joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf752
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x50d488]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x4f28c8
mov dword [esi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea edi, [esi + 4]
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ecx
push edi
lea eax, [ecx - 8]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00434a20
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00435360
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x517398]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x444b77
mov eax, dword [eax]
push ecx
push 2
push eax
mov ecx, edi
call fcn.00434b30
test eax, eax
jne 0x444ba5
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x444b9d
or eax, 4
push 0
push eax
call fcn.00432590
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x447710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfc4b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x50d488]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
sub esp, 8
mov dword [ebp - 4], 0
call fcn.00421380
mov byte [ebp - 4], 1
lea ecx, [edi + 0x34]
mov eax, dword [edi + 0x10]
mov dword [edi + 0x30], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [edi + 0x48], 7
mov dword [edi + 0x44], 0
push eax
mov word [edi + 0x34], ax
lea eax, [ebp + 8]
push eax
call fcn.00407640
mov byte [ebp - 4], 2
lea edx, [edi + 0x34]
mov ecx, edi
mov byte [edi + 0x4c], 0
call fcn.00446c70
cmp dword [edi + 0xc], 0
jne 0x4477ac
mov ecx, edi
call fcn.00423330
mov dword [edi + 0xc], 3
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
cmp dword [ebp + 0x1c], 8
mov byte [edi + 0x4c], 0
jb 0x4477c1
push dword [ebp + 8]
call fcn.00494620
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x44b7b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b7f5
cmp byte [ebp + 8], 0
je 0x44b7e9
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x44e6e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0448
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], ebx
call fcn.0044e950
mov esi, eax
cmp word [edi], bx
je 0x44e739
cmp word [edi + 2], 0x3a
jne 0x44e739
mov eax, edi
jmp 0x44e770
mov ecx, esi
call fcn.0044aa80
test al, al
jne 0x44e84e
push edi
lea eax, [ebp - 0x19c]
mov ecx, esi
push eax
call fcn.0044a280
mov ebx, 1
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [ebp - 0x1a0], ebx
call fcn.0044a270
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x118]
call fcn.0044a050
mov dword [ebp - 4], 2
test bl, 1
je 0x44e795
lea ecx, [ebp - 0x19c]
call fcn.0044a150
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea ecx, [ebp - 0x118]
call fcn.0044a270
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44e83c
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x44e83c
push esi
mov dword [ebp - 0x1a8], 0
call fcn.004494b9
add esp, 4
mov dword [ebp - 0x1a0], eax
lea ecx, [ebp - 0x1a8]
push 0
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1a8], esi
jne 0x44e82e
mov eax, dword [ebp - 0x1a4]
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
mov dword [eax], esi
call fcn.0044a150
mov eax, dword [ebp - 0x1a0]
jmp 0x44e91f
push dword [ebp - 0x1a0]
call fcn.00495dcf
add esp, 4
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call fcn.0044a150
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x94]
call fcn.0044a050
push 0x4ee0dc
push 0x4eb980
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.0044acd0
lea eax, [ebp - 0x94]
mov ecx, 0x514c2c
push eax
call fcn.004543d0
mov esi, eax
mov eax, dword [0x514c2c]
cmp esi, eax
je 0x44e8b7
lea ecx, [esi + 0x10]
call fcn.0044a270
push eax
lea ecx, [ebp - 0x94]
call fcn.0044a310
test al, al
mov dword [ebp - 0x1a0], esi
mov eax, dword [0x514c2c]
je 0x44e8bd
mov dword [ebp - 0x1a0], eax
lea esi, [ebp - 0x1a0]
mov esi, dword [esi]
cmp esi, eax
je 0x44e8fd
mov ebx, dword [esi + 0xa4]
push ebx
call fcn.004494b9
add esi, 0x94
add esp, 4
mov edi, eax
cmp dword [esi + 0x14], 0x10
jb 0x44e8e8
mov esi, dword [esi]
push ebx
push esi
push edi
call fcn.0049d050
mov eax, dword [ebp - 0x1a4]
add esp, 0xc
mov dword [eax], ebx
jmp 0x44e90b
mov eax, dword [ebp - 0x1a4]
xor edi, edi
mov dword [eax], 0
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0044a150
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret
Function at 0x44eb70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4eeca8
push dword [ebp + 8]
call fcn.0044e940
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x44ebca
push edi
push esi
call fcn.0044e940
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44ebc9
push esi
call fcn.0044e940
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x44ebc9
push 0x454fd0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00433630
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
pop ebp
jmp 0x44ebe0
push str.multi_language.tsv
call fcn.0044ec10
push str.multi_language_online.tsv
call fcn.0044ec10
push str.multi_language_patch.tsv
call fcn.0044ec10
add esp, 0xc
ret

Function at 0x44ec10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0486
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.0044e4b0
add esp, 4
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.0044a280
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.0044a150
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea ecx, [ebp - 0x94]
call fcn.0044a270
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44ed0a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x44ed45
cmp esi, 0x400000
ja 0x44ed45
push esi
mov dword [ebp - 0x11c], 0
call fcn.004494b9
add esp, 4
mov edi, eax
lea eax, [ebp - 0x11c]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x11c], esi
jne 0x44ecff
push esi
push edi
call fcn.0044efe0
add esp, 8
push edi
call fcn.00495dcf
add esp, 4
jmp 0x44ed45
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0
push eax
push esi
call fcn.0044e6e0
mov esi, eax
add esp, 8
test esi, esi
je 0x44ed45
mov eax, dword [ebp - 0x11c]
cmp eax, 0xa
jbe 0x44ed45
push eax
push esi
call fcn.0044efe0
push esi
call fcn.00495dcf
add esp, 0xc
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0044a150
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret

Function at 0x44f2a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x44f2c5
or esi, 2
push 1
call edi
test ax, ax
jns 0x44f2d1
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x44f2dd
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x44f2e9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x451c70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0x354]
call fcn.0044b420
mov edi, dword [ebp + 8]
test eax, eax
jle 0x451ccb
nop
push esi
lea ecx, [ebx + 0x354]
mov byte [ebp + 0xb], 0
call fcn.0044a260
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x451e2e
lea ecx, [ebx + 0x354]
inc esi
call fcn.0044b420
cmp esi, eax
jl 0x451c90
sub edi, 0x100
je 0x451db7
sub edi, 4
je 0x451d47
sub edi, 2
jne 0x451dac
cmp dword [ebx + 0xe0], edi
je 0x451dac
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.004951f9
mov ecx, dword [ebx + 0xe0]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push setsockopt
push edx
push 0x4546f0
call dword [eax + 0x114]
mov esi, eax
test esi, esi
je 0x451dac
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x108]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebx + 0xe4]
test eax, eax
je 0x451dac
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
movq qword [ebp - 0xc], xmm0
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0xf4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0xf8]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.0044f2a0
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x451dac
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x451e15
mov eax, dword [ecx]
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x451e15
mov ecx, dword [ebx + 0xe4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x451e15
mov ecx, dword [ebx + 0xe4]
push str.RichEdit
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.0049bf58
add esp, 8
test eax, eax
je 0x451e15
mov ecx, dword [ebx + 0xe4]
call fcn.00469050
test al, al
jne 0x451dac
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.00453570
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x453020
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x45305b
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x45305b
cmp esi, dword [edi + 0xe4]
je 0x45305b
cmp byte [edi + 0xdc], 0
jne 0x45305b
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe4]
cmp esi, eax
je 0x453156
test eax, eax
je 0x4530ca
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x20], 0x14
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.00452b90
mov dword [edi + 0xe4], 0
test esi, esi
je 0x453156
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x453156
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x453156
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x453156
xorps xmm0, xmm0
mov dword [edi + 0xe4], esi
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 4], 0
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.00452b90
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x453f10
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x453fbf
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov ecx, 0x514a6c
mov dword [ebp - 4], ebx
call fcn.0044b420
dec eax
mov dword [ebp + 8], eax
js 0x454001
push eax
mov ecx, 0x514a6c
call fcn.0044a260
cmp dword [ebp - 4], 0
mov edi, eax
je 0x453fa8
mov ecx, edi
call fcn.0044e6c0
cmp dword [esi], eax
je 0x453f7b
mov ecx, edi
call fcn.0044e6c0
cmp ebx, eax
jne 0x453f9b
push esi
mov ecx, edi
call fcn.00453eb0
test al, al
jne 0x453fb6
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.00451c70
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
test ebx, ebx
jne 0x453f65
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
js 0x454001
mov ebx, dword [ebp - 4]
jmp 0x453f52
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x514a6c
xor edi, edi
call fcn.0044b420
test eax, eax
jle 0x454001
nop
mov ecx, 0x514a6c
call fcn.0044b420
push edi
mov ecx, 0x514a6c
call fcn.0044a260
mov ebx, eax
mov ecx, ebx
call fcn.0044e6c0
cmp dword [esi], eax
je 0x45400a
mov ecx, 0x514a6c
inc edi
call fcn.0044b420
cmp edi, eax
jl 0x453fd0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.00453eb0
test al, al
jne 0x453fb6
cmp dword [esi + 8], 0xe5
jne 0x454029
push dword [esi]
call sub.IMM32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
lea eax, [ebp - 8]
mov ecx, ebx
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.00451c70
pop edi
test al, al
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fe50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d104b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push eax
mov dword [edi + 0x10], esi
call fcn.0045f480
mov ecx, esi
call fcn.0045fab0
mov ecx, dword [edi + 0x10]
mov esi, eax
or esi, 0x40000080
call fcn.0047c730
test al, 1
je 0x45feb2
or esi, 1
jmp 0x45feb9
test al, 2
je 0x45feb9
or esi, 2
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.00460090
test al, al
je 0x45feca
or esi, 0x20
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov ecx, ebx
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ebx]
push esi
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044e6c0
push eax
mov ecx, edi
call fcn.0044b2b0
mov ecx, dword [edi + 0x10]
call fcn.00458330
cmp eax, 0xffffffff
je 0x45ff19
mov ecx, dword [edi + 0x10]
push eax
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044e050
test eax, eax
jne 0x45ff2a
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044df70
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
push 0
call fcn.0045fa60
push eax
push 0xc5
push dword [edi + 4]
call esi
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.00460090
test al, al
je 0x45ff74
push 0
mov ecx, ebx
call fcn.0045fa90
movzx eax, ax
push eax
push 0xcc
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0044a270
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0044a150
push 0
push 0
push 0xb9
push dword [edi + 4]
call esi
push 0
push 3
push 0xd3
mov ecx, edi
call fcn.0044b710
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [edi + 0x10]
push 0
call fcn.004600a0
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push 0xcf
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x10]
call fcn.00460080
push dword [edi + 4]
test al, al
je 0x46003d
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
mov ecx, 1
cmove eax, ecx
push eax
push 0
jmp 0x460045
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
push eax
push 0xb1
push dword [edi + 4]
call esi
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 4
Function at 0x4600b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045ad00
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x460141
lea eax, [ebp - 0x14]
push eax
call fcn.0045f480
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x460117
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x460160
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4601eb
cmp dword [esi + 0x10], 0
je 0x4601eb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0049e950
mov ebx, esp
test ebx, ebx
je 0x4601eb
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.0044a1f0
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.00452b90
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044ee80
test al, al
je 0x4601eb
mov ecx, dword [esi + 0x10]
call fcn.0045abd0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x460c80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x50d488]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.0045d150
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x460d19
lea eax, [ebp - 0x14]
push eax
call fcn.0045f480
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x460cef
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0044b420
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004944c3
mov esp, ebp
pop ebp
ret 0x14