joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4853e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dced7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7ce4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x198
call fcn.005be217
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004cbc70
mov dword [ebp - 4], 0xffffffff
mov dword [esi], vtable.t_UserAddWnd.0
mov dword [esi + 0x170], 0
mov dword [esi + 0x174], 0
mov dword [esi + 0x178], 0
mov dword [esi + 0x17c], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
mov dword [esi + 0x188], 0
mov dword [esi + 0x18c], 0x785608
mov dword [esi + 0x190], 0x7879f8
mov eax, dword [edi + 0x104]
mov ebx, dword [edi + 0x1a4]
mov dword [edi + 0x1a0], esi
mov dword [ebp - 0x10], eax
call fcn.004c9520
push ecx
push str.Tool_background.png
mov ecx, dword [eax]
call fcn.004c8ea0
mov dword [esi + 0x170], eax
call fcn.004c9520
push ecx
push str.logo.png
mov ecx, dword [eax]
call fcn.004c8ea0
cmp dword [esi + 0x170], 0
mov dword [esi + 0x174], eax
je 0x4855af
test eax, eax
je 0x4855af
push ecx
mov ecx, ebx
call fcn.004cd270
add esp, 4
test al, al
je 0x4855af
push ecx
push ebx
push dword [ebp - 0x10]
mov ecx, esi
push 0x154
push 0x1f4
push 0
push 0
push 0x800a0000
push 0x785608
push 0xc0008
call fcn.004cbe90
test al, al
je 0x4855af
mov ecx, esi
call fcn.00492450
test al, al
je 0x4855af
mov ecx, esi
call fcn.00492810
test al, al
je 0x4855af
mov ecx, esi
call fcn.00492c30
test al, al
je 0x4855af
mov ecx, esi
call fcn.004925e0
test al, al
je 0x4855af
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x108], eax
mov dword [esi + 0x100], ebx
mov esi, dword [edi + 0x1a0]
cmp byte [esi + 0x30], 0
je 0x485581
mov eax, dword [esi]
mov ecx, esi
push 0
mov byte [esi + 0x30], 0
call dword [eax + 0x48]
cmp dword [esi + 0x8c], esi
je 0x48558d
mov byte [esi + 0x64], 1
push 0
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x1a0]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [edi + 0x1a0], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4858a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x7f5670
push 0
call fcn.005bfaac
mov edi, eax
mov esi, 1
test edi, edi
je 0x4859e7
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 4
mov dword [ebp - 4], eax
inc eax
movzx eax, ax
mov dword [ebp + 8], eax
nop dword [eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x485901
push ebx
mov edx, eax
mov ecx, edi
call fcn.00482a30
add esp, 4
test eax, eax
jne 0x48591c
push esi
mov ecx, 0x7f5670
call fcn.005bfaac
mov edi, eax
inc esi
test edi, edi
je 0x4859e7
mov eax, dword [ebp + 8]
jmp 0x4858e0
test edi, edi
je 0x4859e7
mov eax, dword [ebp - 4]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4859e7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4859e7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4859e7
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x485985
cmp esi, ecx
jae 0x4859e7
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x485973
cmp esi, ecx
jae 0x4859e7
cmp word [esi], 0
je 0x4859e7
mov ebx, dword [ebp - 8]
mov ecx, 1
movzx edi, word [esi]
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4859b0
push edi
mov ecx, ebx
call fcn.00485a10
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.005d05d4
push eax
call fcn.00482810
mov eax, dword [ebx]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x4859f2
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004827f0
int3
Function at 0x488690
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dcf6e
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], 0
test edi, edi
je 0x488874
push dword [esi]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x488874
call dword [sym.imp.USER32.dll_EmptyClipboard]
test byte [esi + 4], 8
je 0x4886f9
push edi
call fcn.00479fe0
mov edx, dword [ebp - 0x44]
test edx, edx
jne 0x48870b
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x488874
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov ecx, edx
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x488742
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x64]
call fcn.00474450
push 0
push 0
push 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x50], 8
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmovae eax, dword [ebp - 0x64]
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call edi
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.005be278
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x50], 8
lea ecx, [ebp - 0x64]
cmovae ecx, dword [ebp - 0x64]
push 0
push 0
push esi
mov esi, eax
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0
call edi
mov ecx, esi
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0xf
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x48], 1
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4887d3
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.004756a0
push esi
call fcn.004eddf0
add esp, 4
lea ecx, [ebp - 0x64]
call fcn.004743f0
movups xmm0, xmmword [ebp - 0x40]
mov esi, dword [ebp - 0x4c]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x30]
mov byte [ebp - 4], 0
test byte [esi + 4], 1
movq qword [ebp - 0x18], xmm0
je 0x488827
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004888a0
test byte [esi + 4], 2
je 0x48883e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00488a00
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x488874
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x48886a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x488891
push ecx
push edx
call fcn.005be247
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 8
call fcn.005c44be
int3
Function at 0x4888a0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dcfad
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0x4e
push str._QQRichEditFormat__Info_version_1001____Info__EditElement_type_1__filepath_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004756a0
push esi
lea ecx, [ebp - 0x28]
call fcn.00489320
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0x2f
push str.__shortcut_____EditElement___QQRichEditFormat_
cmp eax, 0x2f
jb 0x48893c
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0x2f]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.005c0660
add esp, 0xc
mov byte [esi + 0x2f], 0
jmp 0x48894d
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x2f
call fcn.00489670
mov edi, dword [ebp - 0x18]
inc edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4889a8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
je 0x4889a1
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push ecx
call fcn.005d0658
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x786924
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push esi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4889a8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4889d8
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4889ce
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4889f5
push ecx
push edx
call fcn.005be247
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 4
call fcn.005c44be
int3
Function at 0x48d7c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x124]
cmp eax, 4
jne 0x48d801
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x128]
cmp eax, 0x1f4
jb 0x48d954
mov dword [esi + 0x124], 3
call edi
mov dword [esi + 0x128], eax
xor al, al
pop edi
pop esi
ret 4
cmp eax, 3
jne 0x48d878
mov edi, dword [esi + 0x110]
cmp byte [edi + 0x30], 1
je 0x48d81f
mov eax, dword [edi]
mov ecx, edi
push 1
mov byte [edi + 0x30], 1
call dword [eax + 0x48]
cmp dword [edi + 0x8c], edi
je 0x48d82b
mov byte [edi + 0x64], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x128]
mov edi, dword [esi + 0x110]
cmp eax, 0x96
jb 0x48d90b
mov dword [esi + 0x124], 2
mov ecx, dword [edi + 0x108]
mov edx, dword [edi + 0x104]
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x28], edx
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 0x44]
mov byte [edi + 0x64], 1
xor al, al
pop edi
pop esi
ret 4
cmp eax, 2
jne 0x48d8a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x128]
cmp eax, 0x866
jb 0x48d954
pop edi
mov dword [esi + 0x124], 1
xor al, al
pop esi
ret 4
cmp eax, 1
jne 0x48d954
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 0x110]
mov edx, 0xfffff79a
sub edx, dword [esi + 0x128]
add edx, eax
cmp edx, 0x96
jb 0x48d904
mov dword [esi + 0x124], 0
mov ecx, edi
mov eax, dword [edi]
push 0
push 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call dword [eax + 0x44]
mov ecx, esi
mov byte [edi + 0x64], 1
call fcn.0048db10
pop edi
xor al, al
pop esi
ret 4
mov eax, 0x96
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
mov ecx, dword [edi + 0x104]
movd xmm0, dword [edi + 0x108]
addsd xmm1, qword [eax*8 + 0x79b450]
cvtdq2pd xmm0, xmm0
divsd xmm1, qword [0x79b380]
mulsd xmm1, xmm0
cvttsd2si edx, xmm1
mov dword [edi + 0x2c], edx
mov dword [edi + 0x28], ecx
mov eax, dword [edi]
push edx
push ecx
mov ecx, edi
call dword [eax + 0x44]
mov byte [edi + 0x64], 1
pop edi
xor al, al
pop esi
ret 4
Function at 0x490020
Capabilities:
Check for unmoving mouse cursor
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [0x7ce4e4]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
lea eax, [esp + 0x28]
mov esi, ecx
xorps xmm0, xmm0
mov dword [esp + 0x20], esi
push eax
movlpd qword [esp + 0x2c], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
add eax, 0xa
add edi, 0x11
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x49009f
lea ecx, [esp + 0x50]
xorps xmm0, xmm0
push ecx
push eax
movaps xmmword [esp + 0x58], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x49009f
push 2
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
test eax, eax
jne 0x4900dc
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x4900ca
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
jmp 0x4900d2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 2
push eax
push ecx
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x490106
movups xmm0, xmmword [esp + 0x88]
movups xmmword [esp + 0x40], xmm0
jmp 0x490187
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edi
movaps xmm0, xmmword [esp + 0x30]
push 0
push str.Shell_TrayWnd
movaps xmmword [esp + 0x48], xmm0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x49017f
lea ecx, [esp + 0x64]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.USER32.dll_SubtractRect]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x28]
mov ecx, 0xfffffff6
mov edx, dword [esp + 0x14]
add eax, edx
cmp eax, dword [esp + 0x48]
jle 0x4901a6
mov eax, ecx
sub eax, dword [esi + 0x2c]
add edx, eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x2c]
lea eax, [edx + edi]
cmp eax, dword [esp + 0x4c]
jle 0x4901b6
sub ecx, edx
add edi, ecx
mov eax, dword [esp + 0x14]
push 0x1d
push edx
push dword [esi + 0x28]
push edi
push eax
push 0xffffffffffffffff
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004ccdf0
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x490d60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, dword [edi + 0x188]
test ecx, ecx
je 0x490ea6
mov edx, dword [ebp + 8]
lea eax, [edx - 1]
cmp eax, 4
ja 0x490ea6
push ebx
push esi
push dword [ebp + 0x14]
push edx
call fcn.00493060
mov esi, dword [edi + 0x188]
cmp byte [esi + 0x30], 1
je 0x490da7
mov eax, dword [esi]
mov ecx, esi
push 1
mov byte [esi + 0x30], 1
call dword [eax + 0x48]
cmp dword [esi + 0x8c], esi
je 0x490db3
mov byte [esi + 0x64], 1
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
neg eax
sbb eax, eax
neg eax
add eax, 4
push eax
push dword [esi + 0x104]
call ebx
mov eax, dword [edi + 0x188]
push 0x1d
push dword [eax + 0x2c]
push dword [eax + 0x28]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [eax + 0x104]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 0x188]
push 4
push dword [eax + 0x104]
call ebx
mov eax, dword [edi + 0x188]
push dword [eax + 0x104]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [edi + 0x188]
cmp byte [esi + 0x30], 1
je 0x490e34
mov eax, dword [esi]
mov ecx, esi
push 1
mov byte [esi + 0x30], 1
call dword [eax + 0x48]
cmp dword [esi + 0x8c], esi
je 0x490e40
mov byte [esi + 0x64], 1
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
neg eax
sbb eax, eax
neg eax
add eax, 4
push eax
push dword [esi + 0x104]
call ebx
push 0
push dword [edi + 0x104]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 0x17c]
test eax, eax
je 0x490e9d
mov eax, dword [eax + 0xf8]
test eax, eax
je 0x490e9d
mov byte [eax + 0x181], 0
mov eax, dword [edi + 0x17c]
push 0
mov eax, dword [eax + 0xf8]
push dword [eax + 0x140]
call ebx
pop esi
pop ebx
mov al, 1
pop edi
pop ebp
ret 0x10
xor al, al
pop edi
pop ebp
ret 0x10
Function at 0x492080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dd2bd
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x30], fcn.005cff37
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], fcn.005cfea2
mov dword [ebp - 0x28], fcn.005cff1c
mov dword [ebp - 4], 0
cmp dword [edi + 0x188], 0
je 0x4921cb
mov ecx, dword [edi + 0x17c]
test ecx, ecx
je 0x4921cb
lea eax, [ebp - 0x40]
push eax
call fcn.00494630
test al, al
je 0x4921cb
cmp dword [ebp - 0x3c], 0
je 0x4921cb
mov eax, dword [edi + 0x17c]
mov ecx, dword [eax + 0xf8]
test ecx, ecx
je 0x4921cb
call fcn.00480910
test eax, eax
je 0x4921cb
mov eax, dword [edi + 0x17c]
mov ecx, dword [eax + 0xf8]
test ecx, ecx
je 0x49213d
call fcn.00480910
jmp 0x49213f
xor eax, eax
mov ecx, 0x787970
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49216a
test dx, dx
je 0x492166
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49216a
add eax, 4
add ecx, 4
test dx, dx
jne 0x492144
xor eax, eax
jmp 0x49216f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4921cb
mov esi, dword [edi + 0x188]
mov dword [ebp - 0x24], esi
test esi, esi
je 0x492204
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [edi + 0x104]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [edi + 0x28]
sub eax, dword [esi + 0x28]
mov ecx, dword [ebp - 0x24]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [edi + 0x2c]
sub eax, dword [ecx + 0x2c]
mov ecx, edi
cdq
sub eax, edx
sar esi, 1
add esi, dword [ebp - 0x20]
sar eax, 1
add eax, dword [ebp - 0x1c]
push 0
push eax
push esi
push 5
call fcn.00490d60
jmp 0x492204
cmp byte [edi + 0x30], 0
je 0x4921de
mov eax, dword [edi]
mov ecx, edi
push 0
mov byte [edi + 0x30], 0
call dword [eax + 0x48]
cmp dword [edi + 0x8c], edi
je 0x4921ea
mov byte [edi + 0x64], 1
push 0
push dword [edi + 0x104]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x108]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x492248
mov edi, dword [ebp - 0x3c]
test edi, edi
jle 0x492233
mov esi, eax
nop dword [eax + eax]
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
add esi, 0x124
sub edi, 1
jne 0x492220
mov eax, dword [ebp - 0x28]
mov ecx, fcn.005cff1c
push dword [ebp - 0x40]
test eax, eax
cmove eax, ecx
call eax
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 4

Function at 0x492320
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
call dword [eax + 0x134]
cmp byte [esi + 0x30], 0
je 0x492340
mov eax, dword [esi]
mov ecx, esi
push 0
mov byte [esi + 0x30], 0
call dword [eax + 0x48]
cmp dword [esi + 0x8c], esi
je 0x49234c
mov byte [esi + 0x64], 1
push 0
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x4948f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xf8]
jne 0x494941
mov ecx, dword [esi]
test ecx, ecx
je 0x494941
push ecx
push dword [edi + 0x108]
call fcn.00480840
mov eax, dword [edi]
mov ecx, edi
push dword [esi]
call dword [eax + 0xe0]
mov eax, dword [esi]
push 0
push dword [eax + 0x140]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi]
cmp byte [esi + 0x30], 0
je 0x494974
mov byte [esi + 0x30], 0
push 0
jmp 0x49496d
push ecx
push dword [edi + 0x108]
mov ecx, dword [esi]
call fcn.00480840
mov eax, dword [esi]
push 5
push dword [eax + 0x140]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi]
cmp byte [esi + 0x30], 1
je 0x494974
mov byte [esi + 0x30], 1
push 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
mov al, 1
cmp dword [esi + 0x8c], esi
je 0x494981
mov byte [esi + 0x64], al
pop edi
pop esi
pop ebp
ret 4

Function at 0x49a690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e8ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], ecx
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
cmp dword [ebx + 4], esi
jbe 0x49a711
nop
mov eax, edi
lea esi, [ebp - 0x138]
and eax, 1
mov ecx, ebx
lea esi, [esi + eax*2]
call fcn.0049a080
movzx eax, word [eax + edi*2]
push eax
call fcn.005db5f9
xor word [esi], ax
inc edi
add esp, 4
cmp edi, dword [ebx + 4]
jb 0x49a6e0
mov esi, dword [ebp - 0x138]
mov eax, 4
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov byte [ebp - 0x18], 1
push 1
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.0049a590
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
push 0x791ea8
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push 0x791e68
push eax
call fcn.0049a160
push str.mutex_file_
lea eax, [ebp - 0x134]
push 0x791e68
push eax
call fcn.0049a160
push esi
lea eax, [ebp - 0x134]
push str.0x_p
push eax
call fcn.0049a160
mov esi, dword [ebp - 0x13c]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x140]
add esp, 0x24
cmp byte [ebp - 0x18], 0
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push esi
call fcn.004a7420
test al, al
jne 0x49a800
mov ecx, esi
call fcn.0049c7f0
push 0x791ed0
push 0x791e68
push eax
call fcn.0049a160
add esp, 0xc
xor bl, bl
jmp 0x49a802
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x49a82b
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x49a82b
push eax
call fcn.005cff1c
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 8