joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542be0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [0x7f7170]
test ecx, ecx
je 0x542c28
mov eax, dword [ecx]
push 0x7425a0
push str.IDS_CONVERTER_TITLE
call dword [eax + 8]
jmp 0x542c2d
mov eax, 0x790eb0
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [edi + 4]
call ebx
mov ecx, dword [0x7f7170]
test ecx, ecx
je 0x542c56
mov eax, dword [ecx]
push 0x7425a0
push str.IDS_CONVERTER_ADDPLAYLIST
call dword [eax + 8]
mov esi, eax
jmp 0x542c5b
mov esi, 0x790eb0
push 0x71a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x71b
push dword [edi + 4]
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x713
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0x72e
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0x726
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0x727
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0x728
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0x729
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0x712
push dword [edi + 4]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x20], xmm0
call ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
sub dword [ebp - 0x1c], 0x50
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.USER32.dll_ScreenToClient]
push eax
push dword [edi + 4]
call esi
test eax, eax
je 0x542d1f
lea eax, [ebp - 0x18]
push eax
push dword [edi + 4]
call esi
push 0x712
push dword [edi + 4]
call ebx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
sub ecx, esi
mov edx, dword [ebp - 0x20]
push 4
push ecx
mov ecx, dword [ebp - 0x18]
sub ecx, edx
push ecx
push esi
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.00543fa0
mov ecx, edi
call fcn.00543ed0
mov ecx, edi
call fcn.00552e50
push dword [0x7f7604]
push 0x71a
push dword [edi + 4]
call fcn.00432c90
add esp, 0xc
mov ecx, 0x7f7608
call fcn.00429100
push eax
call fcn.005b6cf0
add esp, 4
test eax, eax
jne 0x542dc3
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x24]
push 0x74218c
push eax
call fcn.005b5ac0
add esp, 0x10
push eax
mov ecx, 0x7f7608
mov dword [ebp - 4], 0
call fcn.004289a0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x544800
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709e13
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 4]
mov dword [edi], vtable.CPolicy.0
call fcn.00429050
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
call fcn.00429050
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.00429050
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 2
call fcn.00429050
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 3
call fcn.00429050
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.00547d50
mov dword [edi + 0x18], eax
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 5
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.00547d50
mov dword [edi + 0x20], eax
lea ecx, [edi + 0x28]
mov byte [ebp - 4], 6
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00536d20
mov dword [edi + 0x28], eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 7
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.005de3e0
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x38]
mov byte [ebp - 4], 8
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
call fcn.005522f0
mov dword [edi + 0x38], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5449a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709ed0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00428690
mov eax, dword [esi + 4]
lea ecx, [edi + 0x10]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.00428690
lea eax, [esi + 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x14]
call fcn.00428690
lea eax, [esi + 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x18]
call fcn.00428690
lea eax, [esi + 0x1c]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x1c]
call fcn.00428690
lea eax, [esi + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x20]
call fcn.00428690
lea eax, [esi + 0x24]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x24]
call fcn.00428690
lea eax, [esi + 0x28]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x28]
call fcn.00428690
lea eax, [esi + 0x2c]
mov byte [ebp - 4], 7
push eax
lea ecx, [edi + 0x2c]
call fcn.00428690
lea eax, [esi + 0x30]
mov byte [ebp - 4], 8
push eax
lea ecx, [edi + 0x30]
call fcn.00428690
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x544ce0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709f6c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CPolicy.0
mov eax, dword [edi + 0x38]
lea ecx, [edi + 0x38]
push eax
mov dword [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00548820
push dword [edi + 0x38]
call fcn.00428680
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x30]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00548110
push dword [edi + 0x30]
call fcn.00428680
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00548490
push dword [edi + 0x28]
call fcn.00428680
mov eax, dword [edi + 0x20]
lea ecx, [edi + 0x20]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00548110
push dword [edi + 0x20]
call fcn.00428680
mov eax, dword [edi + 0x18]
lea ecx, [edi + 0x18]
add esp, 4
push eax
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00548110
push dword [edi + 0x18]
call fcn.00428680
add esp, 4
lea ecx, [edi + 0x14]
call fcn.00428810
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.00428810
lea ecx, [edi + 8]
mov byte [ebp - 4], 0
call fcn.00428810
lea ecx, [edi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x545010
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70a0b0
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 8
call fcn.00428810
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 7
call fcn.00428810
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 6
call fcn.00428810
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 5
call fcn.00428810
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 4
call fcn.00428810
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 3
call fcn.00428810
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call fcn.00428810
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.00428810
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 0
call fcn.00428810
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54eb20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709c78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
je 0x54ebf3
mov edi, dword [esi + 0x68]
cmp edi, 0xffffffff
je 0x54ebf3
cmp dword [ebp + 8], 1
jne 0x54ebf3
push dword [esi + 0x38]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
call fcn.00552c50
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0042a300
lea ecx, [ebp + 8]
call fcn.0042a1d0
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00428690
push edi
push dword [ebp - 0x10]
mov ecx, esi
call fcn.00553ee0
cmp edi, 2
jne 0x54ebc4
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x90]
call fcn.00541f20
mov ecx, eax
jmp 0x54ebdf
cmp edi, 3
jne 0x54ebe4
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x88]
call fcn.0053be90
lea ecx, [ebp + 8]
push ecx
lea ecx, [eax + 4]
call fcn.004289a0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
push 0
push dword [esi + 0x38]
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x68], 0xffffffff
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x54f2b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70b180
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x7d3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00552c50
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00429100
push eax
call fcn.005b6cf0
add esp, 4
test eax, eax
jne 0x54f375
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005b5ff0
add esp, 8
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004289a0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00428810
lea ecx, [ebp - 0x10]
call fcn.00429100
push eax
call fcn.005b6cf0
add esp, 4
test eax, eax
jne 0x54f375
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.005b5ff0
add esp, 8
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004289a0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00428810
lea ecx, [ebp - 0x14]
call fcn.00429050
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push 0x7890a0
push eax
call fcn.0042a0e0
add esp, 0xc
lea ecx, [ebp - 0x14]
push 1
push 0
call fcn.00429100
push eax
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00428810
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x54faf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70b220
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x7e6410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
push 0
mov ecx, ebx
call fcn.0054c060
mov ecx, dword [0x7f7170]
test ecx, ecx
je 0x54fb3f
mov eax, dword [ecx]
push 0x298
push dword [ebx]
call dword [eax + 0xc]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x54fb56
mov eax, dword [eax + 0x128]
test eax, eax
je 0x54fb56
mov dword [eax], 2
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x737
push dword [ebx]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x70e
push dword [ebx]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x640000
push 0
push 0x401
push eax
call esi
push 0x70e
push dword [ebx]
call edi
push 0
push 0
push 0x402
push eax
call esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
call fcn.00544660
lea ecx, [ebp - 0x30]
mov byte [0x7f42b6], 0
mov byte [0x7f42b7], 0
call fcn.006b1ced
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0x74467c
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.006b1de5
lea ecx, [ebp - 0x30]
call fcn.006b1d5e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
test eax, eax
jne 0x54fc05
push 1
call fcn.006b1caf
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
push dword [ebp - 0x18]
call fcn.006b1b95
add esp, 8
test eax, eax
je 0x54fc1e
push eax
call fcn.006b1c82
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x54fcf0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x3e9
push esi
mov esi, ecx
jne 0x54fd2b
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.0053f1b0
test eax, eax
je 0x54fd2b
cmp eax, dword [esi + 0x2c]
jne 0x54fd2b
cmp dword [eax + 4], 0
je 0x54fd2b
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x550c00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70b2e8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
cmp dword [edi + 0x64], eax
jne 0x550c44
cmp dword [edi + 0x68], ebx
je 0x550d61
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], ebx
cmp eax, 0xffffffff
je 0x550d56
cmp ebx, 0xffffffff
je 0x550d56
call fcn.00552880
mov ecx, edi
mov esi, eax
call fcn.00552790
mov ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, esi
jge 0x550d61
cmp ebx, ecx
jge 0x550d61
push ebx
push eax
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.005527e0
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
mov ecx, esp
push eax
call fcn.00428690
push dword [edi + 0x38]
mov ecx, edi
call fcn.00554120
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x34]
movdqu xmmword [ebp - 0x20], xmm0
push 0x100e
push dword [edi + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 0xc], eax
jl 0x550cf0
push 0
push esi
push 0x101d
push dword [edi + 0x3c]
mov dword [ebp - 0x34], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
add ebx, eax
cmp esi, dword [ebp + 0xc]
jle 0x550cd1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], ebx
push eax
push dword [edi + 0x3c]
movdqu xmmword [ebp - 0x30], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub eax, edx
mov ecx, dword [ebp - 0x20]
push 0x44
push eax
mov eax, dword [ebp - 0x18]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
jmp 0x550d61
push 0
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8
Function at 0x554d20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x14]
push eax
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
lea ecx, [esi + 0x34]
push dword [esi + 0x28]
call fcn.00433dc0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10

Function at 0x555400
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00555a10
xor eax, eax
pop esi
ret 0x10

Function at 0x5554c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x709b38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
movsx ebx, ax
xor edi, edi
shr eax, 0x10
cwde
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
movdqu xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x55559a
cmp dword [esi + 0x60], edi
mov edi, dword [ebp - 0x24]
je 0x55553b
push edi
push ebx
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x55558a
cmp dword [esi + 0x64], 0
je 0x555595
push edi
push ebx
lea eax, [esi + 0x50]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x555595
push str.https:__play.google.com_store_apps_details_idcom.gomtv.gomaudio
lea ecx, [ebp - 0x24]
mov dword [0x7f7a30], 1
call fcn.00428840
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
call fcn.005bbe70
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00428810
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 1
mov dword [esi + 0x60], 0
mov eax, edi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10

Function at 0x555c20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0
jne 0x555c36
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x555c34
push edi
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [0x7f4744], edi
je 0x555c73
xor ecx, ecx
mov dword [0x7f4744], edi
test edi, edi
setne cl
push ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
pop edi
je 0x555c34
push dword [esi + 0x6c]
lea ecx, [esi + 4]
call fcn.0054c060
mov ecx, esi
pop esi
jmp fcn.005557a0
Function at 0x5576f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70ba80
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [0x7f7170]
test ecx, ecx
je 0x557734
mov eax, dword [ecx]
push 0x267
push dword [edi + 4]
call dword [eax + 0xc]
cmp dword [edi + 0x28], 1
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
jne 0x557807
push 0xebde
push dword [edi + 4]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x30], xmm0
call esi
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call ebx
test eax, eax
je 0x55777d
lea eax, [ebp - 0x28]
push eax
push dword [edi + 4]
call ebx
push 0x5e5
push dword [edi + 4]
call esi
push 5
push 0
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xebde
push dword [edi + 4]
call esi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x7f7170]
test ecx, ecx
je 0x5577ca
mov eax, dword [ecx]
push 0x7425a0
push str.IDS_EXIT_PROGRAM
call dword [eax + 8]
jmp 0x5577cf
mov eax, 0x790eb0
push eax
lea ecx, [ebp - 0x38]
call fcn.00428840
push 2
push dword [edi + 4]
mov dword [ebp - 4], 0
call esi
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.00429100
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
push 0x5e2
push dword [edi + 4]
lea esi, [edi + 4]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call ebx
test eax, eax
je 0x55783f
lea eax, [ebp - 0x18]
push eax
push dword [esi]
call ebx
lea eax, [ebp - 0x20]
add edi, 0x2c
push eax
push dword [esi]
mov ecx, edi
call fcn.00433dc0
test eax, eax
je 0x557896
lea eax, [ebp - 0x34]
mov ecx, 0x7f497c
push eax
call fcn.00557540
push 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.00429100
push eax
mov ecx, edi
call fcn.00434270
push 1
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00434220
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00428810
push 0
mov ecx, esi
call fcn.0054c060
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0x10