joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c223
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4b6930
call fcn.0042c430
mov dword [ebp - 0xc], 0
push 0
call fcn.0042b81b
add esp, 4
call fcn.0053e2c9
call fcn.004cee12
mov dword [ebp - 8], eax
push 0
call fcn.004759bc
add esp, 4
mov eax, dword [ebp - 8]
cmp eax, 3
je 0x42c29a
mov ecx, 0x4b6a98
call fcn.004848b5
test eax, eax
jne 0x42c295
push 1
mov ecx, 0x4b6a98
call fcn.00475e67
call fcn.00476870
mov ecx, 0x4b0770
call fcn.00418c30
push eax
call fcn.00476715
add esp, 4
call fcn.00476882
mov edx, dword [ebp - 8]
cmp edx, 4
ja case.default.0x42c2a6
jmp dword [edx*4 + 0x42c3e4]
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
call fcn.0040be47
jmp 0x42c2e8
call fcn.00413e25
test al, al
je 0x42c2db
mov ecx, 0x4b2b98
call fcn.004332d8
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
mov ecx, 0x4b2b98
call fcn.00433325
nop
nop
nop
mov dword [ebp - 0xc], eax
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7fffffff
div ecx
push edx
call fcn.0047fb05
add esp, 4
mov ecx, 0x4b3d08
call fcn.0044f058
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
ja case.0x42c33d.1
mov eax, dword [ebp - 0x14]
jmp dword [eax*4 + 0x42c3f8]
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
jmp 0x42c388
mov dword [ebp - 4], 1
push 0
mov ecx, 0x4b3d08
call fcn.0040be38
jmp 0x42c388
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
jmp 0x42c388
call fcn.0047b4f7
mov eax, dword [ebp - 0xc]
or al, 8
mov dword [ebp - 0xc], eax
jmp 0x42c388
push 0
call fcn.004759bc
add esp, 4
cmp dword [ebp - 4], 1
jne 0x42c397
mov dword [ebp - 4], 0
jmp 0x42c3a3
mov ecx, 0x569000
call fcn.00417980
jmp 0x42c3a8
jmp 0x42c301
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov byte [0x4aab94], 0
call fcn.0040bb87
mov ecx, dword [ebp - 0xc]
and ecx, 0x6c
test ecx, ecx
je 0x42c3d8
push 0
mov ecx, 0x4b6a98
call fcn.00475e67
jmp 0x42c3dd
jmp 0x42c229
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42c479
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
call fcn.0047eb97
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jge 0x42c498
call fcn.0047eb97
mov dword [ebp - 8], eax
jmp 0x42c4a0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
sub eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x437250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 7
call fcn.0047cae3
add esp, 4
call fcn.0047d340
push 0
push 0xa
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
add esp, 4
push dword [0x4b6a68]
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
pop ebp
ret

Function at 0x439fa6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0x10]
cmp al, 0
je 0x439fcd
cmp al, 1
jne 0x439fc3
dec eax
mov dword [ebp - 4], eax
push eax
push 0x5d
push 0x2b
push 0x44
jmp 0x439ff6
mov dword [ebp - 4], eax
sub al, 6
push eax
push 0x5e
jmp 0x439ff2
mov byte [ebp - 4], 6
cmp byte [0x505fcc], 1
je 0x439fe3
sub byte [ebp - 4], 2
jmp 0x439fe3
inc dword [ebp + 0x10]
mov al, byte [ebp - 4]
cmp byte [ebp + 0x10], al
jae 0x43a055
push 0xff
push 0x10
push 0x1a
push 0x48
push 0
push dword [ebp + 0x14]
call fcn.00450b93
push eax
push 1
push dword [ebp + 0x18]
call fcn.00450b93
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00435116
cmp dword [ebp + 8], 0
jne 0x43a055
push 5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x101
push 0
push 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp + 8], 0
jne 0x43a053
push 0
call fcn.00423971
jmp 0x439fe0
call fcn.004768c0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43d509
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
call fcn.0045f670
mov dword [0x500e95], eax
push eax
call fcn.004061e4
call fcn.004cfc89
test al, al
je 0x43d52d
mov al, 1
xor al, 1
mov ecx, dword [ebp - 0x24]
movzx edx, byte ss:[ecx + 4]
add edx, 0x501b00
cmp byte [edx], 0xff
je 0x43d544
mov byte [edx], al
lea ecx, [ebp - 0x18]
call fcn.0045f710
lea ecx, [ebp - 0xc]
call fcn.0045f710
mov byte [ebp - 4], 0xff
mov eax, dword [ebp + 8]
cmp al, 0
jne 0x43d567
mov ecx, dword [ebp - 0x24]
call fcn.0043f8e8
mov byte [ebp - 0x1c], al
mov ecx, dword [ebp - 0x24]
call fcn.00406710
cmp al, 1
je 0x43d58a
xor eax, eax
mov al, byte [0x4b4230]
and eax, 4
test eax, eax
jne 0x43d58a
mov byte [ebp - 4], 0
jmp 0x43d5e2
push 0x80
mov ecx, dword [ebp - 0x24]
call fcn.00425af0
test eax, eax
jne 0x43d5a7
mov ecx, dword [ebp - 0x24]
call fcn.00425ad0
cmp al, 7
je 0x43d5bc
xor ecx, ecx
mov cl, byte [0x4b4230]
and ecx, 4
test ecx, ecx
jne 0x43d5bc
mov byte [ebp - 4], 1
jmp 0x43d5e2
push 8
mov ecx, dword [ebp - 0x24]
call fcn.004066e0
test eax, eax
je 0x43d5d0
mov byte [ebp - 4], 5
jmp 0x43d5e2
push 2
mov ecx, dword [ebp - 0x24]
call fcn.00425af0
test eax, eax
je 0x43d5e2
mov byte [ebp - 4], 6
push 1
push 0xff
push 0xff
push 0
mov ecx, dword [ebp - 0x24]
call fcn.00539f19
push eax
mov edx, dword [ebp - 0x24]
add edx, 6
push edx
mov ecx, dword [ebp - 0x24]
call fcn.00438484
mov ecx, dword [ebp - 0x24]
call fcn.0043ff54
test eax, eax
jne 0x43d620
mov ecx, dword [ebp - 0x24]
call fcn.00425ad0
cmp al, 7
jne 0x43d62e
push 1
mov ecx, 0x4b4250
call fcn.00451c03
jmp 0x43d63a
push 1
mov ecx, 0x4b4250
call fcn.004350e9
mov ecx, dword [ebp - 0x24]
mov al, byte [ecx + 4]
mov byte [0x4b5dd8], al
nop
movzx eax, byte [ebp - 0x1c]
nop
cmp al, 0xff
je 0x43d667
push 0
mov cl, byte [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
mov ax, word [edx + 6]
push eax
mov ecx, 0x4b4250
call fcn.004539ef
jmp 0x539980
Function at 0x44a3f6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov byte [ecx + 0x18], al
inc eax
mov dword [ecx + 0x14], eax
push 0
push dword [0x4b5fdc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x452fba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
cmp dword [ebp + 0xc], 2
jne 0x452fdc
push 0xfa
push 0x17d
push dword [ebp + 8]
call fcn.0041b125
jmp 0x4530e6
push 0x155
push 0x17d
push dword [ebp + 8]
call fcn.0041b125
jmp 0x452ff3
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
je 0x453016
mov eax, 0x551
add eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x452ff0
mov byte [ebp - 4], 0
jmp 0x45301f
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
je 0x453061
push 0
push 0xa0
push 0x90
push 0x9a
cmp al, 0
je 0x45303f
push 1
jmp 0x453044
push 0x97
mov ecx, 0x557
imul eax, eax, 3
add ecx, eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x45301c
mov byte [ebp - 4], 0
jmp 0x45306a
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
je 0x453089
mov ecx, 0x553
add ecx, eax
push 0x486adc
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x453067
mov byte [ebp - 4], 0
jmp 0x453092
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
je 0x4530cf
mov ecx, 0x507
cmp dword [ebp - 4], 3
jne 0x4530a4
inc ecx
add ecx, dword [ebp - 4]
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x16
push 0x48
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x36
add ecx, 0x7f
push ecx
push 0x12c
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x45308f
push 0x50a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x96
push 0x126
push 2
push 2
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 0x10], 0
je 0x45311f
push 0x48e0e6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45a579
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push eax
sub esp, 0xc
mov edx, dword [ebp + 0xc]
shr edx, 0x10
cmp dx, 0x300
jne 0x45a606
mov ecx, 0x500e27
cmp byte [ecx], 0xff
jne 0x45a5ff
inc byte [ecx]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
push 6
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x45a5ba
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 5
jae 0x45a5d6
lea ecx, [ebp - 0x14]
movzx eax, byte [eax + ecx]
test eax, eax
je 0x45a5ff
push eax
call fcn.004014ca
test eax, eax
jne 0x45a5b7
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov byte [ecx + edx], 0
push ecx
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 4
push 4
push 0xb1
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov byte [0x500e27], 0xff
mov esp, ebp
pop ebp
ret 8
Function at 0x45f0e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x4b5fe8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 7
call fcn.0047cae3
add esp, 4
call fcn.0047d340
push 0
push 0x1f
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
add esp, 4
mov ecx, dword [0x4b6a68]
push ecx
mov edx, dword [0x4b5fe8]
push edx
call dword [sym.imp.USER32.dll_SetParent]
push 0
mov eax, dword [0x4b5fec]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 8
call fcn.0047cae3
add esp, 4
call fcn.0047d340
push 0
push 0x1f
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
add esp, 4
mov ecx, dword [0x4b6a68]
push ecx
mov edx, dword [0x4b5fec]
push edx
call dword [sym.imp.USER32.dll_SetParent]
push 0
mov eax, dword [0x4b600c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x10
call fcn.0047cae3
add esp, 4
call fcn.0047d340
push 0
push 0x1f
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
add esp, 4
mov ecx, dword [0x4b6a68]
push ecx
mov edx, dword [0x4b600c]
push edx
call dword [sym.imp.USER32.dll_SetParent]
mov ecx, 0x4b4250
call fcn.00455e6b
add eax, 7
cdq
mov ecx, 0x30
idiv ecx
imul eax, eax, 0x30
add eax, 0x28
push eax
mov ecx, 0x4b4250
call fcn.00455e44
add eax, 0x2f
cdq
mov ecx, 0x30
idiv ecx
imul eax, eax, 0x30
push eax
push 0x28
push 0
call fcn.0047d281
add esp, 0x10
pop ebp
ret

Function at 0x45fc15
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret

Function at 0x4607ff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x460815
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x15
jge 0x460855
cmp dword [ebp - 4], 2
je 0x460836
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x4b5fd0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x460853
push 0
push 0x9cbd
push 0x111
mov eax, dword [ebp - 4]
mov ecx, dword [eax*4 + 0x4b5fd0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x46080c
push 0
call fcn.0047cae3
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x460863
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push dword [ebp + 0x10]
nop
nop
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
imul ecx, ecx, 4
push eax
push dword [ecx + 0x4b5fd0]
call dword [sym.imp.USER32.dll_SetParent]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x14]
call fcn.00461b6a
add esp, 8
mov edx, dword [ebp + 0xc]
imul edx, edx, 0x10
mov dword [ebp - 0x18], edx
push 0xc
mov ecx, dword [edx + 0x4867fc]
add ecx, 2
push ecx
mov ecx, dword [edx + 0x4867f8]
add ecx, 2
push ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax - 2]
sub eax, dword [edx + 0x4867fc]
cdq
sub eax, edx
sar eax, 1
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
lea eax, [eax + edx - 2]
mov edx, dword [ebp - 0x18]
sub eax, dword [edx + 0x4867f8]
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebp - 0x18]
push 0
push dword [edx + 0x4867fc]
push dword [edx + 0x4867f8]
push 0
push 0
mov ecx, dword [ebp + 0xc]
push dword [ecx*4 + 0x4b5fd0]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
mov ecx, dword [ebp + 0xc]
push dword [ecx*4 + 0x4b5fd0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x460b9e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x460bc7
push 0
mov ecx, dword [0x4b5ff0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 1
mov esp, ebp
pop ebp
ret

Function at 0x462af9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov esp, ebp
pop ebp
ret

Function at 0x462b2c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x462b5d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x462b53
push 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x462b5b
mov ecx, dword [ebp - 4]
call fcn.00462bde
jmp 0x462bd8
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
jle 0x462bd8
push 0
push 0
push 0x173
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x462bd8
push 0
push 0
push 0x172
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x26
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409c11
add eax, 2
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409bf2
add eax, 2
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esp, ebp
pop ebp
ret 4
Function at 0x462bde
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
call fcn.00480ff0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
imul eax, ecx
push eax
call fcn.00480fe0
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00480ff0
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x462cf0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0047cae3
add esp, 4
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
call fcn.0047e239
nop
nop
nop
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.0040979d
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.00409b08
push eax
push 0
push 0x172
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0047cae3
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00481020
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x462cf4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0x173
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x462d6d
push 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x172
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x26
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409c11
add eax, 2
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409bf2
add eax, 2
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
add ecx, 0x18
call fcn.00409caa
mov esp, ebp
pop ebp
ret
Function at 0x462e1a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x14], 0
jle 0x462f39
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
call fcn.00480ff0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
imul ecx, edx
push ecx
call fcn.00480fe0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00480ff0
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x462f39
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x10]
push edx
call fcn.0047cae3
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
push edx
push 0
push 0
call fcn.0047e239
nop
nop
nop
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.0040995f
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.00409b08
push eax
push 0
push 0x172
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0047cae3
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00481020
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x46305a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x463078
push 5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x463087
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4
Function at 0x4640c5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
jmp 0x4640de
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x14]
cmp dword [ebp - 0x14], edx
jge 0x464121
push 0
push dword [ebp - 0x14]
push 0x101d
mov ecx, dword [ebp - 0x2c]
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_SendMessageA]
add dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp + 8], 1
je 0x464116
mov eax, dword [ecx + 0x18]
mov edx, dword [eax + edx*4]
inc edx
push edx
mov edx, dword [ecx]
call dword [edx + 0x14]
add dword [ebp - 0x24], eax
jmp 0x4640db
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebp + 8], 1
je 0x46413d
mov edx, dword [ebp - 0x24]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], edx
je 0x46420d
push 0
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x4641ff
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x14]
dec edx
mov dword [ebp - 0x14], edx
jmp 0x464189
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jl 0x4641d8
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
call dword [edx + 0x14]
push dword [ebp - 0x24]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x20], eax
sub dword [ebp - 0x28], eax
cmp dword [ebp - 0x14], 0
jne 0x4641bd
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x20], eax
movzx edx, byte [ebp - 0x20]
push edx
push dword [ebp - 0x14]
push 0x101e
mov ecx, dword [ebp - 0x2c]
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x464186
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebp + 8], 1
je 0x4641f4
mov edx, dword [ebp - 0x24]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
jmp 0x46415a
push 5
mov ecx, dword [ebp - 0x2c]
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 4