0f0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x55e280]
cmp dword [eax + 0x178], 0
je 0x4ec2b1
cmp byte [ebp - 5], 0
jne 0x4ec1d3
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x4ec1c5
mov eax, dword [ebp - 4]
call fcn.004ef980
push eax
push 0x4ebfdc
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x4ec188
mov eax, dword [0x55e280]
cmp byte [eax + 0xd7], 0
je 0x4ec188
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.004093f4
cmp eax, 0
jl 0x4ec188
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ec168
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4ec1c5
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0044550c
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ec19d
mov eax, dword [ebp - 4]
inc dword [eax + 0xa0]
jmp 0x4ec2b1
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jle 0x4ec2b1
mov eax, dword [ebp - 4]
dec dword [eax + 0xa0]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x4ec2b1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x4ec249
mov eax, dword [0x55e280]
cmp byte [eax + 0xd7], 0
je 0x4ec249
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.004093f4
cmp eax, 0
jl 0x4ec249
mov dword [ebp - 0xc], eax
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ec229
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4ec286
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0044550c
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4ec25e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, dword [ebp - 4]
add eax, 0xdc
mov ecx, 1
mov edx, dword [0x4db234]
call fcn.004095a0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4ed0dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb0], 0
je 0x4ed166
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd7], 0
jne 0x4ed166
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 8]
call fcn.0040779c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ed14d
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ed177
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.004079f4
jmp 0x4ed177
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.004079f4
mov esp, ebp
pop ebp
ret

Function at 0x4eef3c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x88], 0
je 0x4eefc6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00522928
test al, al
je 0x4eefc6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00522390
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4eefc6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x4eefb6
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00522390
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.005168c8
jmp 0x4eefc6
mov cl, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 4]
call fcn.004eed04
pop ecx
pop ebp
ret