joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f13b
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x10], 0
je 0x41f160
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.0041f0cb
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x80000000
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
jmp 0x41f1a1
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 5
jge 0x41f1cc
lea edx, [ebp - 0x4c]
push edx
push 0x30200
push 0x803
push 0
call dword [sym.imp.WINMM.dll_mciSendCommandA]
test eax, eax
jne 0x41f1ca
mov dword [ebp - 4], 1
jmp 0x41f1cc
jmp 0x41f198
cmp dword [ebp - 4], 0
je 0x41f25e
mov ax, word [ebp - 0x48]
mov word [0x497ae0], ax
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x10], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], 0
lea edx, [ebp - 0x14]
push edx
push 0x40000
push 0x841
xor eax, eax
mov ax, word [0x497ae0]
push eax
call dword [sym.imp.WINMM.dll_mciSendCommandA]
mov dword [ebp - 0x24], 0x4001
lea ecx, [ebp - 0x2c]
push ecx
push 0x100
push 0x814
xor edx, edx
mov dx, word [0x497ae0]
push edx
call dword [sym.imp.WINMM.dll_mciSendCommandA]
mov eax, dword [ebp - 0x28]
mov dword [0x497a9c], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.0041f2da
jmp 0x41f282
push 0x30
push 0x48c8d8
push 0x48b734
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x50]
mov dword [eax + 0x10], 0
xor eax, eax
jmp 0x41f2d4
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x4b6a68]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
mov ecx, dword [0x497a9c]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
mov edx, dword [0x4b6a60]
push edx
push 0x41efbe
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x497a98], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x41fddc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push dword [ecx + 8]
push 0
push 0x5087fe
sub esp, 0x20
jmp 0x41fdf7
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp al, 3
jae 0x41fe39
add eax, 0x7e2
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0xc]
push 5
lea ecx, [ebp + ecx*8 - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0xc]
cmp al, 2
jne 0x41fe2e
cmp byte [0x5005a0], 1
je 0x41fe39
lea ecx, [ebp + eax*8 - 0x30]
cmp byte [ecx], 0
je 0x41fea8
jmp 0x41fdf4
lea ecx, [ebp - 0x30]
push ecx
call fcn.00465c27
test al, al
jne 0x41fe4d
mov eax, 0x48e0b2
jmp 0x41fead
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
inc byte [edx]
shl eax, 4
add eax, ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xc], 0
jmp 0x41fe6c
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp al, 3
jae 0x41fe8e
lea ecx, [ebp + eax*8 - 0x30]
push ecx
mov ecx, dword [ebp - 0x14]
imul edx, eax, 5
add ecx, edx
add ecx, 2
push ecx
call fcn.0047fc7d
add esp, 8
jmp 0x41fe69
mov ecx, dword [ebp - 8]
movzx eax, word [ecx]
mov ecx, dword [ebp - 0x14]
mov word [ecx], ax
push 2
push ecx
push eax
call fcn.0044cdd4
xor eax, eax
inc eax
jmp 0x41feb7
mov eax, 0x500e1c
push eax
push 0
call fcn.0042f699
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x421897
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov cl, byte [ecx + 1]
call fcn.004061f9
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0x43
je 0x4218c8
cmp byte [ecx], 0x42
je 0x4218c8
push dword [ecx + 0xd]
push dword [ecx + 1]
call fcn.00435829
add esp, 8
jmp 0x4218d2
mov ecx, dword [ebp - 0x14]
push 2
call fcn.00406670
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + 0xd]
call fcn.004061f9
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00403b96
push 8
mov ecx, 0x4b1b18
call fcn.0042c45f
push 1
push 8
mov ecx, 0x4b69b0
call fcn.0047467a
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x254]
and eax, 0xc0
cmp eax, 0xc0
je 0x421948
mov ecx, dword [ebp - 0x18]
call fcn.00403360
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2cb
call fcn.0040659b
mov eax, dword [ebp - 0x10]
push dword [eax + 0x2cc]
push dword [eax + 0x2cb]
mov ecx, 0x4b4250
call fcn.0045503f
call fcn.0041e5db
mov ecx, 0x4b4250
call fcn.0045461c
mov ecx, dword [ebp - 0x14]
call fcn.0043fcc9
mov ecx, dword [ebp - 0x14]
call fcn.00403360
mov edx, dword [eax]
mov dword [ebp - 4], edx
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0044fa1f
add esp, 8
push dword [ebp - 4]
call fcn.0044fa7e
add esp, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
mov eax, 0x3000
call fcn.004015b1
mov dword [ebp - 8], eax
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
movzx eax, byte [ebp - 0x1f]
push eax
mov al, byte [ebp - 0x20]
push eax
call fcn.004036f9
call fcn.0040159c
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + 2], 1
jne 0x421a02
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
call fcn.0041e5f6
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
mov ecx, dword [ebp - 0x10]
push dword [ecx + 1]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0040e9e5
jmp 0x421a25
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 1]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451347
call fcn.0041e5f6
call fcn.0042c4e0
call fcn.0047eb97
mov dword [ebp - 0x14], eax
push 1
push 0x27
mov ecx, 0x4b69b0
call fcn.0047467a
cmp byte [0x505fdc], 0
jne 0x421a64
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx]
call fcn.00484002
push ecx
push 0x48b58c
push 2
call fcn.0042f699
add esp, 0xc
call fcn.0047eb97
sub eax, dword [ebp - 0x14]
mov ecx, 0x14
sub ecx, eax
cmp ecx, 0
jle 0x421a83
push ecx
mov ecx, 0x4b1b18
call fcn.0042c45f
call fcn.0042c4e0
push 0
push dword [ebp - 8]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451913
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x429cae
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
jmp 0x429cb9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x429cd0
push 0
mov edx, dword [ebp - 8]
push dword [edx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x429cb6
leave
ret

Function at 0x429ed8
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [0x4b6a60]
push 0x4132e9
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4cea0c], eax
leave
ret

Function at 0x42c223
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4b6930
call fcn.0042c430
mov dword [ebp - 0xc], 0
push 0
call fcn.0042b81b
add esp, 4
mov ecx, 0x4ac63c
call fcn.004cee12
mov dword [ebp - 8], eax
push 0
call fcn.004759bc
add esp, 4
mov eax, dword [ebp - 8]
cmp eax, 3
je 0x42c29a
mov ecx, 0x4b6a98
call fcn.004848b5
test eax, eax
jne 0x42c295
push 1
mov ecx, 0x4b6a98
call fcn.00475e67
call fcn.00476870
mov ecx, 0x4b0770
call fcn.00418c30
push eax
call fcn.00476715
nop
nop
nop
call fcn.00476882
mov edx, dword [ebp - 8]
cmp edx, 4
ja case.default.0x42c2a6
jmp dword [edx*4 + 0x42c3e4]
call fcn.0040dfba
movzx eax, ax
jmp 0x42c2e8
call fcn.0040be47
jmp 0x42c2e8
call fcn.0040d320
test al, al
je 0x42c2db
mov ecx, 0x4b2b98
call fcn.004332d8
call fcn.0040dfba
movzx eax, ax
jmp 0x42c2e8
mov ecx, 0x4b2b98
call fcn.00433325
nop
nop
nop
mov dword [ebp - 0xc], eax
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7fffffff
div ecx
push edx
call fcn.0047fb05
add esp, 4
mov ecx, 0x4b3d08
call fcn.0044f058
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
ja case.0x42c33d.1
mov eax, dword [ebp - 0x14]
jmp dword [eax*4 + 0x42c3f8]
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
jmp 0x42c388
mov dword [ebp - 4], 1
push 0
mov ecx, 0x4b3d08
call fcn.0040be38
jmp 0x42c388
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
jmp 0x42c388
call fcn.0047b4f7
mov eax, dword [ebp - 0xc]
or al, 8
mov dword [ebp - 0xc], eax
jmp 0x42c388
push 0
call fcn.004759bc
add esp, 4
cmp dword [ebp - 4], 1
jne 0x42c397
mov dword [ebp - 4], 0
jmp 0x42c3a3
mov ecx, 0x492f90
call fcn.00417980
jmp 0x42c3a8
jmp 0x42c301
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov byte [0x4ab020], 0
call fcn.0040bb87
mov ecx, dword [ebp - 0xc]
and ecx, 0x6c
test ecx, ecx
je 0x42c3d8
push 0
mov ecx, 0x4b6a98
call fcn.00475e67
jmp 0x42c3dd
jmp 0x42c229
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x432d9d
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
add ecx, 0x13
jmp 0x432daa
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ax, 0xc8
jae 0x432dc0
imul edx, eax, 3
mov edx, dword [ecx + edx]
cmp byte [ebp + 8], dl
jne 0x432da7
jmp 0x432dc2
mov al, 0xff
mov esp, ebp
pop ebp
ret 4

Function at 0x437250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 7
call fcn.0047cae3
nop
nop
nop
call fcn.0047d340
push 0
push 0xa
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
nop
nop
nop
push dword [0x4b6a68]
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
pop ebp
ret

Function at 0x439fa6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0x10]
cmp al, 0
je 0x439fcd
cmp al, 1
jne 0x439fc3
dec eax
mov dword [ebp - 4], eax
push eax
push 0x5d
push 0x2b
push 0x44
jmp 0x439ff6
mov dword [ebp - 4], eax
sub al, 6
push eax
push 0x5e
jmp 0x439ff2
mov byte [ebp - 4], 6
cmp byte [0x505fcc], 1
je 0x439fe3
sub byte [ebp - 4], 2
jmp 0x439fe3
inc dword [ebp + 0x10]
mov al, byte [ebp - 4]
cmp byte [ebp + 0x10], al
jae 0x43a055
push 0xff
push 0x10
push 0x1a
push 0x48
push 0
push dword [ebp + 0x14]
call fcn.00450b93
push eax
push 1
push dword [ebp + 0x18]
call fcn.00450b93
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00435116
cmp dword [ebp + 8], 0
jne 0x43a055
push 5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x101
push 0
push 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp + 8], 0
jne 0x43a053
push 0
call fcn.00423971
jmp 0x439fe0
call fcn.004768c0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44a3f6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov byte [ecx + 0x18], al
inc eax
mov dword [ecx + 0x14], eax
push 0
push dword [0x4b5fdc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x44f058
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [0x497738]
mov dword [ebp - 4], eax
test eax, eax
je 0x44f077
mov ecx, dword [ebp - 8]
call fcn.0044d0af
jmp 0x44f07f
mov ecx, dword [ebp - 8]
call fcn.0044d2ca
xor ecx, ecx
mov byte [0x4ab020], cl
mov dword [0x497738], ecx
mov ecx, dword [ebp - 8]
call fcn.0044a3f6
mov ecx, dword [ebp - 8]
call fcn.0044a971
mov ecx, dword [ebp - 8]
cmp byte [ecx + 1], 0
jne 0x44f0cd
cmp dword [ebp - 4], 0
jne 0x44f0cd
mov ecx, 0x492f90
call fcn.00406587
test eax, eax
je 0x44f0cd
push 0
mov ecx, 0x492f90
call fcn.004180c1
call fcn.0047eac4
jmp 0x44f0ac
mov ecx, dword [ebp - 8]
call fcn.00449ef0
mov ecx, dword [ebp - 8]
call fcn.0044a36f
mov ecx, dword [ebp - 8]
call fcn.00449eca
mov ecx, dword [ebp - 8]
call fcn.00449ea4
push 1
mov ecx, 0x4b6bc0
call fcn.00476176
mov ecx, 0x4b0770
call fcn.00482938
and eax, 0x8000
test eax, eax
je 0x44f134
mov ecx, dword [ebp - 8]
call fcn.0044a88a
push 8
push dword [0x4b5fd8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x51c], 0
call fcn.0044a6db
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0044eec5
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 1]
mov esp, ebp
pop ebp
ret
Function at 0x45f0e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x4b5fe8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 7
call fcn.0047cae3
nop
nop
nop
call fcn.0047d340
push 0
push 0x1f
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
nop
nop
nop
mov ecx, dword [0x4b6a68]
push ecx
mov edx, dword [0x4b5fe8]
push edx
call dword [sym.imp.USER32.dll_SetParent]
push 0
mov eax, dword [0x4b5fec]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 8
call fcn.0047cae3
nop
nop
nop
call fcn.0047d340
push 0
push 0x1f
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
nop
nop
nop
mov ecx, dword [0x4b6a68]
push ecx
mov edx, dword [0x4b5fec]
push edx
call dword [sym.imp.USER32.dll_SetParent]
push 0
mov eax, dword [0x4b600c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x10
call fcn.0047cae3
nop
nop
nop
call fcn.0047d340
push 0
push 0x1f
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
nop
nop
nop
mov ecx, dword [0x4b6a68]
push ecx
mov edx, dword [0x4b600c]
push edx
call dword [sym.imp.USER32.dll_SetParent]
mov ecx, 0x4b4250
call fcn.00455e6b
add eax, 7
cdq
mov ecx, 0x30
idiv ecx
imul eax, eax, 0x30
add eax, 0x28
push eax
mov ecx, 0x4b4250
call fcn.00455e44
add eax, 0x2f
cdq
mov ecx, 0x30
idiv ecx
imul eax, eax, 0x30
push eax
push 0x28
push 0
call fcn.0047d281
add esp, 0x10
pop ebp
ret

Function at 0x4607ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x460815
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x15
jge 0x460855
cmp dword [ebp - 4], 2
je 0x460836
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x4b5fd0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x460853
push 0
push 0x9cbd
push 0x111
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x4b5fd0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x46080c
push 0
call fcn.0047cae3
nop
nop
nop
mov esp, ebp
pop ebp
ret
Function at 0x462bde
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
call fcn.00480ff0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
imul eax, ecx
push eax
call fcn.00480fe0
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00480ff0
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x462cf0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0047cae3
nop
nop
nop
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
call fcn.0047e239
nop
nop
nop
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.004096f2
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.004098f3
push eax
push 0
push 0x172
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0047cae3
nop
nop
nop
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00481020
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x462cf4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0x173
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x462d6d
push 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x172
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x26
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00432cbc
add eax, 2
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409c0d
add eax, 2
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409c64
mov esp, ebp
pop ebp
ret
Function at 0x462e1a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x14], 0
jle 0x462f39
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
call fcn.00480ff0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
imul ecx, edx
push ecx
call fcn.00480fe0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00480ff0
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x462f39
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x10]
push edx
call fcn.0047cae3
nop
nop
nop
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
push 0
push 0
call fcn.0047e239
nop
nop
nop
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.00427042
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.004098f3
push eax
push 0
push 0x172
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0047cae3
nop
nop
nop
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00481020
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x46305a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x463078
push 5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x463087
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4
Function at 0x4682d6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x58]
mov edx, dword [ebp + 8]
and edx, 0xff
cmp ecx, edx
je 0x468311
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x468311
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
mov dl, byte [ebp + 8]
mov byte [ebp - 8], dl
cmp byte [ebp - 8], 0
je 0x468325
cmp byte [ebp - 8], 1
je 0x468352
jmp 0x46837d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xdc0
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46837d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0xdc0
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
mov byte [eax + 0x58], cl
mov esp, ebp
pop ebp
ret 4

Function at 0x468e59
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push dword [ebp + 0xc]
call fcn.0047fc5a
add esp, 4
mov dword [ebp - 4], eax
push 0x1a0
lea ecx, [ebp - 0x1a4]
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, dword [ebp - 4]
jne 0x468ea0
lea ecx, [ebp - 0x1a4]
push ecx
push dword [ebp + 0xc]
call fcn.0047fcc3
add esp, 8
test eax, eax
je 0x468eae
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x468eaf
inc eax
mov esp, ebp
pop ebp
ret 8
Function at 0x46ee30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0x68
push 0x18
mov al, byte [ebp + 8]
cmp al, 0
je 0x46ee4d
cmp al, 1
jne 0x46ee91
mov ecx, dword [ebp - 0xc]
xchg dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
call fcn.004d0286
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46ee72
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
push 0
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
call fcn.004d0286
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4

Function at 0x46fc40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov dword [ebp - 0x118], ecx
lea ecx, [ebp - 0x110]
call fcn.004032b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x118]
xor ecx, ecx
mov cl, byte [eax + 0x2024]
call fcn.00484002
nop
nop
nop
nop
call fcn.00418c90
mov byte [ebp - 0x114], al
mov edx, dword [ebp - 0x114]
and edx, 0xff
cmp edx, 0xff
jne 0x46fcb3
mov byte [ebp - 0x114], 0x10
mov eax, str.HITAREA.E5
lea ecx, [ebp - 0x110]
call fcn.004165b8
mov eax, dword [ebp - 0x118]
add eax, 0x24
push eax
mov ecx, dword [ebp - 0x114]
and ecx, 0xff
push ecx
lea ecx, [ebp - 0x110]
call fcn.0041fc89
lea ecx, [ebp - 0x110]
call fcn.004192c5
push 0
mov edx, dword [0x4b5ff8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xb
call fcn.0047cae3
nop
nop
nop
push 7
call fcn.0047d1ca
add esp, 4
push 0
push 0
push 0
call fcn.0047d1f1
add esp, 0xc
mov eax, dword [ebp - 0x118]
add eax, 0x24
push eax
mov ecx, dword [0x48689c]
push ecx
mov edx, dword [0x486898]
push edx
push 0
push 0
call fcn.0047e09b
nop
nop
nop
push 0
call fcn.0047cae3
nop
nop
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.004192c5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret