joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d8d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jle 0x45d906
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x49a6b8]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x45d8e4
pop edi
pop ebx
not eax
pop esi
ret

Function at 0x45d910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
not eax
jle 0x45d949
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x49a6b8]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x45d927
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x45f5b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x52031c]
sub esp, 0x50
test eax, eax
push ebx
push esi
push edi
je 0x45f5cf
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x50
ret
mov ebx, dword [esp + 0x60]
mov esi, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xfffffffffffffffa
push ebx
call esi
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x520464]
test eax, eax
jne 0x45f6a4
push 0x7f00
push 0
mov dword [esp + 0x34], 0x30
mov dword [esp + 0x38], 3
mov dword [esp + 0x3c], 0x45f8c0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
mov dword [esp + 0x4c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [0x517ff4]
push 0
push 0
push 0
push 1
push 0x12a
push ecx
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], str.Pattern
call dword [sym.imp.USER32.dll_LoadImageA]
lea edx, [esp + 0x2c]
mov dword [esp + 0x58], eax
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x45f69a
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x50
ret
mov dword [0x520464], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 0
push edi
push 0
push 0
push 0x100
add eax, 0x64
push 0x100
add ecx, 0x64
push eax
push ecx
push 0x90c80000
push str.Pattern
push str.Pattern
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 5
push eax
mov dword [0x52031c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x52031c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x80
push 0x100
push 0
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, dword [0x52031c]
push 0xffffffffffffffec
push ecx
call esi
mov edx, dword [0x52031c]
push eax
push edx
call dword [sym.imp.USER32.dll_GetMenu]
neg eax
sbb eax, eax
neg eax
push eax
mov eax, dword [0x52031c]
push 0xfffffffffffffff0
push eax
call esi
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
sub edx, ecx
mov ecx, dword [0x52031c]
push 0x106
sub eax, ebx
push edx
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x52031c]
pop edi
pop esi
pop ebx
add esp, 0x50
ret
Function at 0x463e40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push str..ini
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
lea edx, [esp]
push edx
push 0
push str.Show
push str.Launcher
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x523ca8], al
add esp, 0x104
ret

Function at 0x463fd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x190
lea eax, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x20]
push str..ini
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edx, [esp + 0x20]
push edx
push 0
push str.ListNo
push str.Launcher
call esi
mov byte [0x523c80], al
lea eax, [esp + 0x20]
push eax
push 0
push str.FontColor
push str.Launcher
call esi
lea ecx, [esp + 0x20]
mov dword [0x523cac], eax
push ecx
push 0xffffffffffffffff
push str.BGColor
push str.Launcher
call esi
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [0x4a39a0], eax
xor edi, edi
mov esi, 0x5206e0
push edi
lea edx, [esp + 0x14]
push str.ListName_u
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push 0x104
push esi
push 0x5167f8
push ecx
push str.Launcher
call ebx
add esi, 0x40
inc edi
cmp esi, 0x520920
jl 0x46405d
lea edx, [esp + 0x20]
lea eax, [esp + 0x124]
push edx
push 0x79
push eax
push 0x5167f8
push str.LOGFONT
push str.Launcher
call ebx
test eax, eax
je 0x4640da
xor esi, esi
lea edi, [esp + 0x124]
push edi
call fcn.0043a020
add esp, 4
mov byte [esi + 0x52046c], al
inc esi
add edi, 2
cmp esi, 0x3c
jb 0x4640c2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x190
ret
Function at 0x467c50
Capabilities:
Create directory

Disassembly:
sub esp, 0x244
lea eax, [esp]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [esp + 8]
push str.nnnssave
lea eax, [esp + 0xc]
push edx
push eax
call edi
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x467cb0
test byte [esp + 0x10c], 0x10
jne 0x467cbd
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x517ffc]
mov edx, dword [ecx]
call dword [edx + 4]
push eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0xc]
push eax
push ecx
call edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str..ss0]
repne scasb al, byte es:[edi]
mov al, byte [0x4a3c6c]
mov ecx, dword [0x517ffc]
dec edi
mov dword [edi], edx
mov byte [edi + 4], al
mov edx, dword [ecx]
lea eax, [esp + 8]
push eax
call dword [edx + 0x10]
pop edi
pop esi
add esp, 0x244
ret

Function at 0x4697c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push eax
push 0
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea ecx, [esp + 0x14]
push ecx
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [esp + 0x14]
push str.pal_ndefault.pal
lea eax, [esp + 0x18]
push edx
push eax
call ebp
push 0
push 0x80
push 3
push 0
push 0
lea ecx, [esp + 0x28]
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46988c
lea edx, [esp + 0x14]
push 0x104
push edx
push 0
call edi
lea eax, [esp + 0x14]
push eax
call ebx
lea ecx, [esp + 0x14]
push str.ndefault.pal
lea edx, [esp + 0x18]
push ecx
push edx
call ebp
push 0
push 0x80
push 3
push 0
push 0
lea eax, [esp + 0x28]
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46988c
mov ecx, 0x30
mov esi, str.uuue
mov edi, 0x523ee8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
lea ecx, [esp + 0x10]
push 0
push ecx
push 0xc0
push 0x523ee8
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x46a7a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x120]
lea edx, [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x46a7c1
mov edi, dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
lea eax, [esp + 0x1c]
push str..ips
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
lea ecx, [esp + 0x30]
push bind
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x46a897
lea edx, [esp + 0x1c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov ebp, eax
mov al, byte [0x52aaf7]
lea ecx, [esp + 0x1c]
test al, al
je 0x46a84d
push 0x52a9ec
lea edx, [esp + 0x20]
push ecx
push edx
jmp 0x46a858
lea eax, [esp + 0x1c]
push 0x4a46dc
push eax
push ecx
call esi
lea edx, [esp + 0x1c]
push ebp
lea eax, [esp + 0x20]
push edx
push eax
call esi
lea ecx, [esp + 0x1c]
push str..ips
push ecx
call edi
push 0
push 0x80
push 3
push 0
push 0
lea edx, [esp + 0x30]
push bind
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x46a9a7
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 5
push ecx
push esi
call ebp
cmp dword [esp + 0x10], 5
jne 0x46a9a0
push 5
lea edx, [esp + 0x18]
push str.PATCH
push edx
call fcn.0048b5e0
add esp, 0xc
test eax, eax
jmp 0x46a99a
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 5
push ecx
push esi
call ebp
cmp dword [esp + 0x10], 5
jne 0x46a9a0
mov edx, dword [esp + 0x15]
mov edi, dword [esp + 0x17]
mov eax, dword [esp + 0x16]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
and edx, 0xff
mov bh, byte [esp + 0x14]
and edi, 0xff
or ebx, edx
and eax, 0xff
shl ebx, 8
shl edi, 8
and ecx, 0xff
or ebx, eax
or edi, ecx
push 0
jne 0x46a981
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push 3
push eax
push esi
call ebp
mov edx, dword [esp + 0x15]
mov eax, dword [esp + 0x16]
xor ecx, ecx
and edx, 0xff
mov ch, byte [esp + 0x14]
and eax, 0xff
or ecx, edx
mov edx, dword [esp + 0x124]
lea edi, [ebx + edx - 0x10]
mov bl, al
mov bh, bl
mov edx, ecx
mov eax, ebx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x46a8d4
mov ecx, dword [esp + 0x128]
lea eax, [esp + 0x14]
push eax
push edi
lea edx, [ebx + ecx - 0x10]
push edx
push esi
call ebp
cmp dword [esp + 0x10], edi
je 0x46a8d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x46bd30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 0
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46bd59
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x46bd79
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0xc]
push edi
mov ecx, 0xd00
xor eax, eax
mov edi, edx
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x3400
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret

Function at 0x46fe30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x520320]
sub esp, 0x40
test eax, eax
push esi
je 0x46fe4b
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
pop esi
add esp, 0x40
ret
push edi
mov edi, dword [esp + 0x4c]
push 0xfffffffffffffffa
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x5242ec]
pop edi
test eax, eax
jne 0x46ff1e
push 0x7f00
push 0
mov dword [esp + 0x1c], 0x30
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], 0x46ff90
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [0x517ff4]
push 0
push 0
push 0
push 1
push 0x164
push ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], str.NNNKaillera
call dword [sym.imp.USER32.dll_LoadImageA]
lea edx, [esp + 0x14]
mov dword [esp + 0x40], eax
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x46ff14
xor eax, eax
pop esi
add esp, 0x40
ret
mov dword [0x5242ec], 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push esi
push 0
push 0
push 0
add eax, 0x64
push 0
add ecx, 0x64
push eax
push ecx
push 0x90c80000
push str.NNNKaillera
push str.NNNKaillera
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 5
push eax
mov dword [0x520320], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x520320]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x520320]
push 0
push 0
push 0x414
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x520320]
pop esi
add esp, 0x40
ret
Function at 0x473380
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x348
lea edx, [esp]
push ebp
mov ebp, dword [esp + 0x350]
push esi
push edi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x473398
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [esp + 0xc]
push 0x4a2ad8
lea ecx, [esp + 0x10]
push eax
push ecx
call esi
lea edx, [esp + 0x110]
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4733e6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x348
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x114], 0x10
jne 0x47342e
lea ecx, [esp + 0x140]
lea edx, [esp + 0x254]
push ecx
push ebp
push edx
call esi
lea eax, [esp + 0x254]
push eax
call fcn.00473580
add esp, 4
xor eax, eax
mov cl, byte [esp + eax + 0x254]
mov byte [eax + 0x524330], cl
inc eax
test cl, cl
jne 0x47341c
call fcn.00472eb0
lea ecx, [esp + 0x114]
push ecx
push edi
call ebx
test eax, eax
je 0x47344b
mov eax, dword [0x528a08]
test eax, eax
je 0x4733ed
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x348
ret

Function at 0x473470
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x44c
lea edx, [esp + 0x140]
push ebp
push esi
push edi
mov edi, dword [esp + 0x45c]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47348b
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [esp + 0x14c]
push 0x4a2ad8
lea ecx, [esp + 0x150]
push eax
push ecx
call esi
lea edx, [esp + 0xc]
lea eax, [esp + 0x14c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4734df
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x44c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x10], 0x10
jne 0x473523
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x254]
push ecx
push edi
push edx
call esi
lea eax, [esp + 0x254]
push eax
call fcn.00473580
add esp, 4
xor eax, eax
mov cl, byte [esp + eax + 0x254]
mov byte [eax + 0x524330], cl
inc eax
test cl, cl
jne 0x47350f
jmp 0x47354a
cmp byte [esp + 0x3c], 0x2e
je 0x47354a
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x358]
push ecx
push edi
push edx
call esi
lea eax, [esp + 0x358]
push eax
call fcn.00473470
add esp, 4
call fcn.00472eb0
lea ecx, [esp + 0x10]
push ecx
push ebp
call ebx
test eax, eax
je 0x473564
mov eax, dword [0x528a08]
test eax, eax
je 0x4734e6
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x44c
ret
Function at 0x4737d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x528a10]
test eax, eax
jne 0x4738a9
mov eax, dword [0x528988]
mov dword [0x528a10], 1
push ebp
push esi
mov ecx, dword [eax + 8]
mov eax, dword [0x5289c4]
push eax
push 0x472f10
mov edx, dword [ecx + 0x14]
mov ecx, dword [0x517ff0]
mov dword [0x528a0c], edx
mov edx, dword [0x517ff4]
push ecx
push 0x155
push edx
mov byte [0x524330], 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ebp, eax
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x5244d0]
xor esi, esi
test eax, eax
jle 0x473878
push edi
mov edi, 0x5244d4
cmp byte [edi], 0
je 0x473877
mov al, byte [esi + 0x5285d4]
push edi
test al, al
je 0x47385f
call fcn.00473470
jmp 0x473864
call fcn.00473380
mov eax, dword [0x5244d0]
add esp, 4
inc esi
add edi, 0x104
cmp esi, eax
jl 0x473848
pop edi
mov eax, dword [0x528a08]
test eax, eax
jne 0x473888
push ebp
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.00474220
mov eax, dword [0x51802c]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
mov dword [0x528a10], 0
pop ebp
ret

Function at 0x4738b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x528a10]
sub esp, 0x104
test eax, eax
jne 0x47398e
mov ecx, dword [0x517ff0]
lea eax, [esp]
push eax
push ecx
call fcn.00472d00
add esp, 8
test eax, eax
je 0x47398e
mov edx, dword [0x528988]
mov dword [0x528a10], 1
push esi
mov eax, dword [edx + 8]
mov edx, dword [0x5289c4]
push edx
push 0x472f10
mov ecx, dword [eax + 0x14]
mov eax, dword [0x517ff0]
mov dword [0x528a0c], ecx
mov ecx, dword [0x517ff4]
push eax
push 0x155
push ecx
mov byte [0x524330], 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x473950
lea edx, [esp + 4]
push edx
call fcn.00473470
jmp 0x47395a
lea eax, [esp + 4]
push eax
call fcn.00473380
mov eax, dword [0x528a08]
add esp, 4
test eax, eax
jne 0x47396d
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.00474220
mov ecx, dword [0x51802c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [0x528a10], 0
pop esi
add esp, 0x104
ret
Function at 0x476940
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x51802c]
sub esp, 0x3c
test eax, eax
push ebx
jne 0x476967
mov eax, dword [0x517ff4]
mov ecx, dword [0x517ff0]
push eax
push ecx
call fcn.00476380
add esp, 8
pop ebx
add esp, 0x3c
ret
mov eax, dword [0x518030]
test eax, eax
jne 0x476ae7
mov eax, dword [0x517ff0]
push esi
lea edx, [esp + 0x18]
push edi
push edx
push eax
mov dword [esp + 0x24], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov eax, dword [0x524474]
mov dword [0x524480], ecx
mov ecx, dword [0x524470]
mov dword [0x524484], edx
mov edx, dword [0x52447c]
push 4
push eax
mov eax, dword [0x524478]
push ecx
mov ecx, dword [0x517ff0]
push edx
push eax
mov ebx, 1
push 0
push ecx
mov dword [0x528a14], ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x517ff0]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea edx, [esp + 0xc]
push edx
push eax
call edi
mov ecx, dword [esp + 0x18]
mov esi, dword [0x518024]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov esi, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov eax, dword [0x51802c]
sub edx, esi
push ebx
sub edx, 0x108
push ecx
push edx
push 0
push 0x108
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [0x51802c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call esi
mov edx, dword [0x528928]
push 5
push edx
call esi
mov eax, dword [0x528924]
push 5
push eax
call esi
mov dword [0x518030], ebx
call fcn.00476c10
call fcn.004499d0
mov edx, dword [0x517ff0]
lea ecx, [esp + 0xc]
push ecx
push edx
call edi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
shl eax, 0x10
sub ecx, esi
or eax, ecx
push eax
push 0
mov edx, dword [0x517ff0]
push 5
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x517ff0]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x517ffc]
pop edi
test ecx, ecx
pop esi
je 0x476ae7
mov eax, dword [0x5289a0]
test eax, eax
je 0x476ae7
mov eax, dword [0x524460]
test eax, eax
je 0x476ad3
mov dword [0x524468], ebx
mov edx, dword [ecx]
push 0
call dword [edx + 0xc8]
mov ecx, dword [0x517ffc]
mov eax, dword [0x524464]
test eax, eax
je 0x476ae7
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov dword [0x52446c], ebx
pop ebx
add esp, 0x3c
ret
Function at 0x476af0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x518030]
sub esp, 0x2c
test eax, eax
je 0x476c01
mov ecx, dword [0x517ff0]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [0x524478], ecx
sub eax, ecx
mov ecx, dword [esp + 0x28]
mov dword [0x52447c], edx
sub ecx, edx
mov edx, dword [0x528a14]
mov dword [0x524470], eax
test edx, edx
mov dword [0x524474], ecx
je 0x476b6f
mov edx, dword [0x524484]
push 4
push ecx
mov ecx, dword [0x517ff0]
push eax
mov eax, dword [0x524480]
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x51802c]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x518030], 0
call esi
mov eax, dword [0x528930]
push 0
push eax
call esi
mov ecx, dword [0x528928]
push 0
push ecx
call esi
mov edx, dword [0x528924]
push 0
push edx
call esi
mov ecx, dword [0x517ffc]
pop esi
test ecx, ecx
je 0x476bf1
mov eax, dword [0x524468]
test eax, eax
je 0x476bd9
mov dword [0x524468], 0
mov eax, dword [ecx]
push 1
call dword [eax + 0xc8]
mov ecx, dword [0x517ffc]
mov eax, dword [0x52446c]
test eax, eax
je 0x476bf1
mov dword [0x52446c], 0
mov edx, dword [ecx]
call dword [edx + 0x7c]
mov eax, dword [0x517ff0]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
add esp, 0x2c
ret

Function at 0x476c10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x518030]
test eax, eax
je 0x476c40
mov eax, dword [0x52899c]
test eax, eax
je 0x476c31
mov eax, dword [0x528930]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov ecx, dword [0x528930]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret