joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a0250
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x14b
push esi
call ebp
mov eax, dword [edi + 0x260]
mov ecx, dword [edi + 0x40]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00490a30
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5a0338
mov ebx, dword [eax + 0x20]
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x5a0338
cmp ebx, 1
jle 0x5a02e3
push 0x20f
push str.C:RA2MPCoop.cpp
xor edx, edx
mov ecx, str.GUI:Random
call fcn.006eea10
push eax
push 0
push 0x4c2
push esi
call ebp
push 0xfffffffffffffffe
push eax
push 0x151
push esi
call ebp
xor edi, edi
test ebx, ebx
jle 0x5a0323
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x14]
mov ecx, dword [edx + edi*4]
call fcn.00490280
mov ebx, eax
mov eax, dword [0xa1e01c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx + 0x60]
push eax
push 0
push 0x4c2
push esi
call ebp
push ebx
push eax
push 0x151
push esi
call ebp
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x5a02e9
push 0
push 0
push 0x14e
push esi
call ebp
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x5a0340
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x54
push ebx
mov ebx, dword [esp + 0x5c]
push esi
push edi
mov edi, ecx
test ebx, ebx
mov dword [esp + 0x18], edi
je 0x5a04a1
mov ecx, dword [edi + 0x260]
mov esi, dword [0xa25e2c]
lea eax, [esp + 0xc]
mov dword [esp + 0x10], esi
push eax
push ecx
mov ecx, dword [edi + 0x40]
call fcn.00490a30
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5a04a1
mov eax, dword [eax + 0x20]
test eax, eax
mov dword [esp + 0x14], eax
je 0x5a04a1
push ebp
xor ebp, ebp
test esi, esi
jle 0x5a0413
mov dword [esp + 0x68], 0xa27da4
mov ecx, ebp
call fcn.004d0c20
mov esi, eax
mov ecx, edi
push esi
push ebx
call fcn.005a0250
cmp dword [esp + 0x18], 1
jle 0x5a03d3
push 0xfffffffffffffffe
mov edx, esi
mov ecx, ebx
call fcn.004d11c0
mov edx, dword [esp + 0x68]
push 0xfffffffffffffffe
mov ecx, dword [edx]
call fcn.00664d70
jmp 0x5a03fd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x14]
mov ecx, dword [ecx]
call fcn.00490280
mov edi, eax
mov edx, esi
push edi
mov ecx, ebx
call fcn.004d11c0
mov edx, dword [esp + 0x68]
push edi
mov ecx, dword [edx]
call fcn.00664d70
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x14]
inc ebp
add ecx, 4
cmp ebp, eax
mov dword [esp + 0x68], ecx
jl 0x5a03a0
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.005c4370
call fcn.005bd680
mov esi, eax
pop ebp
test esi, esi
je 0x5a04a1
mov edi, dword [edi + 0x44]
test edi, edi
je 0x5a04a1
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.0048e490
test al, al
je 0x5a04a1
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
inc ecx
push ecx
push str.NAME:COOPDESC_d
push edx
call fcn.0076d684
add esp, 0xc
push 0x72f
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x5a04a1
push 0x25d
push str.C:RA2MPCoop.cpp
xor edx, edx
lea ecx, [esp + 0x28]
call fcn.006eea10
push eax
push 0
push 0x4b2
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
add esp, 0x54
ret 4
Function at 0x5a8a00
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
lea eax, [ebp - 0x34]
xor esi, esi
push eax
xor ebx, ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x5a8a29
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
jmp 0x5a8a2f
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
lea ecx, [ebp - 0x2c]
inc edi
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
call esi
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xor cl, cl
mov dword [ebp - 0x24], edx
cmp cl, 0x32
mov dword [ebp - 0x20], eax
jae 0x5a8a6e
lea edx, [ebp - 0x24]
push edx
call esi
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
sub eax, edx
cmp eax, 0x32
jb 0x5a8a5b
rdtsc
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x2c], ecx
cmp eax, 0x3e8
mov dword [ebp - 0x28], edx
jae 0x5a8a9e
lea ecx, [ebp - 0x24]
push ecx
call esi
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
sub edx, ecx
cmp edx, 0x3e8
jb 0x5a8a88
rdtsc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + eax*4]
sub esi, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 5
mov edi, eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, 0xcccccccd
shl ecx, 5
sub edi, ecx
mov ecx, dword [ebp - 0x34]
mul ecx
mov ebx, edx
mov eax, edi
shr ebx, 3
xor edx, edx
div ebx
mov edx, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 0xc]
add edx, edi
add eax, esi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, edi
xor edx, edx
div ecx
shr ecx, 1
cmp edx, ecx
jbe 0x5a8b0d
inc edi
mov eax, esi
xor edx, edx
div edi
xor edx, edx
mov ebx, eax
mov eax, esi
div edi
shr edi, 1
cmp edx, edi
jbe 0x5a8b22
inc ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax]
mov eax, dword [ebp - 4]
add ecx, ebx
cmp eax, 3
jl 0x5a8a2c
cmp eax, 0x14
jge 0x5a8b7d
lea eax, [ebx + ebx*2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 3
jg 0x5a8a2c
mov eax, dword [ebp - 8]
lea eax, [eax + eax*2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 3
jg 0x5a8a2c
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 3
jg 0x5a8a2c
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor edx, edx
lea eax, [esi + esi*4]
shl eax, 1
div edi
xor edx, edx
mov ecx, eax
lea eax, [esi + esi*4]
lea eax, [eax + eax*4]
shl eax, 2
div edi
lea edx, [ecx + ecx*4]
shl edx, 1
sub eax, edx
cmp eax, 6
jb 0x5a8ba8
inc ecx
mov eax, esi
xor edx, edx
div edi
pop edi
lea edx, [eax + eax*4]
shl edx, 1
sub ecx, edx
cmp ecx, 6
jb 0x5a8bbc
inc eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b7c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
mov ebx, edx
jne 0x5b7c57
test ebx, ebx
mov edi, 0xa256b0
jne 0x5b7c57
mov ecx, 0xbd
call fcn.0072a3a0
mov dl, 1
mov ecx, eax
call fcn.005c57e0
push 0xa2791e
mov ecx, edi
call fcn.006eecd0
push eax
call fcn.0076ed63
add esp, 8
test eax, eax
jne 0x5b7c75
mov ebx, 1
mov eax, dword [0xa27d98]
xor esi, esi
test eax, eax
jle 0x5b7cc1
mov eax, dword [0xa27d8c]
push edi
mov ecx, dword [eax + esi*4]
call fcn.006eec70
push eax
call fcn.0076d4b0
add esp, 8
test eax, eax
je 0x5b7cb0
mov eax, dword [0xa27d98]
inc esi
cmp esi, eax
jl 0x5b7c80
xor cl, cl
call fcn.005b6e60
pop edi
pop esi
pop ebx
ret
cmp esi, 0xffffffff
je 0x5b7cc1
mov ecx, dword [0xa27d8c]
mov edx, dword [ecx + esi*4]
mov dword [edx + 0x65], ebx
pop edi
pop esi
xor cl, cl
pop ebx
jmp fcn.005b6e60
Function at 0x5b7e20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18c
mov eax, 0x30303030
push ebx
mov dword [esp + 0x10], eax
push ebp
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov ebx, ecx
mov dword [esp + 0x24], eax
push edi
mov dword [esp + 0x2c], eax
lea edi, [esp + 0x1c]
mov word [esp + 0x30], ax
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x32], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x20
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, str.SOFTWAREWestwoodRed_Alert_2
test eax, eax
je 0x5b7f14
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b7f14
mov edi, str.SOFTWAREWestwoodRed_Alert_2
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x9c]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x9c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5b7f14
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.Serial
push eax
mov dword [esp + 0x2c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x32], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x7d0ebc
mov edx, ecx
mov esi, edi
mov edi, ebx
push str.woldata.key
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
call fcn.0076efd5
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x5b7f61
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18c
ret
push ebp
call fcn.0076ff5b
mov ecx, eax
add esp, 4
cmp ecx, 0xffffffff
je 0x5b7fbb
movsx eax, byte [esp + esi + 0x1c]
sub eax, 0x30
mov edi, 0xa
cdq
idiv edi
mov eax, edx
sub eax, ecx
mov ecx, edi
add eax, 0x3e8
lea edi, [esp + 0x1c]
cdq
idiv ecx
or ecx, 0xffffffff
xor eax, eax
add dl, 0x30
mov byte [esp + esi + 0x1c], dl
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jne 0x5b7fab
xor esi, esi
push ebp
call fcn.0076ff5b
mov ecx, eax
add esp, 4
cmp ecx, 0xffffffff
jne 0x5b7f71
push ebp
call fcn.0076eeeb
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov al, 1
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18c
ret
Function at 0x5bdc20
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
test ebp, ebp
mov dword [esp + 8], ebp
je 0x5bdd84
push ebp
call fcn.0076eb95
add esp, 4
test eax, eax
je 0x5bdd84
mov al, byte [esp + 0x14]
push esi
test al, al
push edi
je 0x5bdc55
mov edi, 0xfb
jmp 0x5bdc7e
test ebx, ebx
jne 0x5bdc60
mov edi, 0xd0
jmp 0x5bdc7e
cmp ebx, 1
jne 0x5bdc6c
mov edi, 0xfc
jmp 0x5bdc7e
mov edi, ebx
sub edi, 4
neg edi
sbb edi, edi
and edi, 0xffffffd5
add edi, 0x126
mov eax, dword [0xb0de30]
mov ecx, dword [0xb0dbd8]
push 0
push 0x5bdd90
push eax
mov edx, edi
call fcn.0072a160
mov esi, eax
mov edx, edi
mov ecx, esi
call fcn.005f7350
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
test ebx, ebx
jne 0x5bdcdd
push 1
push esi
call edi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x10000000
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov al, byte [esp + 0x1c]
test al, al
je 0x5bdd4b
mov ecx, ebx
call fcn.005e1180
jmp 0x5bdd4b
cmp ebx, 1
jne 0x5bdd06
push ebx
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call ebp
or eax, 0x10000000
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 2
jmp 0x5bdd2e
cmp ebx, 4
jne 0x5bdd4b
push 6
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call ebp
or eax, 0x10000000
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 7
push esi
call edi
mov ebx, eax
push 0xfffffffffffffff0
push ebx
call ebp
or eax, 0x10000000
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ebp, dword [esp + 0x10]
push 0x5b0
push esi
call edi
push ebp
push 0
push 0x4b2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
mov edx, dword [esp + 0x18]
push 1
push 1
push 0
call fcn.0072a440
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x5c08a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov dl, 1
xor ecx, ecx
call fcn.00514e00
mov ecx, dword [0xb0dbd8]
mov edx, 0x6b
push 0
push 0x5c0920
push esi
call fcn.0072a160
mov edx, 0x6b
mov ecx, eax
mov dword [0xa5a440], eax
call fcn.005f7350
mov eax, dword [0xa5a440]
push 1
push 0
push 0x4a9
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0xa5a440]
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0xa5a440]
mov edx, 0x5c0700
push 1
push 1
push 0
call fcn.0072a440
pop esi
ret
Function at 0x5c4370
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
cmp edx, 8
push ebp
push esi
mov ebp, ecx
mov esi, edx
jge 0x5c44ee
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
test esi, esi
jne 0x5c43a9
mov dword [esp + 0x10], 0x6d2
mov dword [esp + 0x14], 0x411
jmp 0x5c4458
cmp esi, 1
jne 0x5c43c3
mov dword [esp + 0x10], 0x6d3
mov dword [esp + 0x14], 0x412
jmp 0x5c4458
cmp esi, 2
jne 0x5c43da
mov dword [esp + 0x10], 0x6d4
mov dword [esp + 0x14], 0x413
jmp 0x5c4458
cmp esi, 3
jne 0x5c43f1
mov dword [esp + 0x10], 0x6d5
mov dword [esp + 0x14], 0x414
jmp 0x5c4458
cmp esi, 4
jne 0x5c4408
mov dword [esp + 0x10], 0x6d6
mov dword [esp + 0x14], 0x415
jmp 0x5c4458
cmp esi, 5
jne 0x5c441f
mov dword [esp + 0x10], 0x6d7
mov dword [esp + 0x14], 0x416
jmp 0x5c4458
cmp esi, 6
jne 0x5c4436
mov dword [esp + 0x10], 0x6d8
mov dword [esp + 0x14], 0x417
jmp 0x5c4458
cmp esi, 7
jne 0x5c444d
mov dword [esp + 0x10], 0x6d9
mov dword [esp + 0x14], 0x418
jmp 0x5c4458
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov ecx, esi
call fcn.004d0930
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004d0c20
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.004d13e0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push eax
push ebp
call edi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push ecx
push ebp
call edi
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
push edx
push ebp
call edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push eax
push ebp
call edi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
push ecx
push ebp
call edi
mov edx, dword [esp + 0x10]
push 0
push edx
mov dword [esp + 0x28], eax
call ebx
mov eax, dword [esp + 0x14]
push 0
push eax
call ebx
mov ecx, dword [esp + 0x18]
push 0
push ecx
call ebx
mov edx, dword [esp + 0x1c]
push 0
push edx
call ebx
mov eax, dword [esp + 0x20]
push 0
push eax
call ebx
inc esi
cmp esi, 8
jl 0x5c4390
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x5d3f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8c
mov eax, dword [str.OVERLAY]
push ebx
push ebp
push esi
push edi
push 0
mov ebp, ecx
push eax
call fcn.0050aca0
mov ecx, ebp
push 0
push str.OverlayPack
call fcn.0050aca0
mov ecx, dword [0x821c78]
xor edi, edi
xor ebx, ebx
mov edx, dword [ecx]
call dword [edx + 0x80]
mov ecx, dword [0x821c78]
mov esi, eax
mov eax, dword [ecx]
call dword [eax + 0x7c]
imul esi, eax
mov ecx, dword [0x821c78]
push ebx
push edi
mov edx, dword [ecx]
call dword [edx + 0x5c]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], edi
push esi
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], vtable.Pipe.0
call fcn.00438140
lea ecx, [esp + 0x74]
mov dword [esp + 0x2c], edi
push 0x2000
push edi
mov dword [esp + 0x1c], vtable.BufferPipe.0
call fcn.00532ff0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x74]
push eax
call fcn.00606530
xor esi, esi
lea ecx, [esp + 0x10]
push 1
push ecx
mov ecx, 0x81a800
mov word [esp + 0x18], si
mov word [esp + 0x1a], di
call fcn.005453b0
add eax, 0x44
lea ecx, [esp + 0x78]
push eax
call fcn.005330a0
add ebx, eax
inc esi
cmp esi, 0x200
jl 0x5d3ffc
inc edi
cmp edi, 0x200
jl 0x5d3ffa
test ebx, ebx
je 0x5d4066
mov ecx, dword [0x821c78]
xor edx, edx
xor eax, eax
push ebx
mov esi, dword [ecx]
push edx
push eax
call dword [esi + 0x5c]
mov ecx, ebp
push eax
push str.OverlayPack
call fcn.0050c2c0
mov ecx, dword [0x821c78]
mov edx, dword [ecx]
call dword [edx + 0x60]
mov ecx, dword [0x821c78]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, ebp
push 0
push str.OverlayDataPack
call fcn.0050aca0
mov ecx, dword [0x821c78]
xor edi, edi
xor ebx, ebx
mov edx, dword [ecx]
call dword [edx + 0x80]
mov ecx, dword [0x821c78]
mov esi, eax
mov eax, dword [ecx]
call dword [eax + 0x7c]
imul esi, eax
mov ecx, dword [0x821c78]
push ebx
push edi
mov edx, dword [ecx]
call dword [edx + 0x5c]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], edi
push esi
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x38], vtable.Pipe.0
call fcn.00438140
lea ecx, [esp + 0x4c]
mov dword [esp + 0x48], edi
push 0x2000
push edi
mov dword [esp + 0x38], vtable.BufferPipe.0
call fcn.00532ff0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x4c]
push eax
call fcn.00606530
xor esi, esi
lea ecx, [esp + 0x10]
push 1
push ecx
mov ecx, 0x81a800
mov word [esp + 0x18], si
mov word [esp + 0x1a], di
call fcn.005453b0
add eax, 0x11e
lea ecx, [esp + 0x50]
push eax
call fcn.005330a0
add ebx, eax
inc esi
cmp esi, 0x200
jl 0x5d40f4
inc edi
cmp edi, 0x200
jl 0x5d40f2
test ebx, ebx
je 0x5d4160
mov ecx, dword [0x821c78]
xor edx, edx
xor eax, eax
push ebx
mov esi, dword [ecx]
push edx
push eax
call dword [esi + 0x5c]
mov ecx, ebp
push eax
push str.OverlayDataPack
call fcn.0050c2c0
mov ecx, dword [0x821c78]
mov edx, dword [ecx]
call dword [edx + 0x60]
mov ecx, dword [0x821c78]
mov eax, dword [ecx]
call dword [eax + 0x60]
lea ecx, [esp + 0x4c]
call fcn.00533060
lea ecx, [esp + 0x3c]
call fcn.00438290
lea ecx, [esp + 0x30]
call fcn.006064f0
lea ecx, [esp + 0x74]
call fcn.00533060
lea ecx, [esp + 0x20]
call fcn.00438290
lea ecx, [esp + 0x14]
call fcn.006064f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret
Function at 0x5de2e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0xa255a8
call fcn.00668ff0
test al, al
jne 0x5de4ba
mov eax, dword [0xa5b184]
xor edi, edi
test eax, eax
mov dword [esp + 0xc], esi
je 0x5de34a
lea ecx, [esp + 0xc]
call dword [0xa5b198]
mov ecx, dword [0xa5b18c]
mov edx, 1
shl edx, cl
dec edx
and edx, eax
mov eax, dword [0xa5b180]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x5de34a
mov ecx, dword [esp + 0xc]
cmp dword [eax], ecx
je 0x5de343
mov eax, dword [eax + 0x204]
test eax, eax
jne 0x5de333
jmp 0x5de34a
test eax, eax
je 0x5de34a
lea edi, [eax + 4]
mov al, byte [edi + 0xbd]
test al, al
je 0x5de361
cmp dword [edi + 0xb0], 1
jne 0x5de361
mov bl, 1
jmp 0x5de363
xor bl, bl
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
test bl, bl
je 0x5de4ba
test al, al
je 0x5de4ba
mov ecx, dword [0x821b68]
push ebp
push 0
mov edx, 0x2000
mov ecx, dword [ecx + 0x194]
push 0x3f800000
call fcn.00708810
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
setne dl
push 0
push esi
mov byte [esp + 0x20], dl
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push 0x5dca60
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [0xa5b184]
xor ebp, ebp
test eax, eax
mov dword [esp + 0x10], esi
je 0x5de414
lea ecx, [esp + 0x10]
call dword [0xa5b198]
mov ecx, dword [0xa5b18c]
mov edx, 1
shl edx, cl
dec edx
and edx, eax
mov eax, dword [0xa5b180]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x5de414
mov ecx, dword [esp + 0x10]
cmp dword [eax], ecx
je 0x5de40d
mov eax, dword [eax + 0x204]
test eax, eax
jne 0x5de3fd
jmp 0x5de414
test eax, eax
je 0x5de414
lea ebp, [eax + 4]
push 0
push 0
push esi
mov byte [ebp + 0xbe], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [esp + 0x14], eax
call fcn.005b28a0
mov eax, dword [0xa255a8]
test eax, eax
je 0x5de46b
cmp eax, 5
je 0x5de46b
mov al, byte [0xa2791c]
test al, al
jne 0x5de46b
mov eax, dword [0xa27dc8]
test eax, eax
jne 0x5de46b
call fcn.0053d4d0
test al, al
jne 0x5de470
call fcn.0053dac0
test al, al
jne 0x5de490
jmp 0x5de470
call fcn.004821e0
mov al, byte [ebp + 0xbe]
xor ecx, ecx
test al, al
sete cl
mov edi, ecx
call ebx
sub eax, dword [esp + 0x14]
cmp eax, 0x1388
jg 0x5de490
test edi, edi
je 0x5de432
push 0
push 0x5dca60
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov edx, dword [esp + 0x18]
and edx, 0xff
push edx
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x5f7d30
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov ebx, edx
mov ebp, ecx
push edi
push 0
mov edx, 0x5f7db0
mov ecx, 0xf0
call fcn.005f7180
mov esi, eax
test esi, esi
je 0x5f7da7
mov eax, dword [esp + 0x14]
push eax
push 8
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x5b0
push esi
call edi
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x4b2
push eax
call ebp
test ebx, ebx
je 0x5f7da7
push 0x5c0
push esi
call edi
mov edi, eax
push ebx
push 0
push 0x4b2
push edi
call ebp
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x605d70
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x84
push ebx
mov ebx, ecx
push 0x5e0
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
mov dword [esp + 8], eax
je 0x605da4
push 0
push 0
push 0x188
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0xa27dd0], eax
cmp dword [0xa27dd0], 0xffffffff
jle 0x605ea2
push 0xb0
call fcn.0076d5a7
add esp, 4
mov dword [esp + 4], eax
test eax, eax
je 0x605ea2
mov ecx, dword [0xa27e4c]
mov edx, dword [0xa27dd0]
push ebp
push esi
mov ebp, dword [ecx + edx*4]
push edi
mov ecx, 0x2c
mov esi, ebp
mov edi, eax
push 0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0xb0de30]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push esi
call fcn.00605f50
cmp al, 1
jne 0x605e87
mov ecx, 0x2c
mov edi, ebp
mov byte [ebx + 8], al
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.006058d0
mov ecx, dword [0xa27e58]
xor eax, eax
test ecx, ecx
jle 0x605e42
mov edx, dword [0xa27e4c]
cmp dword [edx], ebp
je 0x605e45
inc eax
add edx, 4
cmp eax, ecx
jl 0x605e36
or eax, 0xffffffff
cmp eax, 0xffffffff
mov dword [0xa27dd0], eax
jle 0x605e87
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x186
push edx
call esi
mov eax, dword [ebx]
push 0x5e5
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x605e87
add ebp, 0x9a
push ebp
push 0
push 0x4b4
push eax
call esi
mov ecx, dword [ebx]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x10]
push edx
call fcn.0076d2d5
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret