joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb042e1
Capabilities:
Authenticate hmac

Disassembly:
xor cl, bl
mov eax, dword [esp + 4]
inc eax
sub cl, 0x92
neg al
not cl
mov dword [esp], eax
add cl, 0x3f
inc al
push eax
jg 0xdc8c4e
lea ecx, [esp + ecx + 0xc]
lea eax, [eax + eax*8 - 0x356f0b65]
mov ax, word [ecx]
shr word [esp + 9], 0xb
sbb ebp, 2
push 0xa4808c8c
not dword [esp + 0xb]
push 0x85869214
mov word [ebp], ax
push 0xb0b0d92f
jmp 0xd4031e
lea esp, [esp + 0x18]
jmp fcn.00de95b6
xor cl, 0xbf
neg al
dec cl
xchg dword [esp + 8], eax
neg byte [esp + 7]
lea eax, [eax + eax*4 - 0x53c7c9cf]
rol cl, 1
xor bl, cl
shr eax, 0x86
jne 0xce24bb
xor eax, 0x7abc529c
sbb bl, ah
jbe 0xdc8c7a
invalid

Function at 0xcc506a
Capabilities:
Encode data using xor

Disassembly:
call fcn.00d9ad56
call fcn.00cf5a88
push ebp
mov dword [esp + 4], 0x761d89f6
lea esp, [esp + 4]
call fcn.00d72737
mov edx, 0x9595ff8b
jmp 0xd7deb8
add ebp, 4
xor ecx, ecx
sub dword [esp + 2], 0x522cd51b
test edx, edx
push 0x4f9a66aa
lea esp, [esp + 0xc]
je 0xce7b17
mov eax, 0x102cbf24
movzx eax, byte [esi + eax*2 - 0x20597e48]
xor eax, ecx
push 0x37b202b3
and eax, 0xff
mov eax, dword [eax*4 + 0x9aa29c]
shr ecx, 8
xor ecx, eax
inc esi
xor ecx, 0x589c38a7
dec edx
lea esp, [esp + 4]
jne 0xce7ae0
push 0xbb25b094
call fcn.00cff1e2
mov esi, dword [ebp]
mov edx, dword [ebp + 4]
push 0x5c190a95
push 0x20348e2c
jmp 0xce7abf

Function at 0xccb08b
Capabilities:
Encode data using base64

Disassembly:
add esi, 6
mov byte es:[edx], al
push 0x11efd2c
lea esp, [esp + 8]
jmp fcn.00d5264f
add ebp, 1
or dword [esp + 4], 0x649e9536
xor dl, bl
mov dword [esp], 0xe9877db4
xor dl, 0xae
push 0xc831a1a8
sub dl, 0
not dl
rol dl, 1
call fcn.00cdda6f
mov ecx, 0x5c93478d
movzx ecx, byte [ecx + esi - 0x5c93478d]
push 0x519b413e
add esi, 1
xor cl, bl
jmp 0xd28069
push 0xc207ccbf
jge 0x8a3ad2
jmp fcn.00ce2091
popal
xchg edx, eax
int3
push esi
pop esi
rcl byte [ecx], 0x78
or al, 0xe2
jmp 0xd28048
adc dword [eax + 0xc], edi
loop 0xd27ffd
xor eax, 0x626101aa
std
jecxz 0xd28019
inc dword [eax + 0x22bbff2d]
mov word [edx - 0x6d6a181d], ss
sub byte [0x8c22bbff], 0x92
xchg edx, eax
jecxz 0xd2800a
xchg ebp, eax
xchg edx, eax
cmp ebp, ebx
invalid
js 0xd2800d
daa
sub byte [ecx], 0xa2
imul esi, dword [ebx - 0x59], 0x9a30ba9e
sbb dh, byte [ecx]
movsx eax, dx
neg eax
mov edx, dword [esi + edx - 0x311a9a30]
jnp 0xddd30c
not cl
add cl, 0x1e
not dword [esp]
xor cl, 9
add cl, 0x34
not cl
push 0xa8156db7
xor bl, cl
shr word [esp + 1], 0x6b
sub ebp, 2
call fcn.00afab16
cmpsb byte [esi], byte es:[edi]
pushfd
push ds
xchg byte [edi], dl
push dword [ebp - 0x442e6f36]
jae 0xd28020
retf 0xb740
mov al, byte [esi + eax*2 - 0xcb9c]
jbe 0xcdfcbf
jmp 0xcf8eed

Function at 0xccb511
Capabilities:
Encode data using base64

Disassembly:
dec ecx
add ebx, 8
dec eax
mov dword [esp], 0xf2959605
dec eax
mov dword [esp], ebx
jmp 0xd9946b

Function at 0xd048c5
Capabilities:
Encode data using base64

Disassembly:
call 0xd405f4
inc ecx
mov esp, 0x4821a700
dec ecx
xor esp, 0xf09b389a
call 0xd1bf14
Function at 0xd05fdc
Capabilities:
Encode data using base64

Disassembly:
pushfd
add dword [esp + edi + 0x505448e5], 0xff2732cb
lea edi, [edi*2 + 0x693888b4]
mov dword [esp + 0xc], 0xba378e17
mov edi, dword [esp + edi*2 + 0x6ee01224]
popfd
call fcn.00d7a41f
mov ecx, 0x3023212e
inc cx
call fcn.00ce122e

Function at 0xd0608d
Capabilities:
Get number of processors

Disassembly:
adc eax, edx
mov dword [ebp - 4], eax
call fcn.00b070f6

Function at 0xd1196a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
xchg bp, bp
btc ebp, 0x16
mov ebp, esp
btc edx, ecx
mov edx, dword [ebp + 8]
sub esp, 0x114
test bp, dx
push esi
test edx, edx
jmp 0xd5c719

Function at 0xd2632a
Capabilities:
Encode data using xor

Disassembly:
inc edi
movzx ecx, word [esi + ecx - 0x4c9045bf]
dec ecx
add esi, 2
add byte [eax], al
inc bp
xor ecx, edx
inc cx
ror ecx, 1
inc cx
dec ecx
inc cx
neg ecx
push 0x86186b89
inc cx
dec ecx
inc cx
xor ecx, 0x64e92f37
or byte [eax + eax], cl
stosb byte es:[edi], al
add byte [edi + 0x48], 0x38
cmp byte es:[ecx], al
stc
push edx
jl 0xd26338
invalid

Function at 0xd29572
Capabilities:
Encode data using base64

Disassembly:
rep stosd dword es:[edi], eax
jmp 0xcdfc97
mov dword [ebp - 0x24], edi
jmp 0xd7728a
je 0xaf9bc5
mov ecx, eax
movsx eax, si
mov eax, 0x400
bts edi, eax
mov edi, edx
and edx, 0x92040685
movzx edx, ax
mov eax, edx
test ecx, 0xba8e8e17
shl edx, 0x10
cmp ecx, 0x4c085e1b
cmp ch, bh
or eax, edx
stc
cmp di, dx
cmp esi, 0xac02348b
shr ecx, 1
jmp 0x996cbf
adc ecx, ecx
mov dword [ebp - 0x28], edi
jmp 0xcbad84
dec ecx
mov esi, dword [ebx]
inc ecx
mov edi, 0xac8deabc
call fcn.00d6aead
xor ebx, ebx
cmp di, 0xd39b
mov dword [ebp - 0x20], edx
cmc
stc
sub esi, edi
cmc
test ebp, ebp
mov dword [ebp - 0x44], esi
rcr esi, 0x1d
movzx esi, bx
adc esi, esi
mov esi, edi
test dh, 0x8c
clc
test esi, eax
shl esi, cl
cmc
setg cl
mov ecx, dword [ebp + 0xc]
test cx, dx
test bl, 0x1e
stc
mov dword [ebp - 0x18], ebx
cmp esp, 0x6cbae1a6
clc
mov byte [ebp - 1], bl
test eax, edi
sub esi, edi
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
cmp si, bp
mov dword [ecx], ebx
add cx, 0xb437
btr cx, 0x32
mov ecx, dword [ebp + 0x14]
cmc
mov dword [ecx], ebx
btr ecx, 0x34
mov ecx, dword [eax + 4]
lea ecx, [ecx + esi]
sar ah, 0x33
sbb ax, bp
bt eax, 0x33
mov eax, 0x300
test si, si
test dh, 0xa
shl eax, cl
mov dword [ebp - 0x3c], esi
test eax, edi
mov dword [ebp - 0x14], ebx
cmc
test bp, bx
mov dword [ebp - 0x10], edi
jmp 0xd75608
add eax, 0x736
jmp 0xd28a1d
mov dword [ebp - 0x2c], edi
jmp 0xcd3a72

Function at 0xd5c700
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xb0b81f
mov eax, 0x5a4d
test cx, 0xba2f
clc
jmp 0xd7f723
je 0xdb4902
cmp dword [eax], 0x4550
jmp 0xd549b3
add esi, 6
shld edi, edx, cl
mov dword [esp], 0x979386a4
call fcn.00df003d
test byte [edx], dl
add byte [eax], al
je 0xb0b81f
mov esi, dword [ebp + 0xc]
cmp esp, ebx
stc
test esi, esi
jmp 0x9a03db
cmp word [edx], ax
jmp 0xb0b819
mov eax, dword [edx + 0x3c]
jmp 0xdf4a55
lea eax, [eax + edx]
jmp 0xcfce06
Function at 0xd8fb40
Capabilities:
Encode data using base64

Disassembly:
pop ecx
movsx eax, dx
mov ebp, edx
pop edx
lea ebp, [ebp*2 + 0x563d6db3]
call fcn.00cbcf45
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0xeecbf9d5
mov ebx, dword [esp + 8]
add dword [esp], 0xff2a8518
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.00cb9b4a
mov edx, 0x9a3c1fbc
lea ecx, [edx + edx*4 - 0x2a4c47dd]
shl cl, 0xc4
mov esp, esi
popfd
jmp 0xd7205b

Function at 0xdb25a8
Capabilities:
Execute syscall

Disassembly:
add esi, 2
mov dword [esp], 0xa3fb897
imul dl
call fcn.00d89c85
sysenter
push edi
mov edi, 0x6419d02e
mov edi, dword [esp + edi - 0x6419d02e]
mov dword [esp], 0xd3c4fbe9
call fcn.00de8254
mov eax, 0x7951a0
sbb ch, ah
frstor dword [ecx + 0x6c1335d9]
pop es
in al, dx
ret

Function at 0xdb6ac6
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x10]
jmp dword [edx*4 + 0xda7040]

Function at 0xdb7913
Capabilities:
Encode data using base64

Disassembly:
mov word [ebp], si
lea esp, [esp + 8]
jmp fcn.00d9dd0d
shl si, 6
shr esi, 0xb
dec cl
xor cl, 0xb7
pop esi
neg cl
mov esi, dword [esp]
dec esi
shr esi, 0x7e
xor bl, cl
ror si, 0xae
jae 0xdd6c3e
sbb ebp, 2
jmp 0xda75c0
lea ecx, [esp + ecx + 4]
add si, word [esp + esi*8 + 2]
push esi
mov si, word [ecx + esi*2 - 0x100]
jns 0xdd210e

Function at 0xdc5cdf
Capabilities:
Encode data using base64

Disassembly:
jmp 0xd914c7
movzx ebx, byte [eax]
call fcn.0099ff52
lea esp, [esp + 0x1c]
jne 0x9a527a
mov ebx, 0x2906d62a
pop ebx
not esi
push 0xfd188f9e
call fcn.00db7f96
xor dword [esi + 0x509ee143], edx
add eax, dword [edx + 0x57]
stc
sbb dh, dl
jge 0xdc5d2e
lea esi, [ebp + 0x540bc32a]
inc ebx
scasb al, byte es:[edi]
cmp dword [edi - 0x7e915fa7], esp
adc ebx, dword [edx + esi*2]
fld dword [edx + 0x7d]
add eax, dword [0x87238a9a]
push cs
outsb dx, byte [esi]
mov byte [0xbbff23a3], al
pop ds
inc edi
mov byte [0xb4c730fc], al
mov ebp, 0x4e19c52a
jmp dword [eax - 0x2c]
cld
xor bh, al
mov ah, 0xbd
sub al, ch
sbb dword [esi - 1], ecx
pushal
aam 0x10
jo 0xdc5d01
mov edx, 0x490fb4d
aaa
and al, 0x42
sahf
sahf
invalid
Function at 0xdd7ecc
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [ebp + 8]
btc ax, 0xa5
lea eax, [ecx - 1]
mov dword [ebp - 0x40], eax
stc
cmp sp, 0xe536
xor esi, esi
clc
test eax, edi
or eax, 0xffffffff
xor edi, edi
test si, bx
cmc
cmp ecx, dword [ebp - 0x40]
jmp 0xd19e36
push edx
std
loop 0xcdfc99
fstp qword [edx]
push ss
add esi, dword [edx]
invalid
std
jbe 0xcdfc53
sub dword [eax + edi*8 + 0x288e8843], ecx
retf
jmp 0xdf0a33
invalid
call fcn.00ce2398
leave
add byte es:[eax], al
cmc
clc
and dword [edi - 0x34523b0e], 0x46
std
pop edi
je 0xcdfd20
adc byte [ebx], bh
jbe 0xcdfce6
and dword [edx + ebx + 0x5f], ecx
cmpsd dword [esi], dword es:[edi]
test byte [edx], dh
fiadd word [esi + 0x3b]
inc ebx
mov dh, 0x27
push eax
inc esi
push dword [esi + 0x1f]
jo 0xcdfd50
and eax, 0xf46898b3
jns 0xcdfc83
insd dword es:[edi], dx
add al, 0xd1
ja 0xcdfd0e
insb byte es:[edi], dx
xchg ebp, eax
loope 0xcdfcef
sbb bl, byte [ecx]
dec bp
jl 0xcdfca9
mov byte [0xd7342b68], al
sbb dl, bh
loope 0xcdfd32
jb 0xcdfccb
clc
mov esi, 0x1901c292
call fcn.00db0984
pushal
or al, 0xd
add byte [esi], dh
movzx dx, byte ss:[edi]
add esi, 2
jmp 0xd29c73
add al, 0
push 0x9b34ccb0
cpuid
push 0xa9ad0427
sub esi, 0xc
mov dword [esi + 0xc], eax
push 0x12835fbd
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
mov dword [esi], edx
or byte [ecx + 0x1689044e], cl
mov ebx, dword [esp + 0xc]
lea esp, [esp + 0x10]
jmp fcn.008aa2a5
je 0xcd32cc
movzx edx, byte [ecx]
shl esi, 8
inc edi
or esi, edx
jmp 0xd651f7
mov dword [esp], 0xd03e6b10
mov word [esi], dx
call fcn.00d82706
and dword [edi - 0x3af680b7], eax
wait
jmp 0xa9c5e1bd
jl 0xaf9be7
mov dword [ebp - 8], ecx
cmp cx, si
lea esp, [esp]
xchg cx, cx
cmc
inc ecx
test ax, 0x673e
cmp edi, 5
jmp 0xd4eb58
jmp 0xcdfcca
rep stosw word es:[edi], ax
jmp 0xaf9bc5

Function at 0xde8254
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push esi
movzx esi, ax
call fcn.00cc0b1c
push eax
mov eax, 0x727cfb2
jmp 0xcc4a7f
Function at 0x40b1cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
sub esp, 0xd4
push dword [ebp + 0xc]
lea ecx, [ebp - 0xdc]
push ecx
call fcn.0040bf56
add esp, 8
lea edx, [ebp - 0xdc]
push edx
push 0x42e
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x492e28
push 0x3f9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp - 8]
push 0x3f8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 8]
call fcn.004375e9
push 0x5ab
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.0040c45a
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40b271
cmp byte [ebp + 0x10], 0xff
je 0x40b271
push 5
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0x10]
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x40b28f
push 0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x492e2c
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0x10], 0
jne 0x40b2c3
push 0x565
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5ad
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
call fcn.0040b3d6
push dword [eax*4 + 0x48bc04]
push 0x3ff
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0x12], 0xff
jne 0x40b2fe
push 0x48b284
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x40b317
mov ecx, dword [ebp - 8]
call fcn.0040e070
push 0
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.00461fc8
lea edx, [ebp - 0x70]
push edx
push 0x401
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.0044282d
lea edx, [ebp - 0x70]
push edx
push 0x5af
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
call fcn.0041ddf0
mov dword [ebp - 0xc], eax
jmp 0x40b36b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0x50
jae 0x40b3d0
push dword [ebp - 4]
call fcn.0040687c
add esp, 4
cmp al, 0xff
je 0x40b3ce
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + 0x11]
cmp al, 0x1a
jae 0x40b39f
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b781
call fcn.00466bb9
jmp 0x40b3b4
cmp al, 0x47
jb 0x40b3a7
cmp al, 0x59
jb 0x40b3ce
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0045bc13
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x5c0
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40b368
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41fddc
Capabilities:
Get graphical window text
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
push dword [ecx + 8]
push 0
push 0x5087fe
sub esp, 0x20
jmp 0x41fdf7
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp al, 3
jae 0x41fe39
add eax, 0x7e2
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0xc]
push 5
lea ecx, [ebp + ecx*8 - 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0xc]
cmp al, 2
jne 0x41fe2e
cmp byte [0x5005a0], 1
je 0x41fe39
lea ecx, [ebp + eax*8 - 0x30]
cmp byte [ecx], 0
je 0x41fea8
jmp 0x41fdf4
lea ecx, [ebp - 0x30]
push ecx
call fcn.00465c27
test al, al
jne 0x41fe4d
mov eax, 0x500e30
jmp 0x41fead
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x10]
jmp 0x52eb3b
mov eax, 0x500e1c
push eax
push 0
call fcn.0042f699
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x42c223
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4b6930
call fcn.0042c430
mov dword [ebp - 0xc], 0
push 0
call fcn.0042b81b
add esp, 4
call fcn.0052e2c9
call fcn.004cee12
mov dword [ebp - 8], eax
push 0
call fcn.004759bc
add esp, 4
mov eax, dword [ebp - 8]
cmp eax, 3
je 0x42c29a
mov ecx, 0x4b6a98
call fcn.004848b5
test eax, eax
jne 0x42c295
push 1
mov ecx, 0x4b6a98
call fcn.00475e67
call fcn.00476870
mov ecx, 0x4b0770
call fcn.00418c30
push eax
call fcn.00476715
nop
nop
nop
call fcn.00476882
mov edx, dword [ebp - 8]
cmp edx, 4
ja case.default.0x42c2a6
jmp dword [edx*4 + 0x42c3e4]
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
call fcn.0040be47
jmp 0x42c2e8
call fcn.0040d273
test al, al
je 0x42c2db
mov ecx, 0x4b2b98
call fcn.004332d8
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
mov ecx, 0x4b2b98
call fcn.00433325
nop
nop
nop
mov dword [ebp - 0xc], eax
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7fffffff
div ecx
push edx
call fcn.0047fb05
add esp, 4
mov ecx, 0x4b3d08
call fcn.0044f058
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
ja case.0x42c33d.1
mov eax, dword [ebp - 0x14]
jmp dword [eax*4 + 0x42c3f8]
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
jmp 0x42c388
mov dword [ebp - 4], 1
push 0
mov ecx, 0x4b3d08
call fcn.0040be38
jmp 0x42c388
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
jmp 0x42c388
call fcn.0047b4f7
mov eax, dword [ebp - 0xc]
or al, 8
mov dword [ebp - 0xc], eax
jmp 0x42c388
push 0
call fcn.004759bc
add esp, 4
cmp dword [ebp - 4], 1
jne 0x42c397
mov dword [ebp - 4], 0
jmp 0x42c3a3
mov ecx, 0x492f90
call fcn.00417980
jmp 0x42c3a8
jmp 0x42c301
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov byte [0x4aab94], 0
call fcn.0040bb87
mov ecx, dword [ebp - 0xc]
and ecx, 0x6c
test ecx, ecx
je 0x42c3d8
push 0
mov ecx, 0x4b6a98
call fcn.00475e67
jmp 0x42c3dd
jmp 0x42c229
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x452fba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
cmp dword [ebp + 0xc], 2
jne 0x452fdc
push 0xfa
push 0x17d
push dword [ebp + 8]
call fcn.0040bdf3
jmp 0x4530e6
push 0x155
push 0x17d
push dword [ebp + 8]
call fcn.0040bdf3
jmp 0x452ff3
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
je 0x453016
mov eax, 0x551
add eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x452ff0
mov byte [ebp - 4], 0
jmp 0x45301f
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
je 0x453061
push 0
push 0xa0
push 0x90
push 0x9a
cmp al, 0
je 0x45303f
push 1
jmp 0x453044
push 0x97
mov ecx, 0x557
imul eax, eax, 3
add ecx, eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x45301c
mov byte [ebp - 4], 0
jmp 0x45306a
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
je 0x453089
mov ecx, 0x553
add ecx, eax
push 0x486adc
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x453067
mov byte [ebp - 4], 0
jmp 0x453092
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
je 0x4530cf
mov ecx, 0x507
cmp dword [ebp - 4], 3
jne 0x4530a4
inc ecx
add ecx, dword [ebp - 4]
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x16
push 0x48
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x36
add ecx, 0x7f
push ecx
push 0x12c
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x45308f
push 0x50a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x96
push 0x126
push 2
push 2
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 0x10], 0
je 0x45311f
push 0x48e0e6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45a579
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push eax
sub esp, 0xc
mov edx, dword [ebp + 0xc]
shr edx, 0x10
cmp dx, 0x300
jne 0x45a606
mov ecx, 0x500e27
cmp byte [ecx], 0xff
jne 0x45a5ff
inc byte [ecx]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
push 6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x45a5ba
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 5
jae 0x45a5d6
lea ecx, [ebp - 0x14]
movzx eax, byte [eax + ecx]
test eax, eax
je 0x45a5ff
push eax
call fcn.004014ca
test eax, eax
jne 0x45a5b7
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov byte [ecx + edx], 0
push ecx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 4
push 4
push 0xb1
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov byte [0x500e27], 0xff
mov esp, ebp
pop ebp
ret 8
Function at 0x4682d6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x58]
mov edx, dword [ebp + 8]
and edx, 0xff
cmp ecx, edx
je 0x468311
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x468311
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
mov dl, byte [ebp + 8]
mov byte [ebp - 8], dl
cmp byte [ebp - 8], 0
je 0x468325
cmp byte [ebp - 8], 1
je 0x468352
jmp 0x46837d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x1288
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46837d
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0x1288
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
mov byte [eax + 0x58], cl
mov esp, ebp
pop ebp
ret 4

Function at 0x468e67
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 0xc]
push eax
call fcn.0047fc5a
add esp, 4
mov dword [ebp - 0x44], eax
push 0x40
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, dword [ebp - 0x44]
jne 0x468ea5
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0047fcc3
add esp, 8
test eax, eax
je 0x468eb5
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x468eba
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x46edba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov al, byte [ebp + 8]
mov byte [ebp - 8], al
cmp byte [ebp - 8], 0
je 0x46edda
cmp byte [ebp - 8], 1
je 0x46ee26
jmp 0x46ee70
mov ecx, dword [ebp - 4]
add ecx, 0x68
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46edfc
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x68
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46ee70
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46ee48
push 0
mov ecx, 0x4b69b0
call fcn.004746ad
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 4]
add ecx, 0x68
call fcn.004d0286
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4

Function at 0x46fc40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov dword [ebp - 0x118], ecx
lea ecx, [ebp - 0x110]
call fcn.004032b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x118]
xor ecx, ecx
mov cl, byte [eax + 0x2024]
call fcn.00484002
nop
nop
nop
nop
call fcn.00418c90
mov byte [ebp - 0x114], al
mov edx, dword [ebp - 0x114]
and edx, 0xff
cmp edx, 0xff
jne 0x46fcb3
mov byte [ebp - 0x114], 0x10
push str.HITAREA.E5
lea ecx, [ebp - 0x110]
call fcn.0041fb35
mov eax, dword [ebp - 0x118]
add eax, 0x24
push eax
mov ecx, dword [ebp - 0x114]
and ecx, 0xff
push ecx
lea ecx, [ebp - 0x110]
call fcn.0041fc89
lea ecx, [ebp - 0x110]
call fcn.004192c5
push 0
mov edx, dword [0x4b5ff8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xb
call fcn.0047cae3
add esp, 4
push 7
call fcn.0047d1ca
add esp, 4
push 0
push 0
push 0
call fcn.0047d1f1
add esp, 0xc
mov eax, dword [ebp - 0x118]
add eax, 0x24
push eax
mov ecx, dword [0x48689c]
push ecx
mov edx, dword [0x486898]
push edx
push 0
push 0
call fcn.0047e09b
nop
nop
nop
push 0
call fcn.0047cae3
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.004192c5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret