joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420b87
Capabilities:
Get graphical window text

Disassembly:
push 0xa0
mov eax, 0x53b151
call fcn.005365cc
mov esi, ecx
mov dword [ebp - 0xa0], esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x9c], ebx
push dword [edi]
mov dword [ebp - 4], ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
mov eax, ebx
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 1
test esi, esi
jle 0x420c56
lea eax, [esi + 1]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x98]
call fcn.004206f5
mov ecx, dword [ebp - 0xa0]
jmp 0x420c17
cmp dword [ebp - 0x98], 0
jne 0x420c3a
lea ecx, [ebp - 0x98]
call fcn.00420b77
lea ecx, [ebp - 0x9c]
call fcn.00404f98
xor eax, eax
jmp 0x420c90
lea eax, [esi + 1]
push eax
push dword [ebp - 0x98]
push dword [ecx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x420c6a
mov eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test esi, esi
je 0x420c6a
xor ebx, ebx
test eax, eax
setne bl
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x98], eax
je 0x420c83
lea ecx, [ebp - 0x98]
call fcn.00420b77
lea ecx, [ebp - 0x9c]
call fcn.00404f98
mov eax, ebx
call fcn.00536519
ret 4
Function at 0x421639
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 0x864]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x2e4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x858]
test ecx, ecx
je 0x421668
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x105
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
ret
Function at 0x4288d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x604524]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x110], ecx
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x428a5a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x428a5a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x428a5a
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x428a5a
mov ecx, dword [esi + 4]
mov dword [ebp - 0x10c], eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x114], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x4289ca
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.00428a72
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
movzx eax, ax
push eax
mov eax, dword [ebp - 0x110]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x104]
cmove edi, ecx
cmp dword [ebp - 0x108], eax
je 0x428a4c
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x428a4c
mov ecx, 0x1234
cmp cx, ax
jne 0x428a4c
or dword [ebp - 0x134], 0xffffffff
lea eax, [ebp - 0x104]
push 3
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x108], eax
call fcn.00428a72
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x130], eax
cmp eax, ecx
je 0x428a1d
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
movzx eax, ax
push eax
mov eax, dword [ebp - 0x110]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x114]
test edi, edi
jne 0x428930
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.005364e2
leave
ret 4
Function at 0x42acb9
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x5390d5
call fcn.0053655e
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.004032b6
xor esi, esi
lea ecx, [ebp - 0x28]
push str.https_:
mov dword [ebp - 4], esi
call fcn.00401cd4
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041d306
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.0040257a
test bl, bl
je 0x42ad20
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 5
cmovae eax, dword [ebp - 0x40]
push esi
push esi
push eax
push 0x55a570
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
call fcn.0040257a
call fcn.00536508
ret 4
Function at 0x42d602
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x42d6fc
cmp byte [edi + 0x388], 0
jne 0x42d77b
push ebx
lea eax, [ebp - 0x14]
push eax
lea ebx, [edi + 0x118]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.00421f69
lea esi, [edi + 0x264]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42d6aa
push eax
push dword [edi + 4]
lea ecx, [edi + 0x260]
call fcn.0042a6c2
lea eax, [ebp - 0x24]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
dec ecx
mov eax, edx
mov dword [edi + 0x38c], ecx
sub eax, ecx
mov dword [ebp - 0x28], edx
dec eax
mov ecx, esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.004219fd
mov eax, dword [edi + 0x38c]
mov ecx, ebx
sub dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004219fd
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x14c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push 1
push eax
call fcn.004219fd
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [edi + 0x260]
call fcn.0042b08e
mov byte [edi + 0x388], 1
pop ebx
jmp 0x42d77b
push dword [edi + 0x264]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42d77b
cmp byte [edi + 0x388], 0
je 0x42d77b
lea eax, [ebp - 0x14]
push eax
lea esi, [edi + 0x118]
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 4]
call fcn.00421f69
mov eax, dword [edi + 0x38c]
mov ecx, esi
add dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004219fd
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x14c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push 1
push eax
call fcn.004219fd
push 0
push dword [edi + 0x264]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [edi + 0x388], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005364e2
leave
ret 4
Function at 0x42eef2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
xor bl, bl
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x42ef1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x42ef87
push esi
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42ef1b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x42ef7e
cmp dword [ebp + 0x10], 0
mov ecx, dword [ebp - 4]
push esi
mov ecx, dword [ecx + 0x20]
push ecx
jne 0x42ef58
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x42ef7c
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
cmp ecx, eax
jl 0x42ef7e
push ecx
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x42ef8e
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
cmp byte [ebx + 0x30], 0
lea edi, [ebx + 0x38]
mov dword [ebx + 0x24], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x42efe5
cmp dword [ebx + 0x28], 1
jbe 0x42efe5
xor ecx, ecx
cmp dword [ebx + 0x14], ecx
jne 0x42efe5
lea eax, [ebp + 8]
mov dword [ebp + 8], ecx
push eax
push 4
push ebx
push 0x42f1f4
push ecx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x42efde
mov al, 1
jmp 0x42efe7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x430aeb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [0x604524]
jb 0x430b05
mov eax, dword [eax]
push eax
movzx eax, word [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x430bab
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x430bab
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x430bab
push dword [ebp + 0xc]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x430b9d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x430b96
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 0xc]
push eax
push ebx
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x430b8f
push ebx
push dword [ebp + 0xc]
call fcn.004307b7
pop ecx
pop ecx
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, ebx
jmp 0x430bad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x435b4e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
movsx edx, ax
shr eax, 0x10
push esi
push edi
mov esi, ecx
mov ebx, dword [ebp + 0x14]
movsx ecx, ax
lea edi, [ebp - 0x18]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x1012
push dword [esi + 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x435bb8
cmp dword [ebp - 0x14], 8
jne 0x435bb8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x435bb8
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004355ce
mov ecx, dword [ebp - 4]
xor eax, eax
and dword [ebx], 0
xor ecx, ebp
pop edi
pop esi
inc eax
pop ebx
call fcn.005364e2
leave
ret 0x10

Function at 0x437093
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00436fd8
Function at 0x439134
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.00403d03
mov ecx, eax
call fcn.004a8026
test al, al
je 0x439169
push 0
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004378cf
mov ecx, esi
call fcn.0043994d
mov ecx, esi
call fcn.00439996
jmp 0x43917b
push 5
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0043780d
xor eax, eax
pop esi
ret

Function at 0x439fca
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, ecx
push edi
mov edi, dword [0x604524]
push 0
push 0xc
call esi
push eax
push 0xb
call esi
push eax
push 1
push 0x80
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea esi, [ebx + 4]
push eax
push 1
push 0x80
push dword [esi]
mov dword [ebx + 0x20], eax
call edi
push dword [ebx + 0x20]
push 0
push 0x80
push dword [esi]
call edi
call fcn.00403d03
lea eax, [ebp - 0x1c]
push eax
call fcn.004a7bd8
pop ecx
cmp dword [eax + 0x14], 8
jb 0x43a042
mov eax, dword [eax]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x1c]
call fcn.0040257a
push 0
mov ecx, esi
call fcn.0042074a
push 0x491
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebx + 0x24], eax
lea eax, [ebx + 0x28]
push eax
push dword [0x604524]
push 0x55cb00
push 0x9b
call fcn.00407c96
add esp, 0x10
push dword [ebx + 0x2c]
push 0
push 0x172
push dword [ebx + 0x24]
call edi
push 5
push dword [ebx + 0x24]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005364e2
leave
ret 0x10
Function at 0x445517
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push eax
push str.Shell_TrayWnd
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x44555d
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
cmp dword [ebp - 0x20], 0
jle 0x44555d
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x34]
push ecx
push eax
call esi
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
call esi
lea eax, [ebp - 0x44]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x38]
sub edx, esi
mov edi, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x48]
lea eax, [ecx + 5]
sub edi, ecx
add edx, 0xfffffffb
add edi, 0xfffffff6
mov dword [ebp - 0x10], edx
add eax, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
lea ecx, [ebx + 4]
lea eax, [edx + esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004219fd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005364e2
leave
ret

Function at 0x446a02
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.00447fa3
pop esi
ret

Function at 0x447166
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x5390a0
call fcn.0053655e
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x562dfc
lea ecx, [ebp - 0x28]
call fcn.00401cd4
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00448c84
lea ecx, [ebp - 0x28]
call fcn.0040257a
xor eax, eax
call fcn.00536508
ret 0x10

Function at 0x4480a7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00447fa3
Function at 0x4482e3
Capabilities:
Hide graphical window

Disassembly:
push 0xb0
mov eax, 0x539efb
call fcn.0053652a
mov esi, ecx
push 1
push 3
lea ecx, [ebp - 0xbc]
call fcn.00404da4
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0xac]
push str.ShowActivateButton___:
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___bool_]
lea eax, [ebp - 0xbc]
push eax
push str.CWizardSheet::ShowActivateButton
push 0x28b
push str.C:workprojects_rubilnik_srcuiWizardSheet.cpp
push 1
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x54]
call fcn.00404fea
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
push 5
xor eax, eax
cmp byte [ebp + 8], 1
pop ecx
cmove eax, ecx
push eax
push dword [esi + 0x4c4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.005364f3
ret 4
Function at 0x448dc2
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x448ddf
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
Function at 0x449c08
Capabilities:
Hide graphical window

Disassembly:
push 0x20
mov eax, 0x53ff65
call fcn.0053655e
mov esi, ecx
mov ecx, dword [esi + 0x9c8]
test ecx, ecx
jne 0x449c28
xor eax, eax
inc eax
jmp 0x449d6d
lea eax, [ebp - 0x2c]
xor bh, bh
push eax
xor edi, edi
call fcn.0042adeb
mov ecx, dword [eax]
and dword [ebp - 4], edi
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x21], al
test ecx, ecx
je 0x449c4e
call fcn.00406959
mov ecx, dword [esi + 0x9c8]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042ae75
mov ecx, dword [eax]
mov dword [ebp - 4], 1
mov eax, dword [ecx]
call dword [eax + 0x14]
or dword [ebp - 4], 0xffffffff
mov bl, al
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x449c7d
call fcn.00406959
mov al, byte [ebp - 0x21]
test al, al
jne 0x449c8c
test bl, bl
je 0x449c95
xor edi, edi
jmp 0x449c93
test bl, bl
jne 0x449c95
xor edi, edi
inc edi
mov bh, 1
mov byte [esi + 0x9d4], al
mov byte [esi + 0x9d5], bl
call fcn.00403d03
mov ecx, esi
mov bl, byte [eax + 0x22]
call fcn.0044ab24
xor eax, eax
mov ecx, esi
test bl, bl
cmove eax, edi
push eax
call fcn.0044a13e
xor ecx, ecx
movzx eax, bh
test bl, bl
cmove ecx, eax
movzx eax, cl
mov ecx, esi
push eax
call fcn.0044a32f
lea eax, [ebp - 0x20]
push eax
lea edi, [esi + 0x74]
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 4]
call fcn.00421f69
xor ebx, ebx
inc ebx
cmp dword [esi + 0xa10], ebx
jne 0x449d2d
cmp byte [esi + 0xa14], 0
jne 0x449d5f
push 0
push dword [esi + 0x15c]
call dword [sym.imp.USER32.dll_ShowWindow]
add dword [ebp - 0x1c], 0xf
lea eax, [ebp - 0x20]
add dword [ebp - 0x14], 0xf
mov ecx, edi
push ebx
push eax
call fcn.004219fd
mov byte [esi + 0xa14], bl
jmp 0x449d5f
cmp byte [esi + 0xa14], 0
je 0x449d5f
push 5
push dword [esi + 0x15c]
call dword [sym.imp.USER32.dll_ShowWindow]
sub dword [ebp - 0x1c], 0xf
lea ecx, [ebp - 0x20]
sub dword [ebp - 0x14], 0xf
push ebx
push ecx
mov ecx, edi
call fcn.004219fd
mov byte [esi + 0xa14], 0
call fcn.0044a902
mov ecx, eax
call fcn.004bbf6b
mov eax, ebx
call fcn.00536508
ret
Function at 0x44a13e
Capabilities:
Hide graphical window

Disassembly:
push 0x4c
mov eax, 0x540020
call fcn.0053655e
mov esi, ecx
mov eax, dword [ebp + 8]
lea ebx, [esi + 0x240]
push dword [esi + 0x30]
mov ecx, ebx
mov dword [esi + 0x9d0], eax
call fcn.0043178d
push dword [esi + 0x30]
lea ecx, [esi + 0x328]
call fcn.0043178d
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x76c]
call edi
push 0
push dword [esi + 0x8ac]
call edi
mov eax, dword [esi + 0x9d0]
test eax, eax
jne 0x44a256
mov ecx, dword [esi + 0x9c8]
lea eax, [ebp - 0x40]
push eax
call fcn.0041069b
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x28]
push 0x5633d0
push eax
call fcn.00411f47
add esp, 0xc
push eax
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 1
call fcn.00431725
lea ecx, [ebp - 0x28]
call fcn.0040257a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040257a
push 0x563428
lea ecx, [ebp - 0x28]
call fcn.00401cd4
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [esi + 0x158]
call fcn.00431725
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040257a
push dword [esi + 0x2c]
mov ecx, ebx
call fcn.0043178d
push 5
push dword [esi + 0x76c]
call edi
mov ecx, esi
call fcn.0044b2ac
movzx eax, byte [esi + 0x73a]
mov ecx, esi
push eax
call fcn.0044ad7e
push 0
lea eax, [esi + 0x739]
mov ecx, esi
push eax
lea eax, [esi + 0x700]
push eax
call fcn.0044abb8
jmp 0x44a31a
cmp eax, 1
jne 0x44a31a
mov ecx, dword [esi + 0x9c8]
lea eax, [ebp - 0x28]
push eax
call fcn.0041069b
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 3
push 0x5634c8
push eax
call fcn.00411f47
add esp, 0xc
push eax
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 4
call fcn.00431725
lea ecx, [ebp - 0x40]
call fcn.0040257a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040257a
push 0x563520
lea ecx, [ebp - 0x58]
call fcn.00401cd4
push 5
pop ebx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
push eax
lea ecx, [esi + 0x158]
call fcn.00431725
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.0040257a
push dword [esi + 0x2c]
lea ecx, [esi + 0x328]
call fcn.0043178d
push ebx
push dword [esi + 0x8ac]
call edi
mov ecx, esi
call fcn.0044ad9b
push 0
lea eax, [esi + 0x738]
mov ecx, esi
push eax
lea eax, [esi + 0x6c8]
push eax
call fcn.0044abb8
movzx eax, byte [esi + 0x73b]
mov ecx, esi
push eax
call fcn.0044ad61
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.00536508
ret 4
Function at 0x44a32f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
push edi
mov edi, ecx
cmp byte [edi + 0x9c2], al
je 0x44a3fe
push ebx
push esi
mov byte [edi + 0x9c2], al
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 4]
call fcn.00421f69
cmp byte [edi + 0x9c2], 0
mov ecx, dword [edi + 0x244]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x44a39e
sub dword [ebp - 0x10], 0x14
push 0
push ecx
call esi
push 0
push dword [edi + 0x32c]
call esi
push 0
jmp 0x44a3b8
mov eax, dword [edi + 0x9c4]
push 1
push ecx
mov dword [ebp - 0x10], eax
call esi
push 1
push dword [edi + 0x32c]
call esi
push 1
push dword [edi + 0x414]
call esi
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x34]
call fcn.004219fd
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x76c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push 1
push eax
call fcn.004219fd
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x8ac]
call fcn.004219fd
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005364e2
leave
ret 4

Function at 0x44ab24
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x9c8]
test eax, eax
je 0x44abb6
mov eax, dword [eax + 4]
push esi
cmp eax, 1
je 0x44ab64
cmp eax, 2
je 0x44ab5d
jle 0x44abb5
cmp eax, 4
jle 0x44ab56
cmp eax, 5
jne 0x44abb5
mov esi, 0xa1
jmp 0x44ab69
mov esi, 0xa0
jmp 0x44ab69
mov esi, 0x9f
jmp 0x44ab69
mov esi, 0x9e
push ebx
lea ebx, [edi + 0x3c]
cmp dword [ebx + 4], 0
je 0x44ab81
mov ecx, ebx
call fcn.00421940
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push dword [0x604524]
push 0x55cb00
push esi
call fcn.00407c96
add esp, 0x10
push dword [edi + 0x40]
push 0
push 0x172
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop edi
ret