joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4976d4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 6
add esp, 0xfffff004
push eax
dec eax
jne 0x4976dd
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
mov ebx, dword [ebp + 8]
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4978ce
push 5
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
push 0
call fcn.004013d8
add esp, 8
call fcn.004013fc
lea eax, [ebp - 0x2000]
push eax
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.00417e44
add esp, 0xc
test eax, eax
jne 0x4977ab
call fcn.00401400
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
push 0
call fcn.004013d8
add esp, 8
push ebx
push 0x4976bc
call fcn.00401c38
add esp, 8
jmp 0x4978ce
push 0x7c
push 3
lea ecx, [ebp - 0x4000]
push ecx
lea eax, [ebp - 0x2000]
push eax
call fcn.0041e2f8
add esp, 0x10
test eax, eax
jne 0x49781c
call fcn.00401400
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
push 0
call fcn.004013d8
add esp, 8
push ebx
push 0x4976bc
call fcn.00401c38
add esp, 8
jmp 0x4978ce
mov esi, 0x40
push 0x7c
push 4
lea eax, [ebp - 0x6000]
push eax
lea edx, [ebp - 0x2000]
push edx
call fcn.0041e2f8
add esp, 0x10
test eax, eax
je 0x497851
movsx ecx, byte [ebp - 0x6000]
cmp ecx, 0x31
jne 0x497851
or esi, 0x100000
push esi
lea eax, [ebp - 0x2000]
push eax
push 0
lea edx, [ebp - 0x4000]
push edx
call fcn.00494cb8
add esp, 0x10
test eax, eax
jne 0x4978bc
call fcn.00401400
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
push 0
call fcn.004013d8
add esp, 8
push ebx
push 0x4976bc
call fcn.00401c38
add esp, 8
push 0
push 0x4e20
push 0x7c8
push ebx
call sub.USER32.dll_SetTimer
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499380
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov eax, 0x597e80
call fcn.004d08c0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
xor ebx, ebx
mov word [ebp - 0x14], 8
mov dword [ebp - 0x28], 1
test edi, edi
je 0x4993d6
push 0xfffffffffffffff0
push edi
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetWindowLongA
test eax, 0x800000
je 0x4993d6
mov bl, 1
push ebx
lea eax, [ebp - 0x1028]
push eax
call fcn.00466878
add esp, 8
sub eax, 0xffffffff
je 0x499435
dec eax
je 0x4993f1
dec eax
je 0x4993fa
mov dword [ebp - 0x28], 0xa
jmp 0x49946e
mov dword [ebp - 0x28], 0x32
push 5
mov edx, dword [ebp + 0x10]
push edx
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x33
push 0
mov ecx, dword [ebp + 0x14]
push ecx
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x34
jmp 0x49946e
mov dword [ebp - 0x28], 0x50
push 0
mov eax, dword [ebp + 0x10]
push eax
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x51
push 5
mov edx, dword [ebp + 0x14]
push edx
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x52
mov dword [ebp - 0x28], 0x96
lea ecx, [ebp - 0x1028]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
call sub.USER32.dll_SetDlgItemTextA
mov dword [ebp - 0x28], 0x97
mov word [ebp - 0x14], 0
jmp 0x4994b8
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov esp, ebp
mov edi, dword [ebp - 0x1034]
mov esi, dword [ebp - 0x1030]
mov ebx, dword [ebp - 0x102c]
pop ebp
ret
Function at 0x4a1cf4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
mov ecx, 0x104
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov esi, dword [ebp + 8]
push esi
mov esi, 0x598a14
rep movsd dword es:[edi], dword [esi]
pop esi
call fcn.0049fbd8
sub al, 0xff
je 0x4a1d91
dec al
je 0x4a1d2d
dec al
je 0x4a1d5f
jmp 0x4a1dc1
push 0
push 0x65
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x66
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x67
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4a1dc1
push 5
push 0x65
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x66
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x67
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4a1dc1
push 0
push 0x65
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x66
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x67
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x5167f0
call fcn.00479380
push eax
call fcn.00479388
push eax
mov bl, byte [0x519bf1]
test bl, bl
jne 0x4a1df2
cmp byte [0x519bf5], 0
jne 0x4a1df2
cmp byte [0x519bf7], 0
jne 0x4a1df2
xor eax, eax
jmp 0x4a1df7
mov eax, 1
shl eax, 0x10
cmp byte [0x519bf6], 0
setne dl
and edx, 1
shl edx, 0xc
add eax, edx
test bl, bl
setne cl
and ecx, 1
mov dl, byte [0x519bf5]
shl ecx, 8
add eax, ecx
test dl, dl
setne cl
and ecx, 1
mov dl, byte [0x519bf7]
shl ecx, 4
add eax, ecx
test dl, dl
setne cl
and ecx, 1
add eax, ecx
push eax
movsx eax, byte [0x517e74]
push eax
call fcn.004a1c14
push eax
call fcn.00479bcc
push eax
call fcn.00479bd4
push eax
call fcn.00479bc4
push eax
push 0x5f8a84
push 0x5dd3cd
lea eax, [ebp - 0x410]
push eax
call fcn.004d26c8
add esp, 0x30
call fcn.004538c4
test al, al
je 0x4a1ea8
call fcn.004538b0
push eax
push 0x5dd3f0
lea edx, [ebp - 0x410]
push edx
call fcn.004cdfec
pop ecx
lea ecx, [ebp - 0x410]
add eax, ecx
push eax
call fcn.004d26c8
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
push 0x64
push esi
call sub.USER32.dll_SetDlgItemTextA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a493c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov al, byte [0x519bf1]
test al, al
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
je 0x4a495e
mov eax, 1
jmp 0x4a4b03
mov dl, byte [ebp + 0xc]
test dl, dl
jne 0x4a496f
mov eax, 1
jmp 0x4a4b03
push 0
push 0x5dd9d1
call sub.USER32.dll_FindWindowA
test eax, eax
jne 0x4a4990
mov byte [0x599185], 0
mov eax, 1
jmp 0x4a4b03
push 1
push esi
call fcn.004a3aec
add esp, 8
test eax, eax
setne bl
and ebx, 1
mov byte [0x599185], bl
test bl, bl
je 0x4a49b7
mov eax, 1
jmp 0x4a4b03
mov dl, byte [0x519bf6]
test dl, dl
je 0x4a49d5
mov cl, byte [0x519bf1]
test cl, cl
je 0x4a49d5
mov eax, 1
jmp 0x4a4b03
mov dl, byte [0x519bf6]
test dl, dl
je 0x4a4a47
mov cl, byte [0x519bf7]
test cl, cl
je 0x4a4a47
mov eax, dword [0x599188]
test eax, eax
jne 0x4a4a07
push 0x5dd9df
call fcn.00401260
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x599188], eax
mov edx, dword [0x59918c]
test edx, edx
jne 0x4a4a26
push 0x5dd9eb
call fcn.00401260
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x59918c], eax
mov ecx, dword [0x599190]
test ecx, ecx
jne 0x4a4aa3
push 0x5dd9fb
call fcn.00401260
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x599190], eax
jmp 0x4a4aa3
mov eax, dword [0x599188]
test eax, eax
jne 0x4a4a65
push 0x5dda0b
call fcn.00401260
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x599188], eax
mov edx, dword [0x59918c]
test edx, edx
jne 0x4a4a84
push 0x5dda15
call fcn.00401260
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x59918c], eax
mov ecx, dword [0x599190]
test ecx, ecx
jne 0x4a4aa3
push 0x5dda23
call fcn.00401260
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x599190], eax
push esi
mov esi, 0x599198
lea edi, [ebp - 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x104]
push eax
push 1
call fcn.0044fe28
add esp, 8
lea edx, [ebp - 0x104]
push 1
push 0x40b
push esi
push edx
push 0
call fcn.004a3b2c
add esp, 0x14
mov ebx, eax
mov byte [0x599185], bl
test bl, bl
je 0x4a4afe
mov eax, dword [0x599188]
push eax
push 1
push esi
call fcn.004a3a9c
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5628
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push 0x7c9
push ebx
call sub.USER32.dll_KillTimer
cmp byte [ebp + 0x24], 0
je 0x4a56eb
push 0
mov eax, dword [ebp + 0x20]
push eax
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
mov edx, dword [ebp + 0xc]
push edx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push edi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
mov eax, dword [ebp + 0x1c]
push eax
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4a56d7
push 1
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
push 0x28
push ebx
call sub.USER32.dll_PostMessageA
jmp 0x4a5751
push 1
push edi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
push 0x28
push ebx
call sub.USER32.dll_PostMessageA
jmp 0x4a5751
push 5
mov edx, dword [ebp + 0x20]
push edx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push edi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
mov eax, dword [ebp + 0x18]
push eax
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
mov edx, dword [ebp + 0x1c]
push edx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a63dc
Capabilities:
Hide graphical window

Disassembly:
push 0x599478
call fcn.00401b2c
pop ecx
cmp dword [0x599474], 1
jne 0x4a6401
push 0x599478
call fcn.00401b40
pop ecx
mov eax, 1
ret
push 0x599478
call fcn.00401b40
pop ecx
call fcn.0045e73c
mov dl, byte [0x59979c]
test dl, dl
je 0x4a644e
push 0
call fcn.004417a4
pop ecx
push 5
mov ecx, dword [0x516880]
push ecx
call sub.USER32.dll_ShowWindow
push 0
push 0x1388
push 0x7c9
mov eax, dword [0x516880]
push eax
call sub.USER32.dll_SetTimer
mov eax, 1
ret
call fcn.00455cf4
test eax, eax
je 0x4a645d
mov eax, 1
ret
mov byte [0x59979c], 1
push 0
call fcn.004417a4
pop ecx
push 0
push 0
mov edx, dword [0x516888]
push edx
push 0x59979d
call fcn.0040d780
add esp, 0x10
mov eax, 1
ret
Function at 0x4a8e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
je 0x4a8eec
push 0
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 1
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4a8f85
push 0x5de140
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetWindowTextA
push 0
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 1
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0
call fcn.004013d8
add esp, 8
push 0
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
pop ebx
pop ebp
ret
Function at 0x4a9bf0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x54b208], 0
jne 0x4a9c0b
test byte [0x51b4a0], 2
jne 0x4a9c0b
test byte [0x51b4a0], 1
je 0x4a9c11
mov eax, 1
ret
mov edx, dword [0x51a5dd]
cmp edx, 0xebc
jne 0x4a9c25
mov eax, 1
ret
mov edx, dword [0x516880]
push edx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4a9c3b
mov eax, 1
ret
mov dl, byte [0x519bf9]
test dl, dl
je 0x4a9c4b
mov eax, 1
ret
mov edx, dword [0x517e34]
test edx, edx
je 0x4a9c7c
xor ecx, ecx
mov dword [0x517e34], ecx
mov byte [0x5f8e1e], 0
mov byte [0x5f8f9e], 0
mov byte [0x5f8fde], 0
call fcn.004a9f50
call fcn.00467be8
mov eax, dword [0x517e2c]
test eax, eax
je 0x4a9ca1
push 0
call fcn.004417a4
pop ecx
push 5
mov edx, dword [0x51688c]
push edx
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
mov dword [0x517e2c], 1
push 0
call fcn.004417a4
pop ecx
push 0
push 0
mov edx, dword [0x516888]
push edx
push 0x59acc0
call fcn.0040d780
add esp, 0x10
mov eax, 1
ret

Function at 0x4aa2fc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb80
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x17f
lea eax, [ebp - 0x180]
push eax
push esi
push ebx
call sub.USER32.dll_GetDlgItemTextA
push 0x17f
lea edx, [ebp - 0x300]
push edx
push edi
push ebx
call sub.USER32.dll_GetDlgItemTextA
push 0x5de193
push esi
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0x5de194
push edi
push ebx
call sub.USER32.dll_SetDlgItemTextA
lea ecx, [ebp - 0x480]
push ecx
lea eax, [ebp - 0x300]
push eax
lea edx, [ebp - 0x180]
push edx
call fcn.004a9fb8
add esp, 0xc
mov ebx, eax
mov eax, ebx
sub eax, 0xfffffffe
je 0x4aa3fd
dec eax
je 0x4aa38d
add eax, 0xfffffffe
sub eax, 2
jb 0x4aa440
jmp 0x4aa445
mov byte [0x517e30], 1
push 0x5de195
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [0x51688c]
push ecx
call sub.USER32.dll_SetDlgItemTextA
push 5
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [0x51688c]
push edx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x88b8
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [0x51688c]
push eax
call sub.USER32.dll_SetTimer
test byte [0x516434], 0x40
je 0x4aa3f9
lea edx, [ebp - 0x180]
push edx
push 0x5de1bb
push 0x516438
call fcn.00451598
add esp, 0xc
xor eax, eax
jmp 0x4aa447
mov byte [0x517e30], 1
lea edx, [ebp - 0x480]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [0x51688c]
push eax
call sub.USER32.dll_SetDlgItemTextA
test byte [0x516434], 0x40
je 0x4aa43c
lea edx, [ebp - 0x180]
push edx
push 0x5de1d2
push 0x516438
call fcn.00451598
add esp, 0xc
xor eax, eax
jmp 0x4aa447
call fcn.004a9d10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aa56c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb58
mov eax, 0x59b558
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d08c0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov ecx, dword [0x51a5dd]
cmp ecx, 0xebc
jne 0x4aa5b9
call fcn.00467be8
call fcn.004a9f50
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4aa723
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4aa5f9
push 0x400
lea ecx, [ebp - 0x428]
push ecx
push ebx
call sub.USER32.dll_GetWindowTextA
test byte [0x516434], 0x40
je 0x4aa640
lea eax, [ebp - 0x428]
push eax
push 0x5de1e8
push 0x516438
call fcn.00451598
add esp, 0xc
jmp 0x4aa640
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [0x516434], 0x40
je 0x4aa640
lea eax, [ebp - 0x428]
push eax
push 0x5de1f4
push 0x516438
call fcn.00451598
add esp, 0xc
lea edx, [ebp - 0x468]
lea ecx, [ebp - 0x428]
push edx
push 0x5de200
push ecx
call fcn.0041ba70
add esp, 0xc
test al, al
jne 0x4aa670
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4aa723
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x428]
push ecx
push 0x5de205
push eax
call fcn.0041ba70
add esp, 0xc
test al, al
jne 0x4aa6a0
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4aa723
lea ecx, [ebp - 0x428]
push ecx
lea eax, [ebp - 0x4a8]
push eax
lea edx, [ebp - 0x468]
push edx
call fcn.004a9fb8
add esp, 0xc
dec eax
sub eax, 2
jb 0x4aa6c5
jmp 0x4aa6d3
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4aa723
push 0x8400
lea ecx, [ebp - 0x428]
push ecx
push 0x5de20a
call fcn.00467990
add esp, 0xc
mov word [ebp - 0x14], 0
jmp 0x4aa717
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x4b4]
mov esi, dword [ebp - 0x4b0]
mov ebx, dword [ebp - 0x4ac]
pop ebp
ret
Function at 0x4ba0b4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 8]
inc byte [0x5c6618]
movsx eax, byte [0x5c6618]
cmp eax, 4
jle 0x4ba0d8
mov byte [0x5c6618], 1
movsx edx, byte [0x5c6618]
push edx
push 0x5e5f9f
lea ecx, [ebp - 0x20]
push ecx
call fcn.004d26c8
add esp, 0xc
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push 1
push eax
call fcn.00401260
push eax
call sub.USER32.dll_LoadImageA
mov esi, eax
push 0
push esi
push 0x170
push 0x2d3
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
push eax
call sub.USER32.dll_DestroyIcon
push 5
push 0x2f9
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
movsx eax, byte [0x5c6619]
push 0
push eax
push 0x402
push 0x2f9
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
inc byte [0x5c6619]
movsx edx, byte [0x5c6619]
cmp edx, 0x64
jle 0x4ba175
mov byte [0x5c6619], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bd9e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call fcn.00401270
mov edx, eax
sub edx, dword [0x5c6d5c]
cmp edx, 0x1388
jae 0x4bda0c
mov eax, 1
pop ebx
pop ebp
ret
mov dword [0x5c6d5c], eax
call fcn.004bd9ac
mov ecx, dword [ebp + 0xc]
dec ecx
je 0x4bda27
dec ecx
je 0x4bda4e
dec ecx
je 0x4bda5e
dec ecx
je 0x4bda6c
jmp 0x4bda6c
push ebx
call fcn.0040f240
pop ecx
push 6
push ebx
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_MessageBeep
push 9
push ebx
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4bda6c
push ebx
call fcn.0040f240
pop ecx
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4bda6c
push ebx
call fcn.0040f240
pop ecx
push 0
call sub.USER32.dll_MessageBeep
call fcn.004bd9c8
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x4c1a30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
cmp byte [ebp + 8], 0
je 0x4c1abb
push 0
push 0x2001
push 0x5e7da8
lea eax, [ebp - 0x104]
push eax
call fcn.00453684
add esp, 0x10
mov dl, byte [ebp + 0xc]
test dl, dl
je 0x4c1a77
push 0x5e7db4
lea ecx, [ebp - 0x104]
push ecx
call fcn.004cdf10
add esp, 8
jmp 0x4c1a8b
push 0x5e7dbe
lea eax, [ebp - 0x104]
push eax
call fcn.004cdf10
add esp, 8
test byte [0x516435], 2
je 0x4c1aad
lea edx, [ebp - 0x104]
push edx
push 0x5e7dc6
push 0x516438
call fcn.00451598
add esp, 0xc
push 5
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.dll_WinExec
mov esp, ebp
pop ebp
ret

Function at 0x4c5630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4c5639
add esp, 4
mov eax, dword [ebp - 4]
lea eax, [ebp - 0x2000]
push ebx
mov ebx, dword [ebp + 8]
push 0x2000
push eax
push 0x3e7
push ebx
call sub.USER32.dll_GetDlgItemTextA
mov dl, byte [ebp - 0x2000]
test dl, dl
je 0x4c5682
push 0x5e8783
lea ecx, [ebp - 0x2000]
push ecx
call fcn.004cdf10
add esp, 8
push 0x5e8786
lea eax, [ebp - 0x2000]
push eax
call fcn.004cdf10
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x2000]
push ecx
call fcn.004cdf10
add esp, 8
lea eax, [ebp - 0x2000]
push eax
push 0x3e7
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x3e7
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x7c8
push ebx
call sub.USER32.dll_KillTimer
push 0
push 0xbb8
push 0x7c8
push ebx
call sub.USER32.dll_SetTimer
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret