joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cea70
Capabilities:
Get file size
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x50]
lea edi, [esi + 0x2145c]
push eax
mov ecx, edi
call fcn.004e7f60
push esi
mov ecx, edi
call fcn.004e8a70
lea ecx, [esi + 0x4c]
test ecx, ecx
je 0x4cea99
lea eax, [esi + 0x74]
jmp 0x4cea9b
xor eax, eax
push edi
mov dword [esi + 0x2148c], eax
call fcn.004f24d0
call fcn.00447080
mov ecx, dword [eax + 0x80]
pop edi
test ecx, ecx
pop esi
jne 0x4cead2
mov ecx, 0x56d188
call fcn.0040c8f0
test eax, eax
jne 0x4cead2
call fcn.004d9960
mov ecx, eax
jmp 0x4d9e40
ret
sub esp, 0x454
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x66]
mov word [esp + 0x64], 0
push str.FaceIcon_Bits.dat
rep stosd dword es:[edi], eax
mov ecx, 0x56d188
stosw word es:[edi], ax
call fcn.0040c160
push eax
push str._sdata_s
lea eax, [esp + 0x70]
push 0x1ff
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x78]
push 0
push ecx
call fcn.0043f120
add esp, 0x1c
test eax, eax
je 0x4d9fdf
push 0
push 0x20
push 3
push 0
push 1
lea edx, [esp + 0x78]
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d9fdf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4d9ee7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
lea edi, [ebp + 2]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
je 0x4d9f1d
lea eax, [esp + 0x18]
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
cmp eax, 0x18
jbe 0x4d9fdf
mov ecx, 6
mov esi, ebx
lea edi, [esp + 0x4c]
add eax, 0xffffffe8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x54]
mov ebp, edx
imul ebp, dword [esp + 0x58]
cmp ebp, eax
ja 0x4d9fdf
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x50]
xor edi, edi
push edi
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov word [esp + 0x30], 1
mov word [esp + 0x32], 0x20
mov dword [esp + 0x34], edi
call dword [sym.imp.USER32.dll_GetDC]
push edi
lea edx, [esp + 0x14]
mov esi, eax
push edi
push edx
lea eax, [esp + 0x2c]
push edi
push eax
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push esi
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, dword [esp + 0x10]
mov ecx, ebp
mov edx, ecx
lea esi, [ebx + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x4d9fdf
mov ecx, dword [esp + 0x14]
push eax
call fcn.004d9b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
Function at 0x4d07e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1048
call fcn.0051d1f0
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1050]
xor eax, eax
shr ecx, 0x10
cmp ecx, 0x13
jne 0x4d08b7
push edi
mov ecx, 0x411
lea edi, [esp + 0xa]
mov word [esp + 8], ax
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x11db8]
stosw word es:[edi], ax
call fcn.004a41e0
test eax, eax
pop edi
je 0x4d084a
cmp word [eax], 0
je 0x4d084a
push 1
push 1
lea edx, [esp + 0xc]
push 0x824
push edx
push eax
push 0xffffffffffffffff
call fcn.004a48a0
mov ecx, eax
call fcn.004a4d80
jmp 0x4d0864
push 1
lea eax, [esp + 8]
push 0x824
push eax
push 0xffffffffffffffff
call fcn.004a48a0
mov ecx, eax
call fcn.004a4ea0
cmp word [esp + 4], 0
je 0x4d08b2
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x587dd0]
lea edx, [esp + 4]
push ecx
push 0
push 0
push 1
push 1
push 8
push 0
push edx
lea ecx, [esi + 0xedb8]
call fcn.00487ba0
call fcn.00422720
mov eax, dword [eax + 4]
push 0
push 0x7612
push 0x405
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
pop esi
add esp, 0x1048
ret 4

Function at 0x4d0c50
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x28]
push 0x2008
push 1
push 0x9d99
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x4d0de0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
mov ebp, ecx
push 0x10
call ebx
mov si, ax
push 0x12
shr esi, 8
and esi, 0xff
call ebx
mov di, ax
push 0x11
shr edi, 8
and edi, 0xff
call ebx
shr eax, 8
and eax, 0xff
test esi, esi
jne 0x4d0e74
test edi, edi
jne 0x4d0e74
test eax, eax
jne 0x4d0e74
mov eax, dword [esp + 0x14]
add eax, 0xffffff90
mov ecx, eax
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*8]
cmp word [eax*8 + 0x5a0b0c], di
lea esi, [eax*8 + 0x5a0b0c]
je 0x4d0e74
push edi
call dword [sym.imp.USER32.dll_InSendMessageEx]
and eax, 9
cmp al, 1
jne 0x4d0e5c
push 1
call dword [sym.imp.USER32.dll_ReplyMessage]
push esi
lea ecx, [ebp + 0xedb8]
call fcn.004875b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4d97d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.004d94c0
lea eax, [ebp + 0xc]
push 0x56a224
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0xc], edi
je 0x4d98b0
push ebx
push edi
lea esi, [ebp + 4]
push 1
push 4
push esi
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4d9882
mov eax, dword [esi]
test eax, eax
je 0x4d9882
mov ecx, dword [ebp + 8]
shl ecx, 1
cmp eax, ecx
jge 0x4d9882
mov edx, eax
shl edx, 5
add edx, eax
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d9882
mov eax, dword [esi]
mov edi, ebx
mov ecx, eax
shl ecx, 5
add ecx, eax
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push eax
push ecx
push 0x21
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
add esp, 0x10
cmp eax, ecx
je 0x4d987e
push ebx
mov dword [esi], 0
call fcn.0051d19a
add esp, 4
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp], ebx
test ebx, ebx
pop ebx
je 0x4d98aa
mov edx, dword [0x5cc150]
pop edi
mov dword [ebp + 0x214], edx
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x4d98c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x565978
lea eax, [esi + 0xc]
mov dword [esp + 0x10], edi
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4d994a
mov eax, dword [esi]
push ebp
test eax, eax
je 0x4d9936
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
lea edi, [esi + 4]
push 1
push 4
push edi
call ebp
add esp, 0x10
cmp eax, 1
jne 0x4d9936
mov ecx, dword [edi]
mov edx, dword [esi]
push ebx
push ecx
push 0x21
push edx
call ebp
mov ecx, dword [edi]
add esp, 0x10
cmp eax, ecx
jne 0x4d9936
push 0x5cc150
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x5cc150]
mov dword [esp + 0x10], 1
mov dword [esi + 0x214], eax
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4d9d80
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
test eax, eax
push esi
je 0x4d9e31
mov esi, dword [esp + 0x24]
test esi, esi
je 0x4d9e31
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
push 0x18
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4d9e31
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d9e31
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x10]
push 0x18
push ecx
push esi
mov dword [esp + 0x38], 0
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
imul eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push 0
push edx
push eax
push ecx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x18
ret 8

Function at 0x4dab30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x522601
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004f8480
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x1c], edi
call fcn.0050ae80
lea ecx, [esi + 0x94]
mov byte [esp + 0x1c], 1
call fcn.00492af0
lea ecx, [esi + 0x2d0]
mov byte [esp + 0x1c], 2
call fcn.004fe9c0
mov al, byte [esp + 0xf]
lea edx, [esi + 0x2c8]
mov byte [esi + 0x11d0], al
mov dword [esi + 0x11d4], edi
mov dword [esi + 0x11d8], edi
mov dword [esi + 0x11dc], edi
xor ecx, ecx
mov dword [esi], 0x528afc
mov dword [ebx], 0x528ae8
mov dword [edx], ecx
mov eax, esi
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x11c0], edi
mov dword [esi + 0x11c4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x11c8], edi
mov dword [esi + 0x11cc], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x11e8], edi
mov dword [esi + 0x11ec], edi
mov dword [esi + 0x28], 0x64
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4dc8d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4dc8ee
mov eax, dword [ecx + 8]
push 5
push eax
mov dword [ecx + 0x2c], 0
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
mov dword [ecx + 0x2c], 1
mov ecx, dword [ecx + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x4dcf10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x11c4]
test eax, eax
je 0x4dcfec
mov eax, dword [esi + 0x11c0]
test eax, eax
je 0x4dcfec
mov dword [esi + 0x40], 1
mov eax, dword [eax + 4]
test eax, eax
je 0x4dcf4c
push 0x4001
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x11c0]
call fcn.0046a7d0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0xf8]
mov ecx, dword [esi + 0x11c0]
mov edx, dword [ecx]
call dword [edx + 0x6c]
cmp eax, 0x64
mov dword [esi + 0x28], eax
je 0x4dcf85
mov ecx, dword [esi + 0x11c0]
push 0x64
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov ecx, esi
call fcn.004dd630
mov ecx, esi
call fcn.004dd4b0
xor ecx, ecx
mov edx, dword [esi + 0x34]
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x30]
mov dword [esp + 8], ecx
push 0x14
mov dword [esp + 0x10], ecx
push 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x11c0]
push edx
push 0x53
mov dword [esp + 0x24], eax
call fcn.00415580
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
mov ecx, esi
call fcn.004dc7e0
pop esi
add esp, 0x14
ret
Function at 0x4e06e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x218]
mov esi, dword [esp + 0x214]
lea ecx, [esp + 8]
dec edx
push ecx
push str._s360seWebCacheImages_
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043f530
add esp, 0x14
mov eax, 1
pop edi
pop esi
add esp, 0x208
ret

Function at 0x4e0750
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push esi
push eax
call fcn.004e0010
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e0772
pop esi
add esp, 0x208
ret
cmp word [esi], 0
je 0x4e07ce
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x1a
push 0
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x21c]
lea edx, [esp + 8]
push esi
mov esi, dword [esp + 0x21c]
push edx
dec eax
push str._s360seWebCache_s.html
push eax
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call fcn.0043f530
add esp, 0x18
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret

Function at 0x4e1040
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
test eax, eax
jne 0x4e1079
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x50], 1
test ecx, ecx
je 0x4e1079
push 2
call fcn.00416bb0
mov eax, dword [esi + 0x28]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x58]
push 0
push 0
push 1
call fcn.004168e0
pop esi
ret

Function at 0x4e8840
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov edx, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x10], eax
push ecx
push edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
add ecx, 0x32
add eax, 0xa
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x38]
mov dword [esp + 0xc], eax
add eax, 0x32
cmp ecx, ebx
mov dword [esp + 0x14], eax
je 0x4e88f3
call fcn.00493c90
test eax, eax
je 0x4e88f3
mov ecx, dword [esi + 0x38]
push ebp
push edi
call fcn.00493d50
mov eax, dword [eax]
mov ecx, dword [esi + 0x38]
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
call fcn.00493d50
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4e88d4
push 1
mov ebx, edi
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x4e88d4
lea ebx, [edi + edi]
mov eax, dword [esp + 0x24]
push 0
mov ecx, dword [esi + 0x38]
push 0
push ebp
push edi
push 0
push ebx
lea edx, [esp + 0x28]
push 0
push edx
push eax
call fcn.004932a0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4eb240
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4eb3e5
mov ecx, dword [esi + 4]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push ecx
call edi
mov edx, dword [esi + 0xeae0]
xor eax, eax
test edx, edx
sete al
push eax
lea ecx, [esi + 0x28]
mov dword [esi + 0xeae0], eax
call fcn.004f5480
mov eax, dword [esi + 0xeae0]
test eax, eax
je 0x4eb369
mov edx, dword [esi + 4]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsZoomed]
push edx
call ebp
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [esi + 0xed6c], eax
lea eax, [esi + 0xed70]
push eax
push ecx
call ebx
mov edx, dword [esi + 4]
push 0xfffffffffffffff0
push edx
call edi
mov dword [esi + 0xed68], eax
mov ecx, dword [0x58d1ac]
test ecx, ecx
jne 0x4eb2d5
and eax, 0xff3fffff
and eax, 0xfffbffff
push eax
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 4]
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
call fcn.004c05d0
add esp, 0x10
test eax, eax
jne 0x4eb30e
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub edi, ecx
mov ecx, dword [esi + 4]
push ecx
sub ebx, eax
call ebp
test eax, eax
je 0x4eb346
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0x60
push ebx
push edi
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi + 4]
push 3
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push 0x190
push 1
push eax
call dword [sym.imp.USER32.dll_SetTimer]
pop ebp
pop ebx
jmp 0x4eb3d4
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 0xed68]
mov eax, dword [esi + 4]
push edx
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 0xed74]
mov edx, dword [esi + 0xed7c]
mov ecx, dword [esi + 0xed70]
sub edx, eax
push 0x60
push edx
mov edx, dword [esi + 0xed78]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0xed6c]
test eax, eax
je 0x4eb3c8
mov ecx, dword [esi + 4]
push 3
push ecx
jmp 0x4eb3ce
mov edx, dword [esi + 4]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 1
push 0
push eax
call fcn.0050b3e0
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4eb9b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 6
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push ecx
call edi
pop edi
pop esi
ret
Function at 0x4f5660
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0x9b8]
test eax, eax
jle 0x4f56dd
mov ebx, dword [esp + 0x220]
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esi + 0x978]
lea eax, [esp + 0x14]
push 0x104
push eax
mov eax, dword [edi]
mov word [esp + 0x1c], 0
lea ecx, [eax + eax*8]
shl ecx, 4
mov edx, dword [ecx + esi + 0xfc]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4f56ec
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x9b8]
inc eax
add edi, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4f5691
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret 4
mov ecx, dword [esp + 0x10]
pop edi
mov eax, dword [esi + ecx*4 + 0x978]
lea edx, [eax + eax*8]
shl edx, 4
mov eax, dword [edx + esi + 0xfc]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4

Function at 0x4f5720
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0x9b8]
test eax, eax
jle 0x4f579d
mov ebx, dword [esp + 0x220]
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esi + 0x978]
lea eax, [esp + 0x14]
push 0x104
push eax
mov eax, dword [edi]
mov word [esp + 0x1c], 0
lea ecx, [eax + eax*8]
shl ecx, 4
mov edx, dword [ecx + esi + 0xfc]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4f57ac
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x9b8]
inc eax
add edi, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x4f5751
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret 4
mov ecx, dword [esp + 0x10]
pop edi
mov eax, dword [esi + ecx*4 + 0x978]
lea edx, [eax + eax*8]
shl edx, 4
mov eax, dword [edx + esi + 0xf8]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
Function at 0x4f6d10
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
test eax, eax
mov esi, ecx
jl 0x4f6e6a
mov eax, dword [esi + 4]
push ebx
push ebp
push edi
mov edi, dword [esi + 0x33a8]
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.USER32.dll_GetParent]
mov ebp, eax
mov eax, dword [esi + 0x33a4]
xor ebx, ebx
mov dword [esi + 0x33a8], 0xffffffff
test eax, eax
jbe 0x4f6dc5
lea edi, [esi + 0xdc0]
cmp ebx, dword [esp + 0x18]
jne 0x4f6da1
mov eax, dword [edi - 8]
test eax, eax
jne 0x4f6da1
mov ecx, dword [edi - 0x21c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push 1
lea ecx, [esi + 0x33d0]
call fcn.00502670
mov dword [esi + 0x33a8], ebx
mov edx, dword [edi - 0x214]
lea eax, [edi - 0x210]
push edx
push eax
push 0x1503
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4f6db0
mov ecx, dword [edi - 0x21c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x33a4]
inc ebx
add edi, 0x280
cmp ebx, eax
jb 0x4f6d55
mov edi, dword [esp + 0x10]
cmp edi, dword [esi + 0x33a8]
je 0x4f6df5
cmp edi, 0xffffffff
je 0x4f6df5
lea edx, [edi + edi*4]
shl edx, 7
mov ecx, dword [edx + esi + 0xbac]
lea eax, [edx + esi]
add eax, 0xbb0
push ecx
push eax
push 0x1504
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x33a8]
pop edi
pop ebp
cmp eax, 0xffffffff
pop ebx
jne 0x4f6e30
mov edx, dword [esi + 0xba4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esi + 0xdc0]
lea ecx, [esi + 0x33d0]
push eax
push 1
call fcn.00502670
mov dword [esi + 0x33a8], 0
mov eax, dword [esi + 0x5220]
cmp eax, 1
jne 0x4f6e52
mov edx, dword [esi + 4]
lea ecx, [esi + 0x5234]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ecx
ret 4
cmp eax, 2
jne 0x4f6e6a
mov ecx, dword [esi + 4]
lea eax, [esi + 0x5244]
push 1
push eax
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ecx
ret 4
Function at 0x4f79d0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x20
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
cmp edi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x4f7ac8
cmp edi, dword [esi + 0x33a4]
jae 0x4f7ac8
mov eax, dword [esi + 4]
push ebx
push ebp
push eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [edi + edi*4]
push eax
shl ecx, 7
add esi, ecx
mov dword [esp + 0x14], eax
mov edi, dword [esi + 0xe0c]
mov edx, dword [esi + 0xe04]
mov ebx, dword [esi + 0xe10]
mov ecx, dword [esi + 0xe08]
sub edi, edx
sub ebx, ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
mov ebp, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebp
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebx
call fcn.004f7500
mov edx, dword [esi + 0xe08]
mov eax, dword [esi + 0xe04]
mov esi, dword [esp + 0x10]
push 0xcc0020
push 0
push 0
push ebp
push ebx
push edi
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x14]
push esi
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20
ret 4