joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40107c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
push eax
push 0x461158
call fcn.0043babc
add esp, 8
push 0x2712
push 0x44c0a8
push 0x461158
call fcn.0043c02b
add esp, 0xc
push 0x461158
call fcn.0043bafe
pop ecx
test eax, eax
je 0x401104
cmp byte [0x44c07c], 0
jne 0x4010eb
push 0x23
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x461158
call fcn.0043bacf
pop ecx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
mov dword [0x44c078], eax
inc byte [0x44c07c]
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x44c078], eax
push 1
push 0x461158
call fcn.0043c0ab
add esp, 8
pop ebp
ret

Function at 0x401677
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, 0x451348
lea edi, [ebp - 0x100]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
cmp dword [0x16e0ea6], 0
je 0x40175d
push 0x16e231e
lea eax, [ebp - 0x100]
push eax
call fcn.00440fd4
add esp, 8
call fcn.0040166c
lea edx, [ebp - 0x100]
push edx
push 0x1f40
push 0x18a4c7c
push 0x452f1c
push 0
push edi
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
jne 0x401706
push edi
push 0x452f1d
lea ecx, [ebp - 0x200]
push ecx
call fcn.004452e0
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
call fcn.00401fde
pop ecx
jmp 0x40175d
mov ebx, 0x18a4c7c
jmp 0x401758
lea eax, [ebp - 0x100]
push eax
push 0x1f4
push 0x18a6bbc
push 0x452f34
push ebx
push edi
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, ebx
push esi
call fcn.004470f4
pop ecx
test eax, eax
jle 0x40175d
push 0x18a6bbc
mov esi, ebx
push esi
call fcn.004470f4
pop ecx
push eax
push dword [ebp + 0xc]
call sub.USER32.dll_SetDlgItemTextA
push ebx
call fcn.00441094
pop ecx
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x40170d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408658
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
imul eax, esi, 0x5dcb
mov eax, dword [eax*4 + 0x47ccec]
test eax, eax
je 0x408733
cmp eax, 0x2ee0
jle 0x408681
mov eax, 0x2ee0
push 0
push eax
imul edx, esi, 0x1772c
add edx, 0x46d2ec
push edx
imul ecx, esi, 0x5dcb
push dword [ecx*4 + 0x47ccf0]
call sub.WSOCK32.dll_send
mov ebx, eax
test ebx, ebx
jle 0x4086e9
imul eax, esi, 0x5dcb
sub dword [eax*4 + 0x47ccec], ebx
imul edx, esi, 0x5dcb
push dword [edx*4 + 0x47ccec]
imul ecx, esi, 0x1772c
add ebx, ecx
add ebx, 0x46d2ec
push ebx
imul eax, esi, 0x1772c
add eax, 0x46d2ec
push eax
call fcn.00440f58
add esp, 0xc
jmp 0x408733
push 0x453be0
call fcn.0043d96d
pop ecx
mov ebx, eax
cmp ebx, 0x2746
jne 0x408718
imul eax, esi, 0x5dcb
push dword [eax*4 + 0x47ccf4]
call fcn.004022b3
pop ecx
push esi
call fcn.004084aa
pop ecx
test ebx, ebx
je 0x408733
cmp ebx, 0x2733
je 0x408733
test ebx, ebx
je 0x408733
push 0x453be1
call fcn.004020a5
pop ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x409dde
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff990
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x464c14
xor ebx, ebx
lea eax, [edi + ebx]
push eax
lea edx, [ebp - 0x670]
push edx
call fcn.00409a1a
add esp, 8
push 0x14
lea ecx, [ebp - 0x670]
push ecx
imul eax, ebx, 0xb
push dword [esi + eax*4]
call sub.USER32.dll_GetWindowTextA
push 0x14
lea edx, [ebp - 0x43c]
push edx
imul ecx, ebx, 0xb
push dword [esi + ecx*4 + 4]
call sub.USER32.dll_GetWindowTextA
push 0x100
lea eax, [ebp - 0x65c]
push eax
imul edx, ebx, 0xb
push dword [esi + edx*4 + 8]
call sub.USER32.dll_GetWindowTextA
lea ecx, [ebp - 0x670]
push ecx
call fcn.00409cd4
pop ecx
test eax, eax
je 0x409e82
mov byte [ebp - 0x670], 0
lea eax, [ebp - 0x670]
push eax
imul edx, ebx, 0xb
push dword [esi + edx*4]
call sub.USER32.dll_SetWindowTextA
push 0x453e7f
push dword [ebp + 8]
call fcn.00401fc7
add esp, 8
lea ecx, [ebp - 0x670]
push ecx
call fcn.00441094
pop ecx
test eax, eax
jne 0x409eb4
lea eax, [ebp - 0x43c]
push eax
call fcn.00441094
pop ecx
test eax, eax
je 0x409eb4
push 0x453f1d
push dword [ebp + 8]
call fcn.00401fc7
add esp, 8
push 0x32
lea edx, [ebp - 0x64]
push edx
imul ecx, ebx, 0xb
push dword [esi + ecx*4 + 0xc]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x64]
push eax
call fcn.0043d9d4
pop ecx
mov dword [ebp - 0x55c], eax
push 0x32
lea edx, [ebp - 0x64]
push edx
imul ecx, ebx, 0xb
push dword [esi + ecx*4 + 0x10]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x64]
push eax
call fcn.0043d9d4
pop ecx
mov dword [ebp - 0x448], eax
push 0x32
lea edx, [ebp - 0x64]
push edx
imul ecx, ebx, 0xb
push dword [esi + ecx*4 + 0x14]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x64]
push eax
call fcn.0043d9d4
pop ecx
mov dword [ebp - 0x558], eax
push 0x32
lea edx, [ebp - 0x64]
push edx
imul ecx, ebx, 0xb
push dword [esi + ecx*4 + 0x18]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x64]
push eax
call fcn.0043d9d4
pop ecx
mov dword [ebp - 0x554], eax
imul edx, ebx, 0xb
push dword [esi + edx*4 + 0x20]
call fcn.00409cbe
pop ecx
mov dword [ebp - 0x44c], eax
lea ecx, [edi + ebx]
push ecx
lea eax, [ebp - 0x670]
push eax
call fcn.00409af4
add esp, 8
lea edx, [ebp - 0x670]
push edx
call fcn.00409d7d
pop ecx
test eax, eax
je 0x409faf
mov byte [ebp - 0x670], 0
lea ecx, [ebp - 0x670]
push ecx
imul eax, ebx, 0xb
push dword [esi + eax*4]
call sub.USER32.dll_SetWindowTextA
lea edx, [edi + ebx]
push edx
lea ecx, [ebp - 0x670]
push ecx
call fcn.00409af4
add esp, 8
push 0x453f5e
push dword [ebp + 8]
call fcn.00401fc7
add esp, 8
inc ebx
cmp ebx, 8
jl 0x409df4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c153
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push 0x50
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextA
lea edx, [ebp - 0x50]
push edx
call fcn.0043d9d4
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c175
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, 0x171d17c
xor ebx, ebx
imul eax, ebx, 0x67
push dword [esi + eax*4 + 0x18c]
call fcn.0040c153
pop ecx
imul edx, ebx, 0x67
mov dword [esi + edx*4 + 0x50], eax
imul ecx, ebx, 0x67
push dword [esi + ecx*4 + 0x190]
call fcn.0040c153
pop ecx
imul edx, ebx, 0x67
mov dword [esi + edx*4 + 0x54], eax
imul eax, ebx, 0x67
push dword [esi + eax*4 + 0x194]
call fcn.0040c153
pop ecx
imul ecx, ebx, 0x67
mov dword [esi + ecx*4 + 0x58], eax
push 0x100
imul eax, ebx, 0x19c
lea edx, [esi + 0x5c]
add eax, edx
push eax
imul ecx, ebx, 0x67
push dword [esi + ecx*4 + 0x198]
call sub.USER32.dll_GetWindowTextA
inc ebx
cmp ebx, 0x14
jl 0x40c17e
pop esi
pop ebx
ret

Function at 0x40d34c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0x1004
push edi
call sub.USER32.dll_SendMessageA
mov esi, eax
push 0
push edi
call sub.USER32.dll_ShowWindow
lea ebx, [esi - 1]
jmp 0x40d389
dec ebx
push 0x4545f5
push esi
mov eax, esi
sub eax, ebx
push eax
push 0
call fcn.00407cad
add esp, 0x10
push 0
push ebx
push 0x1008
push edi
call sub.USER32.dll_SendMessageA
test eax, eax
jne 0x40d373
push 5
push edi
call sub.USER32.dll_ShowWindow
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40e016
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x40dfc4
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop ecx
pop ebp
ret

Function at 0x40ee79
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
mov ebx, dword [ebp + 0x10]
push 0x464a08
lea eax, [ebp - 0x800]
push eax
call fcn.00441064
add esp, 8
push ebx
lea edx, [ebp - 0x800]
push edx
call fcn.00440fd4
add esp, 8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.SHELL32.DLL_ShellExecuteA
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410bd7
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe68
call fcn.0040166c
lea eax, [ebp - 0x1198]
push eax
push 0x5dc
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
jle 0x410c25
cmp eax, 0x5dc
jge 0x410c25
lea edx, [ebp - 0x1198]
push edx
push 0x4558aa
lea ecx, [ebp - 0xbb8]
push ecx
call fcn.004452e0
add esp, 0xc
jmp 0x410c39
push 0x4558b7
lea eax, [ebp - 0xbb8]
push eax
call fcn.004452e0
add esp, 8
push 0
lea edx, [ebp - 0xbb8]
push edx
push 0x4558c5
call sub.KERNEL32.dll_CopyFileA
call fcn.0041044d
push 0x450249
push 0x4558e3
call fcn.00410375
add esp, 8
call fcn.0040f06d
push 1
push 0
push 0
push 0x450249
push 0x4558f4
push 0
call fcn.0040ee79
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x410c86
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, 0x45259d
mov edi, 0x18a765c
lea eax, [esi + 0x335c]
push eax
push dword [ebp + 8]
call fcn.0040ed14
add esp, 8
lea edx, [esi + 0x337c]
push edx
lea ecx, [esi + 0x336c]
push ecx
call fcn.00443f30
add esp, 8
mov ebx, eax
test ebx, ebx
jbe 0x410e09
lea eax, [esi + 0x337f]
push eax
push ebx
call fcn.00443f64
add esp, 8
push dword [edi]
call fcn.004038fc
pop ecx
push eax
lea edx, [esi + 0x3381]
push edx
push ebx
call fcn.00443f64
add esp, 0xc
push dword [edi + 4]
call fcn.004038fc
pop ecx
push eax
lea ecx, [esi + 0x339c]
push ecx
push ebx
call fcn.00443f64
add esp, 0xc
push dword [edi + 8]
call fcn.004038fc
pop ecx
push eax
lea eax, [esi + 0x33ae]
push eax
push ebx
call fcn.00443f64
add esp, 0xc
mov edx, dword [edi + 4]
add edx, dword [edi + 8]
push edx
call fcn.004038fc
pop ecx
push eax
lea ecx, [esi + 0x33c1]
push ecx
push ebx
call fcn.00443f64
add esp, 0xc
push dword [edi + 0x10]
call fcn.004038fc
pop ecx
push eax
lea eax, [esi + 0x33d3]
push eax
push ebx
call fcn.00443f64
add esp, 0xc
mov edx, dword [edi + 4]
add edx, dword [edi + 8]
add edx, dword [edi]
sub edx, dword [edi + 0x10]
push edx
call fcn.004038fc
pop ecx
push eax
lea ecx, [esi + 0x33ec]
push ecx
push ebx
call fcn.00443f64
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push dword [edi + 0xc]
call fcn.00402c3e
add esp, 8
lea edx, [ebp - 0x50]
push edx
lea ecx, [esi + 0x3401]
push ecx
push ebx
call fcn.00443f64
add esp, 0xc
push dword [edi + 0x14]
call fcn.004038bb
pop ecx
push eax
lea eax, [esi + 0x341a]
push eax
push ebx
call fcn.00443f64
add esp, 0xc
push dword [edi + 0x18]
call fcn.004038fc
pop ecx
push eax
lea edx, [esi + 0x3423]
push edx
push ebx
call fcn.00443f64
add esp, 0xc
push dword [edi + 0x1c]
call fcn.004038fc
pop ecx
push eax
lea ecx, [esi + 0x3431]
push ecx
push ebx
call fcn.00443f64
add esp, 0xc
push ebx
call fcn.00443ba0
pop ecx
push 0
lea eax, [esi + 0x3442]
push eax
call sub.KERNEL32.dll_WinExec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4113f5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4113d0
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop ecx
pop ebp
ret

Function at 0x411ec7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push 0x1004
push esi
call sub.USER32.dll_SendMessageA
mov ebx, eax
push 0
push esi
call sub.USER32.dll_ShowWindow
dec ebx
jmp 0x411eec
dec ebx
push 0
push ebx
push 0x1008
push esi
call sub.USER32.dll_SendMessageA
test eax, eax
jne 0x411eeb
push 5
push esi
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret
Function at 0x412133
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff400
push ebx
push esi
push edi
mov edi, 0x45259d
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
call fcn.0043c3fe
pop ecx
mov esi, eax
xor ebx, ebx
push ebx
lea eax, [edi + 0x3854]
push eax
lea edx, [ebp - 0xc00]
push edx
call fcn.004452e0
add esp, 0xc
lea ecx, [ebp - 0xc00]
push ecx
call fcn.00402714
pop ecx
test eax, eax
je 0x4121be
lea eax, [ebp - 0x400]
push eax
push esi
call fcn.004120f3
add esp, 8
push ebx
lea edx, [ebp - 0x400]
push edx
lea ecx, [edi + 0x3863]
push ecx
lea eax, [ebp - 0x800]
push eax
call fcn.004452e0
add esp, 0x10
lea edx, [ebp - 0x800]
push edx
lea ecx, [ebp - 0xc00]
push ecx
call sub.KERNEL32.dll_MoveFileA
inc ebx
cmp ebx, 0x64
jl 0x412155
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4149ca
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
call fcn.0041456e
pop ecx
cmp eax, 0xffffffff
jne 0x4149f7
push 0x456a8e
push esi
call fcn.00401fc7
add esp, 8
jmp 0x414a59
push 0x100
lea edx, [ebp - 0x100]
push edx
push eax
push ebx
call fcn.0041453d
add esp, 0x10
lea eax, [ebp - 0x100]
push eax
call fcn.0043c3fe
pop ecx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x414a31
push 0x456aa8
push esi
call fcn.00401fc7
add esp, 8
jmp 0x414a59
call fcn.0040166c
push ebx
push 0x456abb
lea eax, [ebp - 0x100]
push eax
call fcn.004452e0
add esp, 0xc
push 3
lea edx, [ebp - 0x100]
push edx
call sub.KERNEL32.dll_WinExec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418d7e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call sub.USER32.dll_GetDlgItem
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
call sub.USER32.dll_GetClientRect
mov dword [ebp - 8], 0xa
mov dword [ebp - 4], 0xa
push 0
push dword [0x171d164]
push 0
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x40a12844
push 0x4575cd
push 0x4575c1
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
test ebx, ebx
jbe 0x418de7
push 0
push esi
call sub.USER32.dll_ShowWindow
push 0
push 1
push 0x45b
push ebx
call sub.USER32.dll_SendMessageA
push 0x4000000
push 0
push 0x445
push ebx
call sub.USER32.dll_SendMessageA
push 0x4575ce
push ebx
call sub.USER32.dll_SetWindowTextA
push 1
push ebx
call sub.USER32.dll_ShowWindow
push 0x85
push 0
push 0
push ebx
call sub.USER32.dll_RedrawWindow
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a7b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
xor ebx, ebx
jmp 0x41a7cb
push 0
imul eax, ebx, 0x17
push dword [eax*4 + 0x16f8588]
call sub.USER32.dll_ShowWindow
inc ebx
cmp ebx, dword [0x451324]
jl 0x41a7b9
pop ebx
ret
Function at 0x41a896
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push edi
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x457f75
push esi
push ebx
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
je 0x41a8ec
lea edx, [ebp - 0x100]
push edx
call fcn.0041a857
pop ecx
push dword [ebp + 0x18]
lea ecx, [ebp - 0x100]
push ecx
push dword [ebp + 0x14]
call fcn.00441238
add esp, 0xc
jmp 0x41a8f7
push edi
push dword [ebp + 0x14]
push esi
push ebx
call sub.KERNEL32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c0e9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1713c10
push esi
push dword [0x16f8558]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f855c]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8560]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8564]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8568]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f856c]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8570]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8574]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8578]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f857c]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8cb8]
call sub.USER32.dll_ShowWindow
push esi
push dword [0x16f8cbc]
call sub.USER32.dll_ShowWindow
xor ebx, ebx
jmp 0x41c210
push esi
imul eax, ebx, 0xb
push dword [edi + eax*4]
call sub.USER32.dll_ShowWindow
push esi
imul edx, ebx, 0xb
push dword [edi + edx*4 + 4]
call sub.USER32.dll_ShowWindow
push esi
imul ecx, ebx, 0xb
push dword [edi + ecx*4 + 8]
call sub.USER32.dll_ShowWindow
push esi
imul eax, ebx, 0xb
push dword [edi + eax*4 + 0x14]
call sub.USER32.dll_ShowWindow
push esi
imul edx, ebx, 0xb
push dword [edi + edx*4 + 0x1c]
call sub.USER32.dll_ShowWindow
push esi
imul ecx, ebx, 0xb
push dword [edi + ecx*4 + 0x18]
call sub.USER32.dll_ShowWindow
push esi
imul eax, ebx, 0xb
push dword [edi + eax*4 + 0x20]
call sub.USER32.dll_ShowWindow
push esi
imul edx, ebx, 0xb
push dword [edi + edx*4 + 0x24]
call sub.USER32.dll_ShowWindow
push esi
imul ecx, ebx, 0xb
push dword [edi + ecx*4 + 0x28]
call sub.USER32.dll_ShowWindow
push esi
imul eax, ebx, 0xb
push dword [edi + eax*4 + 0xc]
call sub.USER32.dll_ShowWindow
inc ebx
cmp ebx, dword [0x451288]
jl 0x41c18e
cmp ebx, 0x32
jge 0x41c2ba
push 0
imul edx, ebx, 0xb
push dword [edi + edx*4]
call sub.USER32.dll_ShowWindow
push 0
imul ecx, ebx, 0xb
push dword [edi + ecx*4 + 4]
call sub.USER32.dll_ShowWindow
push 0
imul eax, ebx, 0xb
push dword [edi + eax*4 + 8]
call sub.USER32.dll_ShowWindow
push 0
imul edx, ebx, 0xb
push dword [edi + edx*4 + 0x14]
call sub.USER32.dll_ShowWindow
push 0
imul ecx, ebx, 0xb
push dword [edi + ecx*4 + 0x1c]
call sub.USER32.dll_ShowWindow
push 0
imul eax, ebx, 0xb
push dword [edi + eax*4 + 0x18]
call sub.USER32.dll_ShowWindow
push 0
imul edx, ebx, 0xb
push dword [edi + edx*4 + 0x20]
call sub.USER32.dll_ShowWindow
push 0
imul ecx, ebx, 0xb
push dword [edi + ecx*4 + 0x24]
call sub.USER32.dll_ShowWindow
push 0
imul eax, ebx, 0xb
push dword [edi + eax*4 + 0xc]
call sub.USER32.dll_ShowWindow
push 0
imul edx, ebx, 0xb
push dword [edi + edx*4 + 0x28]
call sub.USER32.dll_ShowWindow
inc ebx
cmp ebx, 0x32
jl 0x41c225
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41df62
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40800000
push dword [ebp + 0xc]
push 0x458b20
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41dfa2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40800001
push dword [ebp + 0xc]
push 0x458b27
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41dfe2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40800001
push dword [ebp + 0xc]
push 0x458b2e
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
push dword [0x4512a0]
push 0x30
push ebx
call sub.USER32.dll_SendMessageA
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e032
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40000001
push dword [ebp + 0xc]
push 0x458b35
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e072
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40000001
push dword [ebp + 0xc]
push 0x458b3c
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
push dword [0x4512a0]
push 0x30
push ebx
call sub.USER32.dll_SendMessageA
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e0c2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40800002
push dword [ebp + 0xc]
push 0x458b43
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x41e102
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40800000
push dword [ebp + 0xc]
push 0x458b4a
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e142
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40800003
push dword [ebp + 0xc]
push 0x458b51
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e182
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40002403
push dword [ebp + 0xc]
push 0x458b58
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
xor eax, eax
mov al, byte [0x44fa21]
cmp eax, 0x6f
je 0x41e1df
xor eax, eax
mov dl, byte [eax + 0x44fa1d]
mov byte [eax + 0x44fa1c], dl
inc eax
cmp eax, 0x186a0
jl 0x41e1cb
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e1e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40000003
push dword [ebp + 0xc]
push 0x458b5f
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
xor eax, eax
mov al, byte [0x44fa21]
cmp eax, 0x6f
je 0x41e241
xor eax, eax
mov dl, byte [eax + 0x44fa1d]
mov byte [eax + 0x44fa1c], dl
inc eax
cmp eax, 0x186a0
jl 0x41e22d
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e246
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40810080
push dword [ebp + 0xc]
push 0x458b66
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x41e286
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x171d164]
push 0
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x40810080
push dword [ebp + 0xc]
push 0x458b6b
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
push 0
push dword [0x4512a0]
push 0x30
push ebx
call sub.USER32.dll_SendMessageA
push 5
push ebx
call sub.USER32.dll_ShowWindow
mov eax, ebx
pop ebx
pop ebp
ret