joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4210
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2010
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x200c], eax
mov eax, dword [esp + 0x2014]
push ebx
push esi
push 0x526a10
mov esi, ecx
mov ecx, dword [esp + 0x2024]
push eax
mov dword [esp + 0x18], ecx
call fcn.004d6190
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
sete cl
mov byte [esi + 0x3028], cl
test cl, cl
je 0x4b4265
xor eax, eax
jmp 0x4b43ac
push ebp
push edi
push ebx
push 0x2000
lea eax, [esp + 0x24]
xor esi, esi
push 1
push eax
mov dword [esp + 0x20], esi
call fcn.0050d63f
add esp, 0x10
mov ebp, eax
cmp ebp, 0x28
jbe 0x4b439f
lea ebx, [ebp - 0x28]
xor edi, edi
mov eax, 0xfeff
test ebx, ebx
je 0x4b433a
lea esi, [esp + 0x20]
cmp byte [esp + edi + 0x1c], 0x2a
jne 0x4b42d4
cmp byte [esp + edi + 0x1d], 0x2a
jne 0x4b42d4
push 0xc
lea eax, [esp + 0x22]
add eax, edi
push 0x532e30
push eax
call fcn.0050a6e0
add esp, 0xc
test eax, eax
je 0x4b436a
mov eax, 0xfeff
cmp word [esi - 4], 0x2a
jne 0x4b42fb
cmp word [esi - 2], 0x2a
jne 0x4b42fb
push 0xc
push str.messages
push esi
call fcn.00509bed
add esp, 0xc
test eax, eax
je 0x4b436a
mov eax, 0xfeff
cmp word [esi - 4], ax
jne 0x4b432a
cmp word [esi - 2], 0x2a
jne 0x4b432a
cmp word [esi], 0x2a
jne 0x4b432a
push 0xc
lea eax, [esi + 2]
push str.messages
push eax
call fcn.00509bed
add esp, 0xc
test eax, eax
je 0x4b436a
mov eax, 0xfeff
inc edi
add esi, 2
cmp edi, ebx
jb 0x4b42a3
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
add ebp, 0xffffffd8
add esi, ebp
push 0
push esi
push ebx
mov dword [esp + 0x1c], esi
call fcn.0050d9a9
push ebx
push 0x2000
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0050d63f
add esp, 0x1c
jmp 0x4b4282
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [esp + 0x14]
push 0
push eax
push edi
call fcn.0050d9a9
push edi
push dword [esp + 0x203c]
push 1
push dword [esp + 0x30]
call fcn.0050d63f
push edi
mov esi, eax
call fcn.00509ce0
add esp, 0x20
mov eax, esi
jmp 0x4b43aa
push ebx
call fcn.00509ce0
add esp, 4
xor eax, eax
pop edi
pop ebp
mov ecx, dword [esp + 0x2014]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x2010
ret 0xc

Function at 0x4b6670
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x130
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x12c], eax
cmp dword [0x54f938], 0
push esi
mov esi, dword [esp + 0x140]
push edi
mov edi, dword [esp + 0x148]
jne 0x4b66ce
push 0x64
lea eax, [esp + 0x70]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [esp + 0x6c]
mov word [0x5999f4], ax
xor eax, eax
mov word [0x5999f6], ax
mov dword [0x54f938], 0x5999f4
push 0x32
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x148]
push dword [esp + 0x148]
call fcn.0049cc80
push edi
push esi
xor eax, eax
push 0x54f928
mov word [esi], ax
lea eax, [esp + 0x14]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ecx, dword [esp + 0x134]
xor eax, eax
mov word [esi + edi*2 - 2], ax
pop edi
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0x130
ret 0x10
Function at 0x4b6730
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xf8
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0xf4], eax
mov ecx, dword [esp + 0x104]
mov eax, dword [esp + 0x10c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x110]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0x5e7
mov dword [esp + 0x1c], 0x5e8
mov dword [esp + 0x20], 0x5e9
mov dword [esp + 0x24], 0x5ea
mov dword [esp + 0x14], eax
test edi, edi
jne 0x4b679c
cmp esi, 0x400
jb 0x4b67c5
mov eax, 1
cmp eax, 5
jae 0x4b67c5
mov ebx, esi
inc ebp
shrd esi, edi, 0xa
and ebx, 0x3ff
inc eax
shr edi, 0xa
test edi, edi
ja 0x4b67a1
jb 0x4b67c5
cmp esi, 0x400
jae 0x4b67a1
push dword [esp + 0x118]
push ecx
push edi
push esi
call fcn.004b6670
test edi, edi
ja 0x4b6855
jb 0x4b67df
cmp esi, 0x64
jae 0x4b6855
test ebx, ebx
je 0x4b6855
imul eax, ebx, 0x3e8
shr eax, 0xa
test edi, edi
ja 0x4b67fe
jb 0x4b67f7
cmp esi, 0xa
jae 0x4b67fe
mov ecx, 0xa
jmp 0x4b6803
mov ecx, 0x64
xor edx, edx
div ecx
mov esi, eax
test esi, esi
je 0x4b6855
push 0x64
lea eax, [esp + 0x40]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx eax, word [esp + 0x3c]
push esi
push eax
push str._c_u
lea eax, [esp + 0x34]
push 0xa
push eax
call fcn.004027c0
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0x3c]
mov edi, dword [esp + 0x24]
add esp, 0x14
push esi
push eax
push edi
call fcn.0049ce50
jmp 0x4b6860
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x118]
cmp dword [esp + 0x11c], 0
jne 0x4b686e
test ebp, ebp
je 0x4b688b
push esi
push 0x5269ec
push edi
call fcn.0049ce50
push esi
push dword [esp + ebp*4 + 0x18]
call fcn.00496b20
push eax
push edi
call fcn.0049ce50
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0xf8
ret 0x14

Function at 0x4b6950
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4b69b4
push ebx
lea ebx, [eax + 1]
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005030d4
mov esi, eax
add esp, 4
test esi, esi
je 0x4b69b2
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push dword [esp + 0x20]
push esi
call fcn.004b6ac0
push esi
call fcn.005030dd
add esp, 4
pop esi
pop ebx
pop edi
ret 0x14
Function at 0x4b88d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, ecx
cmp esi, 0x10d
jne 0x4b8926
push 1
push str.Settings
call fcn.0040de00
test eax, eax
je 0x4b891c
lea esi, [edi + 0x1098]
push esi
push 0x4b84e0
push dword [0x558aa8]
push str.ORGTHEMES
push dword [0x58c1f8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [esi], 0
pop edi
mov al, 1
pop esi
add esp, 0x30
ret 4
cmp esi, 0x10e
jne 0x4b8956
push 1
push 0x52452c
push 0
push 0x4fe
call fcn.00496b20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
mov al, 1
pop esi
add esp, 0x30
ret 4
mov eax, dword [0x558aa8]
push ebx
test eax, eax
jne 0x4b8964
xor ebx, ebx
jmp 0x4b898f
push eax
call dword [sym.imp.USER32.dll_GetMenu]
test eax, eax
jne 0x4b8973
xor ebx, ebx
jmp 0x4b898f
push 4
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
test eax, eax
jne 0x4b8984
xor ebx, ebx
jmp 0x4b898f
push 5
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, eax
cmp esi, 0x10f
jne 0x4b89a8
mov dword [edi + 0x8c], 0xffffffff
push 0x52452c
jmp 0x4b8a0a
lea eax, [esi - 0x41a]
cmp eax, 0x7f
ja 0x4b8a50
push 0x30
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00505530
add esp, 0xc
mov dword [esp + 0xc], 0x30
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x20
push eax
push 0
push esi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x4b8a50
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 0x7c]
jae 0x4b8a50
mov dword [edi + 0x8c], eax
imul eax, eax, 0x1304
add eax, dword [edi + 0x78]
push eax
call fcn.00485280
push eax
push str.ActivePath
push str.InterfaceThemes
call fcn.004af130
mov eax, dword [edi + 0x1094]
cmp eax, 0xffffffff
je 0x4b8a2e
push 0
push eax
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 8
push esi
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, edi
mov dword [edi + 0x1094], esi
call fcn.004b7130
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x30
ret 4
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x30
ret 4
Function at 0x4baad0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x68], eax
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x4baaf6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [edi + 4], 0
push 1
push str.ViewSmall
push str.GeneralToolbar
call fcn.004ae540
test eax, eax
je 0x4bace2
push ebx
push ebp
push 0
push dword [0x58c1fc]
push 0xd
push dword [0x558aa8]
push 0
push 0
push 0
push 0
push 0x56000944
push 0
push str.ToolbarWindow32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0x14
push 0x41e
push eax
mov dword [edi + 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 0x10
mov ebp, ebx
call fcn.004d6640
test al, al
je 0x4bab70
push ebx
call fcn.004d66d0
push ebp
mov ebx, eax
call fcn.004d66d0
mov ebp, eax
push esi
movzx esi, bp
movzx ecx, bx
shl esi, 0x10
or esi, ecx
push esi
push 0
push 0x41f
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push 0x420
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
pop esi
test eax, eax
je 0x4babad
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 0x85
push 0x84
push 0x83
push str.FolderUp.png
push 1
call fcn.004b7eb0
mov dword [edi + 0xc], eax
cmp byte [0x58c2ec], 0
je 0x4babdc
push eax
call fcn.004d5a90
call fcn.004d6900
test al, al
jne 0x4bac09
push dword [edi + 0xc]
mov ecx, 0x57fff8
call fcn.004b70c0
push ebp
push ebx
push dword [edi + 0xc]
call fcn.004d6c70
push 0xf
push 0xffffffffffffffff
push eax
mov dword [edi + 0xc], eax
call fcn.004d6b70
mov eax, dword [edi + 0xc]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0x413
push dword [edi + 4]
mov dword [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x54fe40
push 1
push 0x444
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push 2
call fcn.004b9960
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0x38
mov dword [esp + 0x18], 0x173
pop ebp
pop ebx
test eax, eax
jne 0x4bac6f
mov eax, 1
or eax, 4
mov dword [esp + 0x40], 2
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
push 0x12
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetSysColor]
cmp dword [esp + 0x38], 0
mov dword [esp + 0x1c], eax
jne 0x4bacb4
mov dword [esp + 0x38], 0x2a
lea eax, [esp + 0x5c]
push eax
push dword [0x57da60]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x34], eax
lea eax, [esp + 0xc]
push eax
push 0xffffffffffffffff
push 0x40a
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x6c]
pop edi
xor ecx, esp
call fcn.00502f8e
add esp, 0x6c
ret
Function at 0x4c4dd0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x5abfd0]
mov eax, ecx
xor eax, dword [esp + 4]
mov edx, dword [0x5abfd8]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x59aa40]
movzx eax, cl
add eax, dword [0x5abfd4]
mov dword [0x5abfd0], ecx
imul ecx, eax, 0x8088405
mov eax, dword [esp + 4]
inc ecx
mov dword [0x5abfd4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x59aa40]
mov dword [0x5abfd8], edx
ret 4
Function at 0x4c4e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x304
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x300], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push 0xa8
mov dword [esp + 0x24], eax
lea eax, [esp + 0xec]
push 0
push eax
call fcn.00505530
add esp, 0xc
lea eax, [esp + 0xe8]
push eax
push dword [ebp + 0xc]
push esi
call fcn.004c5520
lea eax, [esp + 0x12]
mov byte [esp + 0x12], 0
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x17], 0
push eax
lea eax, [esp + 0x240]
mov ecx, 0x2a
push eax
push dword [ebp + 0x14]
lea esi, [esp + 0xf8]
lea edi, [esp + 0x248]
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.004c52a0
mov ecx, dword [ebp + 0x20]
mov eax, 0xcccccccd
dec ecx
mul ecx
mov eax, edx
shr eax, 4
add eax, 1
mov dword [esp + 0x24], eax
je 0x4c5077
mov edx, 1
mov dword [esp + 0x18], 0
lea ebx, [esp + 0x2e4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
jmp 0x4c4f00
xor eax, eax
mov byte [esp + 0x2fb], dl
mov dword [esp + 0x2e4], eax
lea esi, [esp + 0x238]
mov dword [esp + 0x2e8], eax
lea edi, [esp + 0x190]
mov dword [esp + 0x2ec], eax
mov ecx, 0x2a
mov dword [esp + 0x2f0], eax
mov dword [esp + 0x2f4], eax
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2f8], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2f9], al
mov eax, edx
shr eax, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x18]
mov byte [esp + 0x2fa], al
mov eax, 4
test ecx, ecx
je 0x4c5035
mov ebx, ecx
lea ecx, [esp + 0x12]
push ecx
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x198]
push ecx
push eax
lea eax, [esp + 0x308]
push eax
call fcn.004c52a0
lea eax, [esp + 0x13]
push eax
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x198]
push eax
push 0x14
lea eax, [esp + 0x308]
push eax
call fcn.004c53d0
xor eax, eax
lea ecx, [ecx]
movzx ecx, byte [esp + eax + 0x2f8]
xor byte [esp + eax + 0x2e4], cl
movzx ecx, byte [esp + eax + 0x2f9]
xor byte [esp + eax + 0x2e5], cl
movzx ecx, byte [esp + eax + 0x2fa]
xor byte [esp + eax + 0x2e6], cl
movzx ecx, byte [esp + eax + 0x2fb]
xor byte [esp + eax + 0x2e7], cl
movzx ecx, byte [esp + eax + 0x2fc]
xor byte [esp + eax + 0x2e8], cl
add eax, 5
cmp eax, 0x14
jb 0x4c4fc0
lea esi, [esp + 0xe8]
mov ecx, 0x2a
lea edi, [esp + 0x190]
rep movsd dword es:[edi], dword [esi]
sub ebx, 1
jne 0x4c4f77
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
xor edx, edx
mov esi, dword [esp + 0x20]
mov ecx, edi
cmp ecx, dword [ebp + 0x20]
jae 0x4c5053
mov al, byte [ebx + ecx]
inc edx
mov byte [ecx + esi], al
inc ecx
cmp edx, 0x14
jb 0x4c5041
mov edx, dword [esp + 0x14]
add edi, 0x14
inc edx
mov dword [esp + 0x18], edi
sub ebx, 0x14
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
lea eax, [edx - 1]
cmp eax, dword [esp + 0x24]
jb 0x4c4f00
mov ecx, dword [esp + 0x30c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4c52a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
push ebx
mov ebx, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
mov eax, dword [ebx + 0xa0]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
cmp eax, 0xffffffff
je 0x4c53aa
cmp eax, 0x40
jbe 0x4c5328
lea eax, [esp + 0x14]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.0049ba10
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 8]
bswap eax
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x24]
bswap eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xa0], 0x14
push ebp
push esi
test edi, edi
je 0x4c5347
cmp byte [edx], 0
je 0x4c5347
mov esi, edi
lea ebp, [ebx + 0x40]
mov ecx, 0x18
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x4c5385
mov ecx, dword [ebx + 0xa0]
mov eax, 0x40
sub eax, ecx
push eax
push 0
lea eax, [ecx + ebx]
push eax
call fcn.00505530
add esp, 0xc
xor eax, eax
xor byte [ebx + eax], 0x36
inc eax
cmp eax, 0x40
jb 0x4c5365
lea ebp, [ebx + 0x40]
push ebp
call fcn.0049bb30
push 0x40
push ebx
push ebp
call fcn.0049bb70
mov edx, dword [esp + 0x10]
test edi, edi
je 0x4c539a
cmp byte [edx], 0
jne 0x4c539a
mov ecx, 0x18
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov byte [edx], 1
mov ecx, dword [esp + 0x18]
pop esi
mov dword [ebx + 0xa0], 0xffffffff
pop ebp
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4c53bd
push eax
push ecx
lea eax, [ebx + 0x40]
push eax
call fcn.0049bb70
mov ecx, dword [esp + 0x28]
pop edi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x24
ret 0x14
Function at 0x4c53d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x14], eax
cmp dword [esi + 0xa0], 0xffffffff
mov dword [esp + 0x10], edi
je 0x4c5411
push 0
push 0
push esi
push 0
push 0
call fcn.004c52a0
lea eax, [esp + 0x18]
push eax
lea ebx, [esi + 0x40]
push ebx
call fcn.0049ba10
mov eax, dword [esp + 0x18]
bswap eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
bswap eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
bswap eax
mov dword [esp + 0x3c], eax
test ebp, ebp
je 0x4c546b
cmp byte [edi], 0
je 0x4c546b
mov ecx, 0x18
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
jmp 0x4c5489
xor eax, eax
lea ecx, [ecx]
xor byte [esi + eax], 0x6a
inc eax
cmp eax, 0x40
jb 0x4c5470
push ebx
call fcn.0049bb30
push 0x40
push esi
push ebx
call fcn.0049bb70
test ebp, ebp
je 0x4c54a4
cmp byte [edi], 0
jne 0x4c54a4
mov eax, dword [esp + 0x10]
mov ecx, 0x18
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x14
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.0049bb70
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0049ba10
mov eax, dword [esp + 0x18]
bswap eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
bswap eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
bswap eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
bswap eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
pop edi
bswap eax
pop esi
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x44]
pop ebp
pop ebx
test eax, eax
je 0x4c550c
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0xc]
call fcn.00504fb0
add esp, 0xc
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00502f8e
add esp, 0x34
ret 0x14
Function at 0x4c93d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
mov edx, dword [eax]
mov edi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push eax
mov esi, dword [edx + 0x48]
mov ecx, esi
mov dword [esp + 0x14], 0
call dword [0x523720]
call esi
mov ebx, eax
test ebx, ebx
js 0x4c94a5
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c949d
mov esi, dword [eax]
lea ecx, [esp + 0xc]
push ecx
push 0x538344
push eax
mov esi, dword [esi]
mov ecx, esi
call dword [0x523720]
call esi
mov ebx, eax
test ebx, ebx
js 0x4c9485
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0x523720]
call esi
mov ebx, eax
test ebx, ebx
js 0x4c9471
mov eax, dword [esp + 0xc]
push dword [esp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x523720]
call esi
mov ebx, eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x523720]
call esi
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x523720]
call esi
mov eax, dword [esp + 0x10]
test ebx, ebx
js 0x4c94a5
test eax, eax
jne 0x4c94fc
cmp dword [edi + 8], 0
je 0x4c94fc
cmp dword [edi + 0x20], 0
jne 0x4c94fc
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4c94fc
push eax
mov ecx, edi
call fcn.004c9ea0
mov esi, eax
test esi, esi
je 0x4c94fc
push 0x204
push 0
push 0
push 0
push 0
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.005097b2
add esp, 4
mov ecx, dword [esp + 0x14]
not ebx
shr ebx, 0x1f
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0xc
ret 8
Function at 0x4ca200
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x10], eax
mov al, byte [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, ecx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x26], al
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov ecx, ebx
call fcn.004c9d30
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4ca24b
push eax
call fcn.005097b2
add esp, 4
test edi, edi
jne 0x4ca253
xor eax, eax
jmp 0x4ca25c
push edi
call fcn.005097cd
add esp, 4
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x20], eax
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4ca297
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
sub esi, edi
push ebx
push dword [ebx]
push 0
push ebp
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
push eax
push esi
push ecx
push edi
push 0x40000000
push 0
push 0x535000
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp dword [ebx + 0x10], 0
mov dword [ebx + 4], eax
jne 0x4ca327
test ebp, ebp
je 0x4ca33d
cmp dword [ebx + 0x20], 0
jne 0x4ca33d
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4ca33d
push eax
mov ecx, ebx
call fcn.004c9ea0
mov esi, eax
test esi, esi
je 0x4ca33d
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.005097b2
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00502f8e
add esp, 0x14
ret 0x14
test eax, eax
je 0x4ca33d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x14
ret 0x14