joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40262f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x3e9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x41e737
push dword [0x4b6a68]
push 0x152
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4ce72c], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x4027c9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
sub esp, 0x10
call fcn.0041c60f
imul edx, eax, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
add dword [ebp - 0x18], eax
push 0
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x1c]
inc eax
imul eax, eax, 0x14
mov dword [ebp - 0x14], eax
push 0
push eax
add ecx, 8
call fcn.004191a9
mov ecx, dword [ebp - 0x14]
sub dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 1
jne 0x40287e
push dword [ebp - 0x10]
push dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.004025a7
test eax, eax
je 0x40287e
mov dword [ebp - 0x14], eax
jmp 0x402832
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp dl, byte [eax + 0x1d]
jae 0x40284e
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
jmp 0x40282f
mov byte [ebp - 8], 0
jmp 0x402857
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp dl, byte [eax + 0x1e]
jae 0x402877
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4 + 0xa0], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
jmp 0x402854
mov eax, 1
jmp 0x402880
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402a25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 1
mov ecx, dword [ebp - 8]
call fcn.00402524
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.004192c5
push 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00418f5c
test eax, eax
je 0x402a9e
push 1
mov ecx, dword [ebp - 8]
call fcn.0040369f
lea edx, [ebp - 4]
push edx
push 0
push dword [ebp - 8]
push 0x41295c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
test eax, eax
je 0x402a97
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
jmp 0x402aa0
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40b1f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
sub esp, 0xd4
lea ecx, [ebp - 0xdc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00421df2
push dword [ebp - 8]
push 0x3f8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 8]
call fcn.004375e9
push 0x5ab
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.0040c45a
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40b271
cmp byte [ebp + 0x10], 0xff
je 0x40b271
push 5
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0x10]
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x40b28f
push 0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x492e2c
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0x10], 0
jne 0x40b2c3
push 0x565
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5ad
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
call fcn.0040b460
push dword [eax*4 + 0x48bc04]
push 0x3ff
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0x12], 0xff
jne 0x40b2fe
push 0x48b284
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x40b317
mov ecx, dword [ebp - 8]
call fcn.0040d85e
push 0
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.00461fc8
lea edx, [ebp - 0x70]
push edx
push 0x401
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.0040df60
lea edx, [ebp - 0x70]
push edx
push 0x5af
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
call fcn.0041b4f7
mov dword [ebp - 0xc], eax
jmp 0x40b36b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0x50
jae 0x40b3cf
push dword [ebp - 4]
call fcn.0040687c
add esp, 4
cmp al, 0xff
je 0x40b368
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + 0x11]
cmp al, 0x1a
jae 0x40b39f
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b782
call fcn.00466bb9
jmp 0x40b3b3
mov al, byte [ecx + 0x14]
cmp al, 3
je 0x40b368
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0045bc13
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x5c0
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40b368
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b418
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [0x4b6a60]
push 0x4132c9
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4cea0c], eax
pop ebp
ret

Function at 0x40c2ad
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
cmp byte [0x5005a0], 0
je 0x40c2e1
jmp 0x40c2c0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
jae 0x40c2e1
add eax, 0x7e4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c2bd
mov esp, ebp
pop ebp
ret 4

Function at 0x40d5a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call fcn.004373c7
call fcn.00420231
push 0x4b2c50
call fcn.0040b6f9
push 0x4b313c
call fcn.0040b6f9
push 0x4c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
xor ecx, ecx
push ecx
movzx eax, byte [0x500c97]
push eax
mov ax, word [0x500c95]
push eax
push ecx
push ecx
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x40dfba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040b913
cmp al, 2
jne 0x40dfff
call fcn.00414dbe
call fcn.004298f7
movzx eax, ax
mov dword [ebp - 4], eax
and eax, 8
test eax, eax
je 0x40dffa
push 0
push dword [0x4ff3d0]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
jmp 0x40e005
mov ax, word [0x4abf9c]
mov esp, ebp
pop ebp
ret

Function at 0x40ec30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
cmp al, 0
je 0x40ec3e
cmp al, 0xcc
jne 0x40ec97
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ebf5
mov dword [ebp - 8], eax
jmp 0x40ec51
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0xa
jae 0x40ec97
imul eax, eax, 3
add eax, 0x501ae1
inc eax
mov edx, dword [eax]
cmp word [ebp - 8], dx
jne 0x40ec4e
movzx ecx, byte [eax + 2]
mov dword [ebp - 8], ecx
mov eax, 0x2c040
call fcn.00401536
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x1b0
add eax, ecx
push 4
push eax
push 0xc
push 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451913
mov esp, ebp
pop ebp
ret 8

Function at 0x4158ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x4b5fd0]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b6a68]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
mov esp, ebp
pop ebp
ret 4
Function at 0x418ed4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
call fcn.0045bc49
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4196f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
call fcn.00403116
push eax
sub esp, 0x28
cmp byte [0x4ac63c], 3
je 0x419733
cmp word [ebp + 0xc], 0x56b
jne 0x419733
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
test cx, cx
jne 0x419733
push dword [ebp + 8]
mov ecx, 0x496f38
call fcn.00438fc1
test eax, eax
jne 0x419738
jmp 0x41982a
push 0
call fcn.004759bc
add esp, 4
mov ecx, 0x496f38
call fcn.0041ca50
call fcn.0041e5f6
xor ecx, ecx
mov eax, dword [ebp + 8]
cmp al, 3
jae 0x4197d9
mov edx, 0x496f4c
cmp dword [edx + eax*4], ecx
je 0x4197bf
cmp dword [ebp - 8], ecx
je 0x4197bf
mov cl, byte [eax + 0x407d1a]
push ecx
call fcn.0040c755
push eax
call fcn.00419933
push eax
mov eax, dword [ebp + 8]
imul edx, eax, 0xf
add edx, 0x48b49b
push edx
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x30]
push edx
call fcn.0042d5d3
push 0
push dword [ebp - 0x34]
push 0x48b496
call fcn.0042d5d3
xor ecx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x496f4c
mov dword [edx + eax*4], ecx
cmp al, 0
jne 0x4197c6
inc ecx
jmp 0x4197ca
cmp al, 1
jne 0x4197d2
push ecx
call fcn.00461cf6
jmp 0x419812
call fcn.00461c8f
jmp 0x419812
cmp al, 3
jne 0x419812
push 1
mov ecx, 0x492f90
call fcn.00418599
mov dword [ebp - 4], eax
test eax, eax
je 0x419812
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0042c858
add esp, 4
mov dword [0x4ae4c0], 1
cmp dword [ebp - 4], 0
jne 0x41982a
mov byte [0x496f48], 0
call fcn.0040e8ee
push eax
call fcn.004759bc
mov esp, ebp
pop ebp
ret 8
Function at 0x41994e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0041ca50
push 0x186
push 0x280
xor ecx, ecx
push ecx
mov eax, dword [ebp - 4]
inc ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, 0x500a6e
mov dword [ecx], 0x496f30
mov dword [ecx + 4], 0x496f58
mov dword [ecx + 8], 0x496f5c
mov dword [ecx + 0xc], 0x496f34
jmp 0x419996
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp al, 4
jae 0x4199ce
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax*4], 0
jne 0x419993
push eax
push 0x4195aa
push dword [0x4b6a68]
push 0x129
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [ecx + edx*4], eax
jmp 0x419993
call fcn.0041df2d
mov byte [ebp - 0x10], 0
jmp 0x4199dc
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, 4
jae 0x419a49
mov eax, dword [0x505f00]
shr eax, cl
test al, 1
jne 0x4199d9
push 1
push 0x32
push 0x32
push dword [ebp - 8]
sub dword [ebp - 0xc], 0x32
push dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push dword [eax + ecx*4]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 8], 0
jne 0x419a49
push 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x101
push 0
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp + 8], 0
jne 0x4199d9
push 0
call fcn.00423971
jmp 0x4199d9
call fcn.004768c0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x41f0d5
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ecx
push ecx
cmp dword [ecx + 0x10], 0
je 0x41f0ef
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
call fcn.0041f6a8
push dword [ebp + 8]
push 0x80000000
push 0
push dword [ebp + 0xc]
push 0
push 0
push 0
jmp 0x41f107
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jae 0x41f12a
lea edx, [ebp - 0x2c]
push edx
push 0x30200
push 0x803
push 0
call dword [sym.imp.WINMM.dll_mciSendCommandA]
test eax, eax
jne 0x41f104
inc dword [ebp - 4]
cmp dword [ebp - 4], 0
je 0x41f1f1
movzx eax, word [ebp - 0x28]
mov word [0x497ae0], ax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov al, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [ecx + 0x10], eax
lea edx, [ebp - 0x20]
push edx
push 0x40000
push 0x841
push dword [ebp - 0xc]
call dword [sym.imp.WINMM.dll_mciSendCommandA]
mov dword [ebp - 0x24], 0x4001
lea ecx, [ebp - 0x2c]
push ecx
push 0x100
push 0x814
push dword [ebp - 0xc]
call dword [sym.imp.WINMM.dll_mciSendCommandA]
mov eax, dword [ebp - 0x28]
mov dword [0x497a9c], eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
call fcn.0041f703
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [0x497a9c]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [0x4b6a60]
push 0x41ef96
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x497a98], eax
mov eax, 1
jmp 0x41f20e
push 0x30
push 0x48e9c4
push 0x48b734
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], eax
mov esp, ebp
pop ebp
ret 8
Function at 0x42189b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov cl, byte [ecx + 1]
call fcn.004061f9
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0x43
je 0x4218cc
cmp byte [ecx], 0x42
je 0x4218cc
push dword [ecx + 0xd]
push dword [ecx + 1]
call fcn.00435829
add esp, 8
jmp 0x4218d6
mov ecx, dword [ebp - 0x14]
push 2
call fcn.00406670
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + 0xd]
call fcn.004061f9
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00403b96
push 8
mov ecx, 0x4b1b18
call fcn.0042c45f
push 1
push 8
mov ecx, 0x4b69b0
call fcn.0047467a
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x254]
and eax, 0x70
cmp eax, 0x70
je 0x421948
mov ecx, dword [ebp - 0x18]
call fcn.00403360
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2cb
call fcn.0040659b
mov eax, dword [ebp - 0x10]
push dword [eax + 0x2cc]
push dword [eax + 0x2cb]
mov ecx, 0x4b4250
call fcn.0045503f
call fcn.0041e5db
mov ecx, 0x4b4250
call fcn.0045461c
mov ecx, dword [ebp - 0x14]
call fcn.0043fcc9
mov ecx, dword [ebp - 0x14]
call fcn.00403360
mov edx, dword [eax]
mov dword [ebp - 4], edx
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0044fa1f
add esp, 8
push dword [ebp - 4]
call fcn.0044fa7e
add esp, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
mov eax, 0x3000
call fcn.004015b1
mov dword [ebp - 8], eax
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
movzx eax, byte [ebp - 0x1f]
push eax
mov al, byte [ebp - 0x20]
push eax
call fcn.004036f9
call fcn.0040159c
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + 2], 1
jne 0x421a02
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
call fcn.0041e5f6
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
mov ecx, dword [ebp - 0x10]
push dword [ecx + 1]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0040e9e5
jmp 0x421a25
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 1]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451347
call fcn.0041e5f6
call fcn.0042c4e0
call fcn.0047eb97
mov dword [ebp - 0x14], eax
push 1
push 0x27
mov ecx, 0x4b69b0
call fcn.0047467a
cmp byte [0x505fdc], 0
jne 0x421a64
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx]
call fcn.00484002
push ecx
push 0x48b58c
push 2
call fcn.0042f699
add esp, 0xc
call fcn.0047eb97
sub eax, dword [ebp - 0x14]
mov ecx, 0x14
sub ecx, eax
cmp ecx, 0
jle 0x421a83
push ecx
mov ecx, 0x4b1b18
call fcn.0042c45f
call fcn.0042c4e0
push 0
push dword [ebp - 8]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451913
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x429cae
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
jmp 0x429cb9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x429cd0
push 0
mov edx, dword [ebp - 8]
push dword [edx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x429cb6
leave
ret

Function at 0x42c223
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4b6930
call fcn.0042c430
mov dword [ebp - 0xc], 0
push 0
call fcn.0042b81b
add esp, 4
mov ecx, 0x4ac63c
call fcn.0041edef
mov dword [ebp - 8], eax
push 0
call fcn.004759bc
add esp, 4
mov eax, dword [ebp - 8]
cmp eax, 3
je 0x42c29a
mov ecx, 0x4b6a98
call fcn.004848b5
test eax, eax
jne 0x42c295
push 1
mov ecx, 0x4b6a98
call fcn.00475e67
call fcn.00476870
mov ecx, 0x4b0770
call fcn.00408808
push eax
call fcn.00476715
nop
nop
nop
call fcn.00476882
mov edx, dword [ebp - 8]
cmp edx, 4
ja case.default.0x42c2a6
jmp dword [edx*4 + 0x42c3e4]
call fcn.0040dfba
movzx eax, ax
jmp 0x42c2e8
call fcn.0040be47
jmp 0x42c2e8
call fcn.00416a9b
mov ecx, 0x4b2b98
test al, al
je 0x42c2db
call fcn.0041ff21
call fcn.0040dfba
movzx eax, ax
jmp 0x42c2e8
call fcn.00433325
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xc], eax
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7fffffff
div ecx
push edx
call fcn.0047fb05
add esp, 4
mov ecx, 0x4b3d08
call fcn.0044f058
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
ja case.0x42c33d.1
mov eax, dword [ebp - 0x14]
jmp dword [eax*4 + 0x42c3f8]
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
jmp 0x42c388
mov dword [ebp - 4], 1
push 0
mov ecx, 0x4b3d08
call fcn.0040be38
jmp 0x42c388
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
jmp 0x42c388
call fcn.0047b4f7
mov eax, dword [ebp - 0xc]
or al, 8
mov dword [ebp - 0xc], eax
jmp 0x42c388
push 0
call fcn.004759bc
add esp, 4
cmp dword [ebp - 4], 1
jne 0x42c397
mov dword [ebp - 4], 0
jmp 0x42c3a3
mov ecx, 0x492f90
call fcn.00417e95
jmp 0x42c3a8
jmp 0x42c301
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov byte [0x4ab020], 0
call fcn.004180f9
mov ecx, dword [ebp - 0xc]
and ecx, 0x6c
test ecx, ecx
je 0x42c3d8
push 0
mov ecx, 0x4b6a98
call fcn.00475e67
jmp 0x42c3dd
jmp 0x42c229
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x44a3f6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov byte [ecx + 0x18], al
inc eax
mov dword [ecx + 0x14], eax
push 0
push dword [0x4b5fdc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x44f058
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [0x497738]
mov dword [ebp - 4], eax
test eax, eax
je 0x44f077
mov ecx, dword [ebp - 8]
call fcn.0044d0af
jmp 0x44f07f
mov ecx, dword [ebp - 8]
call fcn.0044d2ca
xor ecx, ecx
mov byte [0x4ab020], cl
mov dword [0x497738], ecx
mov ecx, dword [ebp - 8]
call fcn.0044a3f6
mov ecx, dword [ebp - 8]
call fcn.0044a971
mov ecx, dword [ebp - 8]
cmp byte [ecx + 1], 0
jne 0x44f0cd
cmp dword [ebp - 4], 0
jne 0x44f0cd
mov ecx, 0x492f90
call fcn.00406587
test eax, eax
je 0x44f0cd
nop
nop
mov ecx, 0x492f90
call fcn.004180c1
call fcn.0047eac4
jmp 0x44f0ac
mov ecx, dword [ebp - 8]
call fcn.00449ef0
mov ecx, dword [ebp - 8]
call fcn.0044a36f
mov ecx, dword [ebp - 8]
call fcn.00449eca
mov ecx, dword [ebp - 8]
call fcn.00449ea4
push 1
mov ecx, 0x4b6bc0
call fcn.00476176
mov ecx, 0x4b0770
call fcn.00482938
and eax, 0x8000
test eax, eax
je 0x44f134
mov ecx, dword [ebp - 8]
call fcn.0044a88a
push 8
push dword [0x4b5fd8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x51c], 0
call fcn.0044a6dd
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0044eec5
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 1]
mov esp, ebp
pop ebp
ret
Function at 0x4682d6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x58]
mov edx, dword [ebp + 8]
and edx, 0xff
cmp ecx, edx
je 0x468311
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x468311
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
mov dl, byte [ebp + 8]
mov byte [ebp - 8], dl
cmp byte [ebp - 8], 0
je 0x468325
cmp byte [ebp - 8], 1
je 0x468352
jmp 0x46837d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xdc0
call fcn.0041b500
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.0041b500
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46837d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.0041b500
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0xdc0
call fcn.0041b500
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
mov byte [eax + 0x58], cl
mov esp, ebp
pop ebp
ret 4

Function at 0x468e59
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push dword [ebp + 0xc]
call fcn.0047fc5a
add esp, 4
mov dword [ebp - 4], eax
push 0x1a0
lea ecx, [ebp - 0x1a4]
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, dword [ebp - 4]
jne 0x468ea0
lea ecx, [ebp - 0x1a4]
push ecx
push dword [ebp + 0xc]
call fcn.0047fcc3
add esp, 8
test eax, eax
je 0x468eae
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x468eaf
inc eax
mov esp, ebp
pop ebp
ret 8