joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fd619
Capabilities:
Encode data using base64

Disassembly:
push edi
push 0xbe7000e
pop edi
or edi, 0xdccba5e3
sub edi, 0x7aea90f9
add edi, 0x9b59a75d
jmp 0x62a506
mov dword [esp], esi
pop esi
push ecx
xchg ecx, eax
jmp 0x6195fa
jmp 0x5fb669
jmp loc.005e3b65

Function at 0x5fe1c3
Capabilities:
Encode data using base64

Disassembly:
push ebp
jmp 0x62a9ea
jmp loc.005e3d91

Function at 0x60031e
Capabilities:
Encode data using base64

Disassembly:
xchg dword [esp], esi
pop esi
pop ebp
mov eax, dword [0x5e6258]
or eax, eax
jmp loc.005ecfa9

Function at 0x602192
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edi
pop edi
mov eax, dword [ebp - 0x14]
jmp 0x615ae3
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 4]
xor edx, edx
push edx
jmp loc.005e3de3
jmp 0x609bf5

Function at 0x60260e
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x60e8b4
jmp 0x622f86
jne 0x61f0a1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
push 0xe31509ed
pop edx
rol edx, 0xf
or edx, 0xdfc721fb
jmp 0x5f47c1
xor edx, 0xd6c84969
add edx, eax
add edx, 0xf6c0478e
mov dword [edx], 0x1000
jmp 0x5f0760
call fcn.005f013c
jmp 0x60765b
and ecx, 0xf3936bfa
xor edi, 0x209fd875
jmp 0x5f1ae6
js 0x5f47da
jmp 0x61a135
jmp 0x5ffe7b
jne 0x62b22e
mov eax, 0xdd29de3
push edx
push 0x9760d306
pop edx
add edx, 0x68ff7ef3
push 0x5f4f0c
jmp 0x61157b
ret
jmp 0x62268d
mov eax, 0x605384
call fcn.005fea0f
test al, al
je 0x622f86
jmp 0x62e029
jmp 0x624b54
ret
ret
jmp 0x60ef74
call fcn.0062d19c
jp 0x5e9ae9
jmp fcn.005fdfcb
jne 0x5f1aec
jmp 0x604700

Function at 0x606455
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
xchg dword [esp], esi
mov esi, dword [esp]
push 0x6fb9c07a
pop esi
xor esi, 0x6f98a331
rol esi, 0xf
add esi, 0x4ebbb13d
xchg dword [esp], esi
jmp 0x6176ec
jmp fcn.005fe1c3

Function at 0x60d84a
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edi
pop edi
jne 0x60b1ec
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 4]
xor edx, edx
jmp loc.005e7609

Function at 0x60dfef
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 3
jae 0x619ea5
mov eax, dword [ebp + 8]
cmp dword [eax - 0x14], 4
jne 0x610156
jmp loc.005e4edb
mov dword [esp], ecx
pop ecx
mov eax, dword [eax - 0x10]
and eax, 7
jmp 0x5f08fd

Function at 0x60f78a
Capabilities:
Encode data using xor

Disassembly:
jmp loc.005de83f
xchg dword [esp], ecx
pop ecx
push ecx
push ebx
cmp ebx, 0xb6172c53
not ecx
jmp 0x6052d9

Function at 0x610bb5
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
jmp loc.005de395
push ebx
push 0x679c2754
jmp 0x5f150e
pop edi
mov eax, dword [0x609e28]
or eax, eax
jne 0x6154fd
jmp 0x60c8c0
je 0x5f9283
jmp loc.005e689e
mov dword [esp], ebp
mov ebp, esp
push ecx
mov esp, ebp
xchg dword [esp], edi
mov ebp, edi
jmp 0x606daa
rol eax, 0xf
push ecx
mov dword [esp], eax
jmp 0x62ab17
ret
Function at 0x611e5e
Capabilities:
Encode data using base64

Disassembly:
jmp 0x628a8e
push ebp
mov ebp, esp
push ebx
jmp 0x62c5b6
jns 0x5f18e5
push ebp
mov ebp, esp
push ecx
mov esp, ebp
jmp 0x5f00cf
mov ebp, 0x61d194
call fcn.005e8372
jmp loc.005ebddd
jmp loc.005e5b24

Function at 0x612d19
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, ebp
xchg dword [esp], esi
mov ebp, esp
push ecx
mov esp, ebp
jmp loc.005ecd13

Function at 0x61e747
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], eax
pop eax
pop edx
setne dh
add esi, edx
jmp loc.005e5a94

Function at 0x624765
Capabilities:
Encode data using base64

Disassembly:
jmp 0x620146
push 0x5fc387
jmp 0x5de5f5
jne 0x607fdf
mov eax, dword [ebp + 8]
jmp 0x619f47
cmp dword [ebp - 0x10], 0
jmp 0x5fb870
cmp dword [ebp - 0x10], 1
jne 0x618336
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
or eax, 8
or eax, 0x10
jmp 0x61832b
jmp 0x61014d
or dword [eax - 8], 8
jmp 0x6231c5
je 0x5fc398
cmp dword [ebp - 0x10], 0
jne 0x62ab3b
mov eax, dword [ebp + 8]
push eax
jmp 0x5f23a6
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
jmp 0x5fc3c4
cmp dword [ebp - 0x10], 2
jne 0x6231c5
mov eax, dword [ebp + 8]
jmp 0x60f328
jne 0x62ab3b
mov eax, dword [ebp + 8]
push 0x601cb1
jmp 0x62ade1
or eax, 8
or eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx - 8], eax
jmp 0x619ea5
cmp dword [ebp - 0x10], 2
jne 0x619ea5
mov eax, dword [ebp + 8]
jmp 0x5f0d7f
or dword [eax - 8], 8
jmp 0x619ea5
mov dword [esp], edx
pop edx
cmp dword [eax - 4], 4
jne 0x610156
cmp dword [ebp - 0x10], 0
jmp 0x5f3663
jmp 0x61d682
cmp dword [ebp - 0x10], 1
jne 0x61d693
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
jmp 0x62a7e4
ret
Function at 0x6285c5
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [ebp - 0x108]
call fcn.005e9884
jmp fcn.005fc458
call fcn.005fb903
test eax, 0xe9c73cea
xor byte [esi], 0
add byte [edi + 0x458b2404], al
cld
push eax
call fcn.00611e5e
mov eax, dword [ebp - 4]
jmp 0x609213
xor edx, 0x76d75117
adc edi, 0x76a63a10
cmp ebx, edx
jmp 0x5fd9e7
jl 0x61cd41
xchg dword [edx], esi
jmp 0x5e8620
mov byte [ebp + eax - 0x100], dl
inc dword [ebp - 0x108]
inc dword [ebp - 0x104]
jmp 0x62ecf4
push 0
call fcn.0062d054
call fcn.006044ad
call fcn.0060fda5
adc al, 0xda
bound eax, qword [ebx - 0x18]
pop edi
ja 0x601124
add byte [eax - 0x1c887eef], al
add eax, 0xffe831d0
and byte [eax], al
add cl, ch
mov al, byte [0xe90001c2]
jmp 0x607c55
jmp 0x62077c
xchg dword [esp], eax
adc dword [ecx - 0x2ffa1c89], eax
xor eax, ebp
jmp dword [eax]
or eax, 0x100
xchg dword [esp], eax
popfd
nop
jmp 0x61a4bb
add eax, 0x28
push esi
push 0x329ab1c7
xchg dword [esp], edi
jmp 0x624b02
jmp 0x626fba
jne 0x61a46a
jmp 0x624691
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x61c0f5
jmp fcn.0061d9f9
jmp 0x5fe5e8
mov eax, dword [ebp - 0x104]
cmp byte [eax], 0
jne 0x61a46a
jmp 0x61e039
jmp 0x616b49
jmp 0x5f3d41
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x104]
mov dl, byte [edx]
jmp 0x614249
jmp 0x5f2a10
jmp loc.005de5fb
je 0x62b83e
jmp loc.005dea51
je 0x5e8620
jmp 0x618f67
jmp 0x627c8a
je 0x606099
push esi
push 0x976c3f71
pop esi
xor esi, 0x869c95ab
jmp loc.005e0f69
mov esi, edi
pop edi
and esi, 0x578da6e4
xor esi, 0xfe1ddf39
add esi, ebp
add esi, 0x136a7fff
mov dword [esi], eax
pop esi
jmp 0x611e4d
mov dword [esp], eax
pop eax
mov dword [ebp - 0xfc], 0x6f6c2074
mov dword [ebp - 0xf8], 0x206461
mov dword [ebp - 0x108], 0xb
jns 0x62d064
jmp 0x61761a
push 0x4fd98d2a
pop eax
xor eax, 0x28cff8d9
add eax, ebp
add eax, 0x98e98905
mov eax, dword [eax]
mov byte [ebp + eax - 0x100], 0
push 0x2010
jmp 0x601109
mov eax, dword [ebp - 0x104]
cmp byte [eax], 0
jmp 0x6102a8
jmp 0x6285e7

Function at 0x720a2f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x721f83
push dword fs:[0]
mov dword fs:[0], esp
jmp 0x7252eb
pushfd
jmp 0x724f76
jb 0x72325b
pushfd
test ecx, ebp
jmp 0x724f88
xchg dword [esp], eax
or eax, 0x100
call fcn.00724c82
add byte [edi], cl
lea edx, [esi + 0xe]
add cl, ch
outsd dx, dword [esi]
stc
invalid
pop dword fs:[0]
xchg dword [esp], eax
pop eax
mov dword [ebp - 0x18], 0x74726956
mov dword [ebp - 0x14], 0x516c6175
mov dword [ebp - 0x10], 0x79726575
jmp 0x720ff3
jmp 0x72116c
jmp 0x7251e4
jmp 0x722242
jnp 0x721aff
popfd
push 0xc2105706
jmp 0x722917
xchg dword [esp], eax
or eax, 0x100
xchg dword [esp], eax
popfd
nop
jmp 0x71ff92
pushfd
jmp 0x724345

Function at 0x724258
Capabilities:
Check for trap flag exception

Disassembly:
pushfd
xchg dword [esp], eax
or eax, 0x100
xchg dword [esp], eax
popfd
nop
jmp 0x71fa65
xchg dword [esp], esi
pop esi
mov dword fs:[0], esp
jmp 0x7224c7
Function at 0x72593c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], 0x276e6143
mov dword [ebp - 0xfc], 0x6f6c2074
mov dword [ebp - 0xf8], 0x206461
mov dword [ebp - 0x108], 0xb
mov eax, dword [ebp - 0x104]
cmp byte [eax], 0
jne 0x7259b4
mov eax, dword [ebp - 0x108]
mov byte [ebp + eax - 0x100], 0
push 0x2010
push 0
lea eax, [ebp - 0x100]
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x104]
mov dl, byte [edx]
mov byte [ebp + eax - 0x100], dl
inc dword [ebp - 0x108]
inc dword [ebp - 0x104]
jmp 0x725973
Function at 0x409310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x426648
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.004097b0
add esp, 8
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
je 0x409416
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ebx, [ebp - 0x24]
mov byte [ebp - 4], 2
jmp loc.0047498a
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40945c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c699
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x44c6a9
push 0xd
pop eax
jmp 0x44c6db
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44c6b2
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [esp + 0x20]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
ret 0xc

Function at 0x44c6df
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x44c6ef
push 0xd
pop eax
jmp 0x44c734
push esi
push edi
xor eax, eax
mov edi, edx
mov dword [esp + 0x14], eax
mov esi, eax
push ebp
mov ecx, edi
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x18]
jne 0x44c701
sub ecx, ebp
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x44c6fc
pop ebp
push esi
push edx
push 7
xor eax, eax
push eax
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x44c738
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x72af34]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.0044c60e
mov esi, eax
test esi, esi
je 0x44c79e
cmp dword [esp + 0xc], ebx
je 0x44c797
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x44c82d
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44c7e2
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0044c738
mov esi, eax
test esi, esi
jne 0x44c844
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x44c7b9
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x44c80c
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.0044c4bc
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x44c82b
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005efadc
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x44c78b
Function at 0x44cbb2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x63a065
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x72af34]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
xor ebx, ebx
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x44cc4d
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x44cc4d
call fcn.0044c18e
mov esi, eax
jmp 0x44cd24
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x44cc6a
call fcn.0044c18e
jmp 0x44cd17
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44cc60
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x18], esi
lea ecx, [esi + 1]
cmp ecx, esi
jae 0x44cc97
mov esi, 0x8007000e
jmp 0x44cd19
push 2
mov byte [ebp - 4], 2
pop edx
lfence
call fcn.00451588
cmp eax, 0x400
jbe 0x44ccbb
push eax
lea ecx, [ebp]
lfence
call fcn.00450f8b
jmp 0x44ccd1
lea eax, [ebp + 4]
mov dword [ebp], eax
jmp 0x44ccd1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp dword [ebp], 0
je 0x44cc8d
push esi
lfence
push dword [ebp]
push esi
push eax
push ebx
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x44cc60
mov eax, dword [ebp]
xor edx, edx
push dword [ebp + 0x41c]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x24]
push dword [ebp]
call fcn.0044d734
mov esi, eax
test edi, edi
je 0x44cd24
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x44cd34
lea ecx, [ebp]
call fcn.00450d0e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.005efadc
add ebp, 0x408
leave
ret 0x10
Function at 0x4545c8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x72af34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x98]
sub eax, 1
je 0x454621
sub eax, 1
je 0x454615
sub eax, 1
jne 0x4546d3
mov dword [esi + 0xbc], 1
push 0
push 0
push 0x404
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4546d3
mov dword [esi + 0xbc], 2
jmp 0x4545fe
mov eax, dword [esi + 0x90]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x454645
mov eax, dword [esi + 0x90]
push 1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 0x90]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
sub eax, dword [esi + 0x100]
mov edx, dword [esi + 0xfc]
add edx, dword [ebp - 0x24]
push eax
call fcn.0045289d
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
pop ecx
push 8
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov eax, dword [esi + 0x90]
push dword [ebp - 0x14]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x90]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x90]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005efadc
leave
ret 0x10

Function at 0x454b67
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x98]
sub eax, 1
je 0x454b8c
sub eax, 1
je 0x454b84
sub eax, 1
jne 0x454b9a
mov eax, dword [ecx + 0x88]
jmp 0x454b8f
mov eax, dword [ecx + 0x80]
jmp 0x454b8f
mov eax, dword [ecx + 0x78]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x454b9b
Capabilities:
Hide graphical window

Disassembly:
push 0xec
mov eax, 0x63ac44
call fcn.00637dc6
mov ebx, ecx
push 3
pop ecx
call fcn.0048816a
test al, al
je 0x454c4f
push ecx
lea ecx, [ebp - 0xf8]
call fcn.0044fd8b
and dword [ebp - 4], 0
lea ecx, [ebp - 0xf8]
mov edx, str.Showing_Finished_Window...
call fcn.004510c8
lea eax, [ebp - 0x58]
mov ecx, 0x6cce38
push eax
call fcn.0045582e
mov edi, eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x6ccec4
call fcn.004558aa
mov esi, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xf4]
call fcn.00450ae4
push edi
push esi
push 0x23f
push 3
pop edx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00488132
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00450c1e
lea ecx, [ebp - 0x40]
call fcn.00450c1e
lea ecx, [ebp - 0x58]
call fcn.00450c1e
lea ecx, [ebp - 0xf8]
call fcn.0044ecc6
mov eax, dword [ebx + 0xc0]
mov byte [eax + 0x44], 0
mov ecx, dword [ebx + 0xc0]
call fcn.0045202f
mov ecx, ebx
call fcn.00454b67
push ecx
push ecx
push 0
push ecx
mov ecx, ebx
call fcn.004552af
mov eax, dword [ebx + 0x80]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x80]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebx + 0x98], 2
call fcn.00637d75
ret

Function at 0x4555cb
Capabilities:
Hide graphical window

Disassembly:
push 0x34
mov eax, 0x63aec7
call fcn.00637dc6
mov ebx, ecx
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x455638
add eax, 0x10
lea ecx, [ebp - 0x40]
push eax
call fcn.0045e07b
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x40]
mov eax, dword [edi]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__private:_void___thiscall_webinstaller::MainWindow::prepareDestroy_void_::_5::_lambda_1___void__bool_.0
mov dword [ebp - 0x34], ebx
mov esi, dword [eax + 0x18]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x14], eax
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call dword [0x6636e0]
mov ecx, edi
call esi
lea ecx, [ebp - 0x38]
call fcn.004565a5
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x455638
call fcn.0044e480
call fcn.00637d75
ret
Function at 0x458aed
Capabilities:
Hide graphical window

Disassembly:
push 0x64
mov eax, 0x63b1f9
call fcn.00637dc6
mov edi, ecx
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [edi + 0x58]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x68]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x60]
call fcn.004682a8
mov eax, dword [edi + 0x60]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [edi + 0x50]
call fcn.0046cead
push str.ConvergedInstallingText
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.00450700
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
mov ecx, esi
push eax
call fcn.0046e48e
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x458b7f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004505f4
sub esp, 0xc
mov byte [ebp - 4], 2
mov eax, esp
xor esi, esi
mov ecx, ebx
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00460f48
lea ecx, [ebp - 0x3c]
call fcn.00450bf0
lea ecx, [ebp - 0x6c]
call fcn.00450bf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00450c1e
push 2
mov ecx, edi
call fcn.00458dd9
push 0x6c7528
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [edi + 0x50]
push esi
push 0xfffffffffffffffc
push dword [eax + 4]
push 0x8019
call dword [sym.imp.USER32.dll_NotifyWinEvent]
mov ecx, dword [edi + 0x70]
mov eax, dword [edi + 0x50]
push 0x40
push dword [ecx + 0x60]
mov eax, dword [eax + 0x74]
push dword [ecx + 0x5c]
add eax, dword [edi + 0x104]
add eax, dword [edi + 0xec]
push eax
push dword [ecx + 0x54]
push esi
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00637d75
ret
Function at 0x458c1e
Capabilities:
Hide graphical window

Disassembly:
push 0x64
mov eax, 0x63b1f9
call fcn.00637dc6
mov edi, ecx
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [edi + 0x58]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x60]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x68]
call fcn.004682a8
mov eax, dword [edi + 0x68]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [edi + 0x50]
call fcn.0046cead
push str.ConvergedSuccessText
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.00450700
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
mov ecx, esi
push eax
call fcn.0046e48e
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x458cb0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004505f4
sub esp, 0xc
mov byte [ebp - 4], 2
mov eax, esp
xor esi, esi
mov ecx, ebx
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00460f48
lea ecx, [ebp - 0x3c]
call fcn.00450bf0
lea ecx, [ebp - 0x6c]
call fcn.00450bf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00450c1e
push 3
mov ecx, edi
call fcn.00458dd9
mov eax, dword [edi + 0x50]
push esi
push 0xfffffffffffffffc
push dword [eax + 4]
push 0x8019
call dword [sym.imp.USER32.dll_NotifyWinEvent]
mov ecx, dword [edi + 0x70]
mov eax, dword [edi + 0x50]
push 0x40
push dword [ecx + 0x60]
mov eax, dword [eax + 0x74]
push dword [ecx + 0x5c]
add eax, dword [edi + 0x104]
add eax, dword [edi + 0xec]
push eax
push dword [ecx + 0x54]
push esi
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00637d75
ret