joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4399f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
movsx ebx, byte [esp + 8]
push esi
push edi
mov edi, dword [edx]
mov eax, dword [edx + 8]
mov ecx, edi
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x606758]
shr edi, 8
xor ecx, edi
mov dword [edx], ecx
movzx ecx, cl
add ecx, dword [edx + 4]
mov esi, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x606758]
and esi, 0xfffd
mov dword [edx + 8], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
pop edi
shr eax, 8
pop esi
xor eax, ebx
pop ebx
ret

Function at 0x439a60
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
cmp byte [esi + 0x2d], 0
mov eax, edi
je 0x439ade
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x439a91
cmp dword [esi + 0x40], ebx
jae 0x439a91
push eax
call fcn.005759d0
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x439aa9
lea eax, [ebx + ebx]
push eax
call fcn.005759c5
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov ecx, dword [esi + 0x3c]
push ebx
push edi
push ecx
call fcn.00588160
add esp, 0xc
xor edi, edi
test ebx, ebx
jbe 0x439adb
lea edx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
movzx ecx, byte [edi + eax]
push ecx
call fcn.004399f0
mov ecx, dword [esi + 0x3c]
mov byte [edi + ecx], al
inc edi
add esp, 4
cmp edi, ebx
jb 0x439ac0
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x439b17
mov ecx, dword [esi + 0x24]
lea edi, [ecx + ebx]
cmp edi, dword [esi + 0x28]
jb 0x439aff
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push ebx
push eax
add ecx, edx
push ecx
call fcn.00588160
add esp, 0xc
add dword [esi + 0x24], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x439b38
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8

Function at 0x439d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, eax
add esi, 4
test edx, edx
jne 0x439d8e
xor eax, eax
jmp 0x439da4
mov eax, edx
push edi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439d94
sub eax, edi
sar eax, 1
pop edi
push eax
push edx
mov ecx, esi
call fcn.00401960
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
cmp eax, 0xffffffff
jne 0x439dbf
xor eax, eax
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
ret
Function at 0x439ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
test ebp, ebp
je 0x439f98
test ebx, ebx
je 0x439f98
test edi, edi
je 0x439f98
push esi
push 0x100
call fcn.005759c5
mov esi, eax
mov eax, dword [esp + 0x24]
push eax
push ebx
call fcn.00439fa0
add esp, 0xc
test eax, eax
jne 0x439f09
pop esi
pop edi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x18]
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x439f81
sub ebp, edi
mov dword [esp + 0x14], edx
jmp 0x439f20
inc eax
and eax, 0x800000ff
jns 0x439f2f
dec eax
or eax, 0xffffff00
inc eax
movzx edx, byte [eax + esi]
add ecx, edx
and ecx, 0x800000ff
jns 0x439f45
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [ecx + esi]
mov dl, byte [eax + esi]
mov byte [eax + esi], bl
mov byte [ecx + esi], dl
movzx edx, byte [eax + esi]
movzx ebx, byte [ecx + esi]
add edx, ebx
and edx, 0x800000ff
jns 0x439f6b
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [edx + esi]
xor dl, byte [edi + ebp]
inc edi
sub dword [esp + 0x14], 1
mov byte [edi - 1], dl
jne 0x439f20
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push esi
mov dword [eax], edx
call fcn.005759d0
add esp, 4
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x439fa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x43a005
test esi, esi
je 0x43a005
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x439fb4
push edi
xor edi, edi
xor ecx, ecx
mov eax, ecx
cdq
idiv ebx
movzx eax, byte [edx + ebp]
movzx edx, byte [ecx + esi]
add eax, edi
add edx, eax
mov edi, edx
and edi, 0x800000ff
jns 0x439fe7
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ecx + esi]
mov dl, byte [edi + esi]
mov byte [ecx + esi], dl
inc ecx
cmp ecx, 0x100
mov byte [edi + esi], al
jl 0x439fc4
pop edi
pop ebp
mov eax, 0xffffffff
pop ebx
ret
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x43bf50
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
and byte [edi + 0xc], 9
mov al, byte [edi + 0xc]
test al, 1
je 0x43bf86
test al, 8
jne 0x43bf86
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x43bf86
or byte [edi + 0xc], 4
mov cl, byte [edi + 0xc]
test eax, 0x21000000
jne 0x43bf86
or cl, 2
mov byte [edi + 0xc], cl
test byte [edi + 0xc], 2
je 0x43bfa0
mov eax, dword [edi + 4]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.0043b390
pop edi
ret
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret

Function at 0x43cea0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x43ceb8
mov esi, 8
push 2
call edi
test ax, ax
jge 0x43cec4
or esi, 2
push 1
call edi
test ax, ax
jge 0x43ced0
or esi, 1
push 0x10
call edi
test ax, ax
jge 0x43cedc
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x43cee8
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x43dff0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x2d4], esi
jle 0x43e044
jmp 0x43e010
mov eax, dword [edi + 0x2d0]
mov byte [esp + 0x38], 0
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push eax
push ebp
push ebx
call edx
cmp byte [esp + 0x38], 0
jne 0x43e1cd
inc esi
cmp esi, dword [edi + 0x2d4]
jl 0x43e010
sub ebx, 0x100
je 0x43e152
sub ebx, 4
je 0x43e0d0
sub ebx, 2
jne 0x43e146
cmp dword [edi + 0xe0], ebx
je 0x43e146
xor eax, eax
xor ecx, ecx
push ebp
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], cx
call fcn.0058ae80
mov ecx, dword [edi + 0xe0]
add esp, 4
mov word [esp + 0x38], ax
mov edx, dword [ecx]
mov edx, dword [edx + 0x110]
push reloc.WS2_32.dll_select
lea eax, [esp + 0x3c]
push eax
push 0x4438f0
call edx
mov esi, eax
test esi, esi
je 0x43e146
mov eax, dword [esi]
mov edx, dword [eax + 0x104]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
mov ecx, dword [edi + 0xe4]
test ecx, ecx
je 0x43e146
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0xf4]
mov dword [esp + 0x14], ecx
mov ecx, dword [edi + 0xf8]
mov dword [esp + 0x10], 6
mov word [esp + 0x24], bp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.0043cea0
mov word [esp + 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x11c]
lea eax, [esp + 0x10]
push eax
call edx
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
cmp ebp, 9
jne 0x43e146
cmp dword [edi + 0xe4], 0
je 0x43e1b6
mov ecx, dword [edi + 0xe4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xdc]
call edx
test al, al
je 0x43e1b6
mov ecx, dword [edi + 0xe4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe8]
call edx
test al, al
je 0x43e1b6
mov ecx, dword [edi + 0xe4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.RichEdit
call edx
push eax
call fcn.00584472
add esp, 8
test eax, eax
je 0x43e1b6
mov eax, dword [edi + 0xe4]
cmp byte [eax + 0x699], 0
jne 0x43e146
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge cl
movzx edx, cl
push edx
call fcn.004416d0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x20
ret 0xc
Function at 0x441170
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push edi
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 8], 0
je 0x4411ab
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x4411ab
cmp esi, dword [edi + 0xe4]
je 0x4411ab
cmp byte [edi + 0xdc], 0
jne 0x4411ab
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe4]
cmp esi, eax
je 0x4412c2
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x441228
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0xe4]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x11c]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [edi + 0xe4]
push 0
push 0
push 0
push str.killfocus
call fcn.00441c20
mov dword [edi + 0xe4], 0
test esi, esi
je 0x4412c2
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
mov ecx, esi
call eax
cmp eax, edi
jne 0x4412c2
mov edx, dword [esi]
mov eax, dword [edx + 0xdc]
mov ecx, esi
call eax
test al, al
je 0x4412c2
mov edx, dword [esi]
mov eax, dword [edx + 0xe8]
mov ecx, esi
call eax
test al, al
je 0x4412c2
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edi + 0xe4], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], esi
call ebx
mov ecx, dword [edi + 0xe4]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x11c]
lea eax, [esp + 8]
push eax
call edx
mov ecx, dword [edi + 0xe4]
push 0
push 0
push 0
push str.setfocus
call fcn.00441c20
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45a560
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
test ecx, ecx
jne 0x45a56b
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x45a644
mov esi, edx
shr esi, 3
push edi
lea ecx, [ecx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x606190]
inc ecx
sub edx, 8
sub esi, 1
jne 0x45a580
pop edi
test edx, edx
je 0x45a66b
jmp 0x45a650
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x606190]
inc ecx
sub edx, 1
jne 0x45a650
not eax
pop esi
ret

Function at 0x45adc0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
imul esi, dword [esp + 0x10]
cmp byte [edi], 0
je 0x45adf8
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45aded
mov byte [edi + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x45ae0b
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call fcn.00588160
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret

Function at 0x45be00
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [esi], 0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push edi
jne 0x45be96
cmp dword [esi + 4], 0xffffffff
jne 0x45be96
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x45be30
mov eax, dword [0x60249c]
mov dword [edi], eax
cmp ebx, 1
jne 0x45be5f
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebx
je 0x45be5f
mov eax, 0x2000000
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebp
mov edi, ebx
call fcn.0045ac80
add esp, 0xc
test eax, eax
jne 0x45be83
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
call fcn.0045b1a0
mov dword [esi], eax
mov eax, dword [0x635774]
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
pop edi
pop ebp
mov eax, 0x1000000
pop ebx
pop ecx
ret 0xc
Function at 0x464190
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x694], 0
je 0x464216
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x100
jne 0x4641f4
cmp bx, 0xd
jne 0x4641f4
cmp byte [esi + 0x69a], 0
je 0x4641d3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4641f4
cmp byte [esi + 0x69b], 0
jne 0x4641f4
mov edi, dword [esi + 0x5c]
test edi, edi
je 0x4641ec
push 0
push 0
push 0
push str.return
mov ecx, esi
call fcn.00441c20
pop edi
pop ebx
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 0x694]
mov ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
mov eax, dword [esp + 0x1c]
push eax
push ebx
push edi
call edx
pop edi
pop ebx
pop esi
ret 0x10
mov eax, 1
pop esi
ret 0x10
Function at 0x468790
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x9c
push ebp
push esi
mov esi, eax
lea eax, [esp + 0xc]
push eax
mov eax, edi
mov dword [edi + 0x10], esi
call fcn.00468990
mov ecx, dword [edi + 0x10]
mov esi, dword [esi + 0x6f0]
mov eax, dword [ecx + 0x668]
or esi, 0x40000080
test al, 1
je 0x4687c7
or esi, 1
jmp 0x4687ce
test al, 2
je 0x4687ce
or esi, 2
cmp byte [ecx + 0x6e1], 0
je 0x4687da
or esi, 0x20
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov eax, dword [eax + 0x84]
sub edx, ecx
push edx
mov edx, dword [esp + 0x10]
sub ebp, edx
push ebp
push ecx
push edx
push 0
push esi
push 0
push eax
mov eax, edi
call fcn.0043a870
mov ecx, dword [edi + 0x10]
mov esi, dword [ecx + 0x664]
cmp esi, 0xffffffff
je 0x46882e
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
mov ecx, esi
mov edx, eax
call fcn.004424e0
test eax, eax
jne 0x468841
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
mov esi, eax
call fcn.00441f20
mov eax, dword [eax]
mov ecx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push ecx
call esi
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 0x6dc]
mov ecx, dword [edi + 4]
push 0
push eax
push 0xc5
push ecx
call esi
mov eax, dword [edi + 0x10]
cmp byte [eax + 0x6e1], 0
je 0x46888a
movzx edx, word [eax + 0x6e4]
mov eax, dword [edi + 4]
push 0
push edx
push 0xcc
push eax
call esi
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x38]
lea eax, [esp + 0x1c]
push eax
call edx
mov eax, dword [eax]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x4688bb
push eax
call fcn.0058622f
add esp, 4
mov eax, dword [edi + 4]
push 0
push 0
push 0xb9
push eax
call esi
mov ecx, dword [edi + 4]
push 0
push 3
push 0xd3
push ecx
call esi
mov ecx, dword [edi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0xe8]
call eax
mov edx, dword [edi + 4]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 4]
xor ecx, ecx
cmp byte [eax + 0x6e0], 1
push 0
sete cl
push ecx
push 0xcf
push edx
call esi
mov eax, dword [edi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [edi + 0x10]
cmp byte [edx + 0x6e2], 0
je 0x468965
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x46894a
mov eax, 1
mov ecx, dword [edi + 4]
push eax
push 0
push 0xb1
push ecx
call esi
mov byte [edi + 0x18], 1
pop esi
pop ebp
add esp, 0x9c
ret
mov edx, dword [edi + 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
push eax
mov eax, dword [edi + 4]
push 0xb1
push eax
call esi
pop esi
mov byte [edi + 0x18], 1
pop ebp
add esp, 0x9c
ret
Function at 0x468f90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x62c930]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0
push esi
push edi
je 0x46901d
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea eax, [esi + esi]
call fcn.0058b320
mov edi, esp
test edi, edi
je 0x46901d
mov ecx, dword [ebx + 4]
push esi
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebx + 0x10]
push 0xffffffffffffffff
add esi, 0x1e4
push edi
call fcn.00444050
mov esi, dword [ebx + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
push 0
push 0
push 0
push str.textchanged
mov ecx, esi
call eax
mov ecx, esi
mov edi, eax
call fcn.00441c20
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
cmp byte [eax + 0x145], 0
je 0x46901d
mov edi, dword [ebx + 0x10]
call fcn.0044d1f0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005832f8
mov esp, ebp
pop ebp
ret 4

Function at 0x4699d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
sub esp, 0x14
push esi
push eax
mov esi, ecx
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.0044c3a0
mov eax, dword [esi + 0x6d8]
test eax, eax
je 0x469a6b
lea ecx, [esp + 8]
push ecx
call fcn.00468990
lea edx, [esp + 8]
push edx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x469a3f
mov eax, dword [esi + 0x6d8]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push 0x54
sub edx, eax
push edx
mov edx, dword [esp + 0x18]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x6d8]
push ecx
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x469a80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
sub esp, 0x14
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0044c850
mov eax, dword [esi + 0x6d8]
test eax, eax
je 0x469b07
lea ecx, [esp + 8]
push ecx
call fcn.00468990
lea edx, [esp + 8]
push edx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x469adb
mov eax, dword [esi + 0x6d8]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push 0x54
sub edx, eax
push edx
mov edx, dword [esp + 0x18]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x6d8]
push ecx
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4796a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x98
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x10], eax
mov dword [eax + 0x6e8], 0
cmp dword [esi + 4], 0
push edi
jne 0x47972c
lea edi, [esp + 0xc]
mov eax, esi
call fcn.004797b0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0x84]
sub edx, ecx
push edx
mov edx, dword [esp + 0x10]
sub edi, edx
push edi
push ecx
push edx
push 0
push 0x40000000
push 0
push eax
mov eax, esi
call fcn.0043a870
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
mov edi, dword [ecx + 0x664]
call eax
mov ecx, edi
mov edx, eax
call fcn.00442810
mov ecx, dword [eax]
mov edx, dword [esi + 4]
push 1
push ecx
push 0x30
push edx
call ebp
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
lea edx, [esp + 0x1c]
push edx
call eax
mov ecx, dword [eax]
cmp word [ecx], 0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
sete bl
cmp eax, edx
je 0x479759
push eax
call fcn.0058622f
add esp, 4
test bl, bl
je 0x47976c
mov eax, dword [esi + 0x10]
add eax, 0x6d8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
add ecx, 0x6d8
push ecx
push 0
push 0x1002
push edx
call ebp
mov eax, dword [esi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop ebp
mov byte [esi + 0x18], 1
pop ebx
add esp, 0x98
ret

Function at 0x479cd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
sub esp, 0x10
push esi
push edi
push eax
mov esi, ecx
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.0044c3a0
mov eax, dword [esi + 0x6f0]
test eax, eax
je 0x479d6a
lea edi, [esp + 8]
call fcn.004797b0
mov eax, edi
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x479d3e
mov ecx, dword [esi + 0x6f0]
mov edx, dword [ecx + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x54
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x10]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x6f0]
push ecx
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14