joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a520
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c2888
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0040f8d1
test edi, edi
mov dword [esp + 0x18], 0
je 0x50a564
add edi, 0x28
jmp 0x50a566
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x50a57e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x50a5c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c28c3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.0050a520
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
test edi, edi
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.0
je 0x50a625
lea ebx, [edi + 0x28]
jmp 0x50a627
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
mov edi, dword [ebx + 4]
je 0x50a638
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test edi, edi
mov dword [esi + 0x2c], edi
je 0x50a648
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x50cbb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c2c53
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
push edi
mov byte [esi + 4], 0
call fcn.0040f4da
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0x20]
push ecx
lea ecx, [esi + 0x20]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x1c], eax
call fcn.00404c8d
lea edx, [edi + 0x30]
push edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call fcn.00404c8d
mov al, byte [edi + 0x40]
mov byte [esi + 0x40], al
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x50ea70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5c3000
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
push 0x11
xor ebx, ebx
push str.ambiguous_option
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0041072d
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
call fcn.0040f56c
push eax
mov ecx, esi
call fcn.0040f923
mov dword [esi], vtable.boost::program_options::error.0
cmp dword [esp + 0x28], 0x10
mov byte [esp + 0x34], 2
jb 0x50eaf9
mov ecx, dword [esp + 0x14]
push ecx
call fcn.005112a2
add esp, 4
mov edx, dword [esp + 0x40]
push edx
lea ecx, [esi + 0x28]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esi], vtable.boost::program_options::ambiguous_option.0
call fcn.0041a822
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret 8

Function at 0x5112a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6dd9a4]
jne 0x5112b1
repz ret
jmp fcn.0051f828
Function at 0x521d8b
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x6de648]
je 0x521da6
inc edi
cmp edi, 0x17
jb 0x521d97
cmp edi, 0x17
jae 0x521f26
push ebp
push 3
call fcn.0052975b
cmp eax, 1
pop ecx
je 0x521ef2
push 3
call fcn.0052975b
test eax, eax
pop ecx
jne 0x521dda
cmp dword [0x6dd9a0], 1
je 0x521ef2
cmp ebx, 0xfc
je 0x521f25
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x727918
push ebp
call fcn.00520028
add esp, 0xc
test eax, eax
je 0x521e10
push esi
push esi
push esi
push esi
push esi
call fcn.00511f50
add esp, 0x14
push 0x104
mov esi, 0x727931
push esi
push 0
mov byte [0x727a35], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x521e54
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00520028
add esp, 0xc
test eax, eax
je 0x521e54
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00511f50
add esp, 0x14
push esi
call fcn.00518240
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x521e99
push esi
call fcn.00518240
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x727c2c
push 0x65fd14
sub ecx, eax
push ecx
push eax
call fcn.0052ab90
add esp, 0x14
test eax, eax
je 0x521e99
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00511f50
add esp, 0x14
jmp 0x521e9b
xor esi, esi
push 0x65af00
push ebx
push ebp
call fcn.00529dfd
add esp, 0xc
test eax, eax
je 0x521ebb
push esi
push esi
push esi
push esi
push esi
call fcn.00511f50
add esp, 0x14
push dword [edi*8 + 0x6de64c]
push ebx
push ebp
call fcn.00529dfd
add esp, 0xc
test eax, eax
je 0x521edd
push esi
push esi
push esi
push esi
push esi
call fcn.00511f50
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0052b8a1
add esp, 0xc
jmp 0x521f25
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x521f25
cmp ebp, 0xffffffff
je 0x521f25
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x6de64c]
push dword [esi]
call fcn.00518240
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x52b8a1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0051fa06
xor ebx, ebx
cmp dword [0x727d9c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x52b977
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x52ba57
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x661ff4
push edi
call esi
cmp eax, ebx
je 0x52ba57
push eax
call fcn.0051f998
mov dword [esp], 0x6613a0
push edi
mov dword [0x727d9c], eax
call esi
push eax
call fcn.0051f998
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x727da0], eax
call esi
push eax
call fcn.0051f998
mov dword [0x727da4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0051a728
test eax, eax
pop ecx
pop ecx
je 0x52b945
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00511f50
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x52b977
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0051f998
cmp eax, ebx
pop ecx
mov dword [0x727dac], eax
je 0x52b977
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0051f998
pop ecx
mov dword [0x727da8], eax
mov eax, dword [0x727da8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x52b9fc
cmp dword [0x727dac], ecx
je 0x52b9fc
push eax
call fcn.0051fa0f
push dword [0x727dac]
mov esi, eax
call fcn.0051fa0f
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x52b9fc
cmp edi, ebx
je 0x52b9fc
call esi
cmp eax, ebx
je 0x52b9c9
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x52b9c9
test byte [ebp - 0x18], 1
jne 0x52b9fc
lea eax, [ebp - 0x10]
push eax
call fcn.0051a75f
test eax, eax
pop ecx
je 0x52b9e4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00511f50
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x52b9f3
or dword [ebp + 0x10], 0x200000
jmp 0x52ba37
or dword [ebp + 0x10], 0x40000
jmp 0x52ba37
mov eax, dword [0x727da0]
cmp eax, dword [ebp - 8]
je 0x52ba37
push eax
call fcn.0051fa0f
cmp eax, ebx
pop ecx
je 0x52ba37
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x52ba37
mov eax, dword [0x727da4]
cmp eax, dword [ebp - 8]
je 0x52ba37
push eax
call fcn.0051fa0f
cmp eax, ebx
pop ecx
je 0x52ba37
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x727d9c]
call fcn.0051fa0f
cmp eax, ebx
pop ecx
je 0x52ba57
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x52ba59
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x540c5f
Capabilities:
Hide graphical window

Disassembly:
mov ecx, esi
call fcn.00540af2
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret
Function at 0x564f11
Capabilities:
Hide graphical window

Disassembly:
cmp byte [ecx + 0x2c], 0
sete al
mov byte [ecx + 0x2c], al
neg al
sbb eax, eax
and eax, 5
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x56d6cb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x56d6fb
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x56d6f6
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x56d723
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x56d70c
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.005167a0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x56d7d4
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x67b370]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x67b370]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x56d817
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, dword [esp + 8]
jne 0x56d824
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x56d8d6
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
sub eax, 8
dec edi
jne 0x56d83b
pop edi
test eax, eax
je 0x56d8ef
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x67b370]
inc ecx
dec eax
jne 0x56d8da
mov eax, esi
pop ebx
not eax
pop esi
ret

Function at 0x56f42f
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret

Function at 0x56f43d
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret
Function at 0x57280b
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 4]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x30]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x30]
push eax
lea edi, [ebp - 8]
call fcn.00432dbb
cmp dword [esi + 0x3c], ebx
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
jne 0x5728d0
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [esi + 0x40], eax
push dword [esi + 0x3c]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push dword [ebp - 0x2c]
mov dword [esi + 0x44], eax
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push ebx
push ebx
push dword [esi + 0x3c]
call edi
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push 0xcc0020
push ebx
push ebx
push dword [esi + 0x3c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push ebx
push ebx
push dword [ebp + 8]
call edi
lea esi, [ebp - 0x10]
call fcn.004474ac
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x581103
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x90
cmp eax, esi
mov dword [edi], eax
mov byte [edi + 5], 0
je 0x581141
cmp eax, 0x14
je 0x581141
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
cmp al, byte [ebp + 8]
mov byte [edi + 4], al
je 0x581178
mov esi, dword [edi]
push 0
push eax
mov byte [edi + 5], 1
call fcn.00580fbd
pop ecx
pop ecx
jmp 0x581178
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
cmp al, byte [ebp + 8]
je 0x581178
mov eax, dword [edi]
cmp eax, esi
sete cl
mov byte [ebp + 8], cl
push dword [ebp + 8]
mov esi, eax
push 1
mov byte [edi + 5], 1
call fcn.00580fbd
push dword [ebp + 8]
mov esi, dword [edi]
push 0
call fcn.00580fbd
add esp, 0x10
mov eax, edi
pop esi
pop ebp
ret 4

Function at 0x5811c9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
mov esi, 0x91
push esi
mov byte [0x72ab95], bl
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
cmp bl, al
je 0x5811fc
push 0
push 0
call fcn.00580fbd
push 0
push 1
call fcn.00580fbd
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x581365
Capabilities:
Log keystrokes via polling

Disassembly:
push 8
mov eax, 0x5c9b79
call fcn.00518b46
mov esi, dword [ebp + 8]
xor ebx, ebx
push 8
mov dword [ebp - 4], ebx
push esi
mov dword [ebp - 0x10], ebx
call fcn.00401000
mov dword [ebp - 4], ebx
push ebx
mov eax, edi
mov dword [ebp - 0x10], 1
call fcn.0040107b
push dword [ebp + 0xc]
push 2
call fcn.00401099
push dword [ebp + 0x10]
push 4
call fcn.00401099
cmp edi, 0x60
mov eax, 0x90
jb 0x5813b9
cmp edi, 0x69
jbe 0x5813e0
cmp edi, 0x6e
je 0x5813e0
cmp edi, eax
je 0x5813e0
cmp byte [ebp + 0x10], bl
jne 0x5813f8
cmp edi, 0x21
jb 0x5813d1
cmp edi, 0x28
jbe 0x5813e0
cmp edi, 0x2d
je 0x5813e0
cmp edi, 0x2e
je 0x5813e0
cmp edi, 0xc
jne 0x5813f8
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
neg al
push 7
sbb eax, eax
and eax, 2
dec eax
call fcn.0040107b
mov eax, esi
call fcn.00518c1e
ret 0xc
Function at 0x5894e6
Capabilities:
Hide graphical window

Disassembly:
push 0x30
mov eax, 0x5c6981
call fcn.00518b46
xor edi, edi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0x1c]
call fcn.005aa477
cmp dword [ebp - 0x1c], edi
jne 0x58950c
xor al, al
jmp 0x589608
mov ebx, dword [ebp - 0x18]
push 1
push dword [ebp + 8]
lea esi, [ebp - 0x24]
call fcn.005aa477
mov ecx, dword [eax]
cmp ecx, edi
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
je 0x589505
mov dword [ebp - 0x10], eax
mov eax, dword [0x72dc3c]
lea esi, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
call fcn.0041f60a
mov dword [ebp - 4], edi
cmp dword [ebp - 0x24], edi
je 0x5895f6
mov eax, dword [0x72dc3c]
lea esi, [ebp - 0x2c]
call fcn.0041f5f6
mov eax, dword [eax]
cmp dword [eax + 0x940], edi
mov ecx, dword [ebp - 0x28]
setne byte [ebp + 0xb]
cmp ecx, edi
je 0x58956c
call fcn.004113ee
mov eax, dword [0x72dc3c]
lea esi, [ebp - 0x2c]
call fcn.0041f5f6
cmp byte [ebp + 0xb], 0
je 0x5895af
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
lea esi, [eax + 0x914]
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x58959a
call fcn.004113ee
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
add eax, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
add eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x5895cf
mov byte [ebp - 4], 1
mov eax, dword [eax]
lea edi, [ebp - 0x14]
mov ecx, eax
call fcn.0058f492
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x5895cf
call fcn.004113ee
mov esi, dword [ebp - 0x24]
push 1
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
cmp ecx, edi
je 0x589606
call fcn.004113ee
mov al, 1
call fcn.00518c1e
ret 4

Function at 0x590532
Capabilities:
Hide graphical window

Disassembly:
push edi
push dword [esi + 0x38]
mov edi, eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x59059d
test edi, edi
je 0x590568
cmp edi, 2
je 0x590564
mov ecx, dword [esi + 0x90]
add ecx, 0x70
call fcn.005708af
neg al
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
mov edi, eax
test edi, edi
jne 0x590587
push 5
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x3e8
push 1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
ret
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
ret
Function at 0x59b27e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [eax + 4]
call edi
mov eax, dword [0x72dc3c]
test eax, eax
je 0x59b2db
push esi
lea esi, [ebp - 8]
call fcn.00401420
mov eax, dword [eax]
push 8
push dword [eax + 4]
call edi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x59b2b8
call fcn.004113ee
mov eax, dword [0x72dc3c]
lea esi, [ebp - 8]
call fcn.00401420
mov eax, dword [eax]
mov byte [eax + 0x52c], 0
mov ecx, dword [ebp - 4]
test ecx, ecx
pop esi
je 0x59b2db
call fcn.004113ee
xor eax, eax
inc eax
pop edi
leave
ret 8

Function at 0x59b46b
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 4]
mov byte [esi + 0x52c], 1
call edi
push 8
push dword [esi + 0x504]
call edi
pop edi
ret
Function at 0x59ded3
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x72dc3c]
push ebx
push ebp
push esi
xor esi, esi
cmp dword [eax + 0xb0], esi
je 0x59df00
push esi
call sub.USER32.dll_BlockInput
mov eax, dword [0x72dc3c]
call fcn.005a32cc
mov eax, dword [0x72dc3c]
mov dword [eax + 0xb0], esi
mov eax, dword [edi + 0x570]
cmp eax, esi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
je 0x59df16
push esi
push dword [eax + 4]
call ebp
lea ebx, [edi + 0x568]
mov esi, dword [ebx]
test esi, esi
je 0x59df30
call fcn.0056f406
mov eax, dword [ebx]
push 0
push dword [eax + 4]
call ebp
lea esi, [edi + 0x560]
mov eax, dword [esi]
test eax, eax
je 0x59df50
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x59df50
mov eax, dword [esi]
call fcn.0058854b
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
lea esi, [edi + 0x580]
mov eax, dword [esi]
test eax, eax
je 0x59df76
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x59df76
mov eax, dword [esi]
push dword [eax + 4]
call ebx
lea esi, [edi + 0x578]
mov eax, dword [esi]
test eax, eax
je 0x59df96
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x59df96
mov eax, dword [esi]
push dword [eax + 4]
call ebx
lea eax, [edi + 0x548]
xor edx, edx
cmp dword [eax], edx
je 0x59dfb3
mov dword [eax], edx
mov ecx, dword [eax + 4]
cmp ecx, edx
mov dword [eax + 4], edx
je 0x59dfb3
call fcn.004113ee
mov eax, dword [0x72dc3c]
mov esi, dword [eax + 0x24]
call fcn.0058ff8a
push 0
push dword [edi + 0x504]
call ebp
push 0
push dword [edi + 4]
call ebp
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x59e498
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
call fcn.00449901
call fcn.00449901
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.0059e2a6
push 0
push 0x3e8
push 3
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
pop edi
ret

Function at 0x5a04c5
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret

Function at 0x5a2747
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esi + 0x25], 0
sete al
test al, al
mov byte [esi + 0x25], al
je 0x5a2769
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x3e8
jmp 0x5a277b
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x7d0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
ret