joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8b10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x765d30], 0
je 0x4e8b32
mov eax, dword [0x765d30]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
jmp 0x4e8c5a
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x7619b8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
sub eax, 0x3c
push eax
push 0
mov ecx, dword [0x6972b8]
push ecx
call fcn.005dcad0
add esp, 0xc
mov dword [0x6972b8], eax
mov edx, dword [ebp - 4]
sub edx, 0x3c
push edx
push 0
mov eax, dword [0x6972bc]
push eax
call fcn.005dcad0
add esp, 0xc
mov dword [0x6972bc], eax
cmp dword [0x752038], 0
je 0x4e8b90
mov ecx, dword [0x752038]
mov dword [ebp - 0x14], ecx
jmp 0x4e8b99
mov edx, dword [0x7619b8]
mov dword [ebp - 0x14], edx
push 0
mov eax, dword [0x761714]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [0x6972c4]
add edx, eax
push edx
mov eax, dword [0x6972c0]
push eax
mov ecx, dword [0x6972bc]
push ecx
mov edx, dword [0x6972b8]
push edx
push 0x54c80000
push str.Area_Tools
push str.areaClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x765d30], eax
cmp dword [0x765d30], 0
jne 0x4e8bf8
mov eax, 1
jmp 0x4e8c5a
mov eax, dword [0x761904]
push eax
mov ecx, dword [0x765d30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x765d30]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0x13
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x765d30]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x765d30]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 8
push 0x268
mov edx, dword [0x7567cc]
push edx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x511ec0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x511edb
xor eax, eax
jmp 0x511ffa
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x30], eax
push 8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x20], eax
push 0xa
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
jge 0x511f4a
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x1c], 0
jge 0x511f57
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
jle 0x511f65
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 4]
jle 0x511f73
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
push 0xcc0020
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x5146e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push edi
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [0x7567cc]
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], str.Elapsed:_Apply_canvas
mov edi, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.005e16a0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
sar ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
lea edx, [ecx*4 + 0xf]
mov word [ebp - 0x64], dx
mov eax, dword [ebp - 0x1c]
and eax, 0xffff
add eax, 0x14
mov word [ebp - 0x60], ax
mov dword [ebp - 0x14], str.Elapsed:_
mov edi, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.005e16a0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
and eax, 0xffff
mov dword [0x744960], eax
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [0x7567cc]
push edx
call dword [sym.imp.USER32.dll_EndPaint]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x7619b8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 8]
sub edx, 0x3c
push edx
push 0
mov eax, dword [0x696630]
push eax
call fcn.005dcad0
add esp, 0xc
mov dword [0x696630], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x3c
push ecx
push 0
mov edx, dword [0x696634]
push edx
call fcn.005dcad0
add esp, 0xc
mov dword [0x696634], eax
push 0
mov eax, dword [0x761714]
push eax
push 0
mov ecx, dword [0x7619b8]
push ecx
movsx esi, word [ebp - 0x64]
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add esi, eax
push esi
movsx edx, word [ebp - 0x60]
push edx
mov eax, dword [0x696634]
push eax
mov ecx, dword [0x696630]
push ecx
push 0x54c80000
push str.Chronograph
push str.chronClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x756784], eax
cmp dword [0x756784], 0
jne 0x514842
mov eax, 1
jmp 0x5148b2
mov edx, dword [0x761904]
push edx
mov eax, dword [0x756784]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x756784]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edx, dword [0x756784]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 8
push 0x77
mov eax, dword [0x7567cc]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
movsx ecx, word [ebp - 0x64]
push ecx
movsx edx, word [ebp - 0x60]
push edx
push 0
push 0
push 0x16f
mov eax, dword [0x756784]
push eax
call fcn.00559460
add esp, 0x18
mov word [0x7645a0], 1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5162f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x516303
jmp 0x5163b7
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
test ecx, ecx
jne 0x51631b
jmp 0x5163b7
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5163b7
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x7567cc]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 1
jne 0x5163ad
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp - 8]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x5163a5
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x5163b7
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x517410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
call fcn.0056d660
cmp dword [ebp + 8], 0
jne 0x517454
mov eax, dword [ebp + 8]
push eax
push str.No_help_index:_NULL_Pointer
lea ecx, [ebp - 0x108]
push ecx
call fcn.00667e70
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0
push 0x17
call fcn.005e03c0
add esp, 0xc
jmp 0x5175a5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x51748e
mov edx, dword [ebp + 8]
push edx
push str.No_help_index:_Empty_String
lea eax, [ebp - 0x108]
push eax
call fcn.00667e70
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x17
call fcn.005e03c0
add esp, 0xc
jmp 0x5175a5
mov dword [ebp - str.layers_help], 0x68b2d0
mov dword [ebp - 0x110], 1
cmp dword [ebp - 0x110], 0
je 0x5175a5
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
push ecx
call fcn.006756c0
add esp, 8
test eax, eax
jne 0x517551
mov dword [ebp - 0x110], 0
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx + 4]
push eax
push str.html_docs
push str._s_s.html
lea ecx, [ebp - 0x108]
push ecx
call fcn.00667e70
add esp, 0x10
push 1
push 0x6a1224
push 0
lea edx, [ebp - 0x108]
push edx
push str.open
mov eax, dword [0x7567cc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jg 0x51754f
mov ecx, dword [ebp - 4]
push ecx
push str.lasterror_d
lea edx, [ebp - 0x108]
push edx
call fcn.00667e70
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [0x7567cc]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x5175a0
mov edx, dword [ebp - 0x10c]
add edx, 8
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
cmp dword [eax], 0
jne 0x5175a0
mov dword [ebp - 0x110], 0
mov ecx, dword [ebp + 8]
push ecx
push str.No_help_index:___s_
lea edx, [ebp - 0x108]
push edx
call fcn.00667e70
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0x17
call fcn.005e03c0
add esp, 0xc
jmp 0x5174a2
mov esp, ebp
pop ebp
ret
Function at 0x51e120
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x7567cc]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x190
mov dword [ebp - 0x18], 0x12c
push 0x20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x28], edx
push 0x21
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
mov dword [0x744de4], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x744de8], ecx
push 0x1a90
mov edx, dword [0x761714]
push edx
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [0x7619d8], eax
cmp dword [0x7619d8], 0
jne 0x51e1d1
cmp dword [0x74f5b8], 0
je 0x51e1c7
push str.DIAG_the_splash_bmp_failed_to_load_n
mov eax, dword [0x74f5b8]
push eax
call fcn.00666c30
add esp, 8
mov eax, 1
jmp 0x51e309
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x51e1ec
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x18]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x51e207
mov dword [ebp - 4], 0
cmp dword [0x7619b8], 0
je 0x51e25e
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x7567cc]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x7619b8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x34]
sub esi, dword [ebp - 0x10]
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esi, eax
push 0xf
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esi, eax
sub esi, 0x14
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov edx, dword [ebp - 4]
add edx, eax
mov dword [ebp - 4], edx
push 0
mov eax, dword [0x761714]
push eax
push 0
mov ecx, dword [0x7567cc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x54040000
push 0
push str.splashClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x75b014], eax
cmp dword [0x75b014], 0
jne 0x51e2c1
cmp dword [0x74f5b8], 0
je 0x51e2bd
push str.DIAG_the_splash_window_failed_to_open_n
mov eax, dword [0x74f5b8]
push eax
call fcn.00666c30
add esp, 8
xor eax, eax
jmp 0x51e309
mov ecx, dword [0x761904]
push ecx
mov edx, dword [0x75b014]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x75b014]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, dword [0x75b014]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x1388
push 0x463
mov edx, dword [0x75b014]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5208c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
movsx eax, byte [0x76aee0]
test eax, eax
jne 0x5208da
jmp 0x5209dc
mov dword [ebp - 0x10c], 0
mov edi, 0x76aee0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
cmp ecx, 7
jbe 0x52093e
push 7
push str.http:__
push 0x76aee0
call fcn.00675a90
add esp, 0xc
test eax, eax
jne 0x52091c
mov dword [ebp - 0x10c], 1
push 7
push str.mailto:
push 0x76aee0
call fcn.00675a90
add esp, 0xc
test eax, eax
jne 0x52093e
mov dword [ebp - 0x10c], 1
cmp dword [ebp - 0x10c], 0
je 0x520962
push 0x76aee0
push 0x67d1dc
lea ecx, [ebp - 0x108]
push ecx
call fcn.00667e70
add esp, 0xc
jmp 0x520980
push 0x76aee0
push str.html_docs
push 0x68e714
lea edx, [ebp - 0x108]
push edx
call fcn.00667e70
add esp, 0x10
call fcn.0056d660
push 1
push 0x6a1224
push 0
lea eax, [ebp - 0x108]
push eax
push str.open
mov ecx, dword [0x7567cc]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jg 0x5209dc
mov edx, dword [ebp - 4]
push edx
push str.lasterror_d
lea eax, [ebp - 0x108]
push eax
call fcn.00667e70
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0x7567cc]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5241f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x761940], 0
je 0x524212
mov eax, dword [0x761940]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
jmp 0x524367
call fcn.00529250
test eax, eax
je 0x524225
mov eax, 1
jmp 0x524367
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x7619b8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
sub eax, 0x3c
push eax
push 4
mov ecx, dword [0x6972d8]
push ecx
call fcn.005dcad0
add esp, 0xc
mov dword [0x6972d8], eax
mov edx, dword [ebp - 4]
sub edx, 0x3c
push edx
push 4
mov eax, dword [0x6972dc]
push eax
call fcn.005dcad0
add esp, 0xc
mov dword [0x6972dc], eax
push 0
mov ecx, dword [0x761714]
push ecx
push 0
mov edx, dword [0x7619b8]
push edx
mov eax, dword [0x6972e4]
push eax
mov ecx, dword [0x6972e0]
push ecx
mov edx, dword [0x6972dc]
push edx
mov eax, dword [0x6972d8]
push eax
push 0x54ce0000
push str.Film_Strip
push str.filmClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x761940], eax
cmp dword [0x761940], 0
jne 0x5242e7
cmp dword [0x74f5b8], 0
je 0x5242dd
push str.Open_filmWnd_failed_n
mov ecx, dword [0x74f5b8]
push ecx
call fcn.00666c30
add esp, 8
mov eax, 1
jmp 0x524367
mov edx, dword [0x761904]
push edx
mov eax, dword [0x761940]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x761940]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edx, dword [0x761940]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x761940]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov dx, word [ebp - 4]
mov word [0x7656fc], dx
push 0
push 0
mov eax, dword [0x761940]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 8
push 0x385
mov ecx, dword [0x7567cc]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [0x697e70], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x55dcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
mov edi, 0x696550
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0xc], ecx
call fcn.0055dc60
mov eax, dword [ebp + 8]
push eax
call fcn.0055db90
add esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
jmp 0x55dd1c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jge 0x55ddcf
mov dword [ebp - 0x10], 0
jmp 0x55dd38
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 4
jge 0x55dda9
mov dword [ebp - 0x18], 0
jmp 0x55dd50
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 0xc]
movsx ecx, byte [edx + 0x696550]
add ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x18], ecx
jge 0x55dd6d
call fcn.0055dc80
jmp 0x55dd47
call fcn.0055dcc0
mov cl, al
and ecx, 0xff
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx + 0x696550]
xor eax, ecx
cdq
mov ecx, 9
idiv ecx
add edx, 0x30
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
mov byte [eax], dl
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x55dd2f
cmp dword [ebp - 8], 3
je 0x55ddc1
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
mov byte [edx], 0x2d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x55dd13
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
mov byte [edx], 0
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x561d20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x3c
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x40]
push edx
call fcn.00517410
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x567e50
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push edi
push 0x765200
push str._s_fxfthumb
push 0x7514a0
call fcn.00667e70
add esp, 0xc
push 0x7514a0
call fcn.005f6770
add esp, 4
test eax, eax
je 0x567f9a
push 0x765200
push 0x690a24
push 0x7514a0
call fcn.00667e70
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
push 0x7514a0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x567ebd
jmp 0x567f9a
mov dword [ebp - 0x14c], 1
cmp dword [ebp - 0x14c], 0
je 0x567f90
mov ecx, dword [ebp - 0x144]
and ecx, 0x10
test ecx, ecx
jne 0x567f74
lea edx, [ebp - 0x118]
push edx
push 0x765200
push 0x68e714
push 0x7514a0
call fcn.00667e70
add esp, 0x10
mov edi, 0x7514a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x148], ecx
cmp dword [ebp - 0x148], 4
jle 0x567f30
mov eax, dword [ebp - 0x148]
mov byte [eax + 0x75149c], 0
push 0x7514a0
call fcn.005f6710
add esp, 4
test eax, eax
jne 0x567f74
lea ecx, [ebp - 0x118]
push ecx
push 0x765200
push str._s_fxfthumb_s
push 0x7514a0
call fcn.00667e70
add esp, 0x10
push 0x7514a0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x148], 0
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x14c], eax
jmp 0x567ec7
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5a64c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x766138], 0
je 0x5a64e2
mov eax, dword [0x766138]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
jmp 0x5a664c
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x7619b8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
sub eax, 0x3c
push eax
push 4
mov ecx, dword [0x696a10]
push ecx
call fcn.005dcad0
add esp, 0xc
mov dword [0x696a10], eax
mov edx, dword [ebp - 4]
sub edx, 0x3c
push edx
push 4
mov eax, dword [0x696a14]
push eax
call fcn.005dcad0
add esp, 0xc
mov dword [0x696a14], eax
push 0
mov ecx, dword [0x761714]
push ecx
push 0
mov edx, dword [0x7619b8]
push edx
mov eax, dword [0x696a1c]
push eax
mov ecx, dword [0x696a18]
push ecx
mov edx, dword [0x696a14]
push edx
mov eax, dword [0x696a10]
push eax
push 0x54fc0000
push str.Time_Line
push str.timeClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x766138], eax
cmp dword [0x766138], 0
jne 0x5a6598
push 0x691a84
push 1
push 0x17
call fcn.005e03c0
add esp, 0xc
mov eax, 1
jmp 0x5a664c
mov ecx, dword [0x761904]
push ecx
mov edx, dword [0x766138]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x766138]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 1
push 0
mov ecx, dword [0x766138]
push ecx
call dword [sym.imp.USER32.dll_ShowScrollBar]
push 1
mov edx, dword [0x694738]
sub edx, 1
push edx
call fcn.005dcbc0
add esp, 4
push eax
push 0
push 0
mov eax, dword [0x766138]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 1
push 1
mov ecx, dword [0x766138]
push ecx
call dword [sym.imp.USER32.dll_ShowScrollBar]
push 1
call fcn.005ad600
sub eax, 1
push eax
call fcn.005dcbc0
add esp, 4
push eax
push 0
push 1
mov edx, dword [0x766138]
push edx
call dword [sym.imp.USER32.dll_SetScrollRange]
mov eax, dword [0x766138]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, dword [0x766138]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x766138]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5b5c00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x7619b8], 0
je 0x5b5c20
mov eax, dword [0x7619b8]
mov dword [0x752038], eax
mov eax, dword [0x752038]
jmp 0x5b5c8e
push 9
mov ecx, dword [0x7567cc]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xbf4
lea edx, [ebp - 8]
push edx
mov eax, dword [0x761714]
push eax
push 0
mov ecx, dword [0x7567cc]
push ecx
push 0x12c
push 0x190
push 0x14
push 0x14
push 0x42000001
push 0
push str.mdiclient
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x752038], eax
push 5
mov edx, dword [0x752038]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x752038]
mov esp, ebp
pop ebp
ret