joyce8/EMBER2024-capa huggingface dataset:
Function at 0x596d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x218
mov eax, 0x60c068
call fcn.004db4be
mov eax, edx
mov ebx, ecx
cmp eax, 0xffffffff
jne 0x596d2c
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x596d2c
xor eax, eax
jmp 0x596ea5
test al, 0x10
je 0x596d38
push 6
pop eax
jmp 0x596ea5
push 0x2e
push dword [ebx]
call fcn.004e0fe2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x596ea2
push str..lnk
push esi
call fcn.005144ec
pop ecx
pop ecx
push 3
pop edi
test eax, eax
jne 0x596e12
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x220]
push dword [ebx]
call fcn.004717c9
test eax, eax
je 0x596df7
sub esp, 0xc
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x220]
push eax
call fcn.0047181f
test eax, eax
je 0x596df7
lea eax, [ebp - 0x21c]
push eax
call fcn.00505bb3
pop ecx
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov ecx, ebx
call fcn.0040f513
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x596dc5
xor esi, esi
jmp 0x596dcc
test al, 0x10
je 0x596dea
push 6
pop esi
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x596de3
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x596ea5
push 0x2e
push dword [ebx]
call fcn.004e0fe2
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x596e0a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
je 0x596ea2
push esi
lea ecx, [ebp - 0x224]
call fcn.0040d2ee
mov esi, dword [ebp - 0x224]
push 0x636670
push esi
call fcn.005144ec
pop ecx
pop ecx
test eax, eax
je 0x596e7e
push str..zip
push esi
call fcn.005144ec
pop ecx
pop ecx
test eax, eax
jne 0x596e4a
push 4
jmp 0x596e7d
push 0x63aa30
push esi
call fcn.005144ec
pop ecx
pop ecx
test eax, eax
je 0x596e46
mov edx, esi
call fcn.005d56a9
test eax, eax
je 0x596e6a
push 5
jmp 0x596e7d
cmp dword [ebp + 8], 0
je 0x596e92
mov edx, esi
call fcn.005d56b4
test eax, eax
je 0x596e92
push 2
pop edi
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x596e8e
call fcn.00407965
mov eax, edi
jmp 0x596ea5
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x596ea2
call fcn.00407965
xor eax, eax
inc eax
call fcn.004db46d
ret
Function at 0x596eb0
Capabilities:
Set current directory

Disassembly:
push 0x278
mov eax, 0x60c0c3
call fcn.004db52a
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [ebx + 0x2c], 1
test esi, esi
jne 0x596ed5
xor edi, edi
mov eax, edi
jmp 0x596ede
push esi
call fcn.00505bb3
pop ecx
xor edi, edi
push esi
push eax
lea ecx, [ebx + 0x14]
call fcn.0040f513
push 0x2e
push esi
mov dword [ebp - 4], edi
call fcn.004e0fe2
mov dword [ebp - 0x22c], eax
pop ecx
pop ecx
test eax, eax
je 0x5970b5
push 0x63ab14
push eax
call fcn.005144ec
pop ecx
pop ecx
test eax, eax
jne 0x596f22
push edi
push esi
mov ecx, ebx
call fcn.00595160
jmp 0x5970b7
push str..m3u
push dword [ebp - 0x22c]
call fcn.005144ec
pop ecx
pop ecx
test eax, eax
jne 0x596f46
push edi
push esi
mov ecx, ebx
call fcn.00593b90
jmp 0x5970b7
push str..m3u8
push dword [ebp - 0x22c]
call fcn.005144ec
pop ecx
pop ecx
test eax, eax
jne 0x596f69
push 0xfde9
jmp 0x596f39
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], edi
push eax
lea eax, [ebp - 0x224]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [ebp - 0x224]
push 0x5c
push eax
call fcn.004e0fe2
pop ecx
pop ecx
test eax, eax
je 0x596fb0
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0040d36e
lea ecx, [ebp - 0x25c]
mov dword [ebp - 4], 2
call fcn.005cb530
push ecx
push ebx
lea ecx, [ebp - 0x284]
call fcn.00473299
mov edx, dword [ebx + 0x14]
mov eax, ecx
push edi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x23c], eax
call fcn.00407a7f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x25c]
mov dword [esp], 0xfde9
push dword [eax]
call fcn.005cb475
mov ecx, dword [ebp - 0x234]
test al, al
mov esi, 0x668010
sete byte [ebp - 0x225]
add ecx, 0xfffffff4
cmp ecx, esi
je 0x59702d
call fcn.00407965
lea ecx, [ebp - 0x284]
call fcn.00473c92
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x25c], 0x636404
call fcn.005cb049
cmp byte [ebp - 0x225], 0
je 0x597063
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff4
cmp ecx, esi
jmp 0x5970ae
mov esi, dword [ebp - 0x22c]
cmp dword [esi - 8], edi
je 0x59707d
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebx + 0x10]
call fcn.0040d242
mov ecx, ebx
call fcn.004741f0
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x597094
call fcn.00407965
xor eax, eax
inc eax
jmp 0x5970b7
je 0x5970b5
call fcn.00407965
xor eax, eax
call fcn.004db47c
ret 4
Function at 0x5997cb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx esi, word [eax + 0xc]
cmp esi, 0x2e
jne 0x5997f5
push 0
push 0x7f13
push 0x111
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x59981d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, 0xfffe
je 0x59981d
or esi, 0x20
cmp si, 0x61
jne 0x59981d
push 0xb
push 2
push 0xffffffffffffffff
lea ecx, [edi + 0x5a8]
call fcn.00429dec
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x59d331
Capabilities:
Get disk information

Disassembly:
push 0x5c
mov eax, 0x60cadc
call fcn.004db4be
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
xor esi, esi
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x58], ebx
push esi
push eax
call fcn.004e0bc0
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.0044bf1f
xor edx, edx
mov dword [ebp - 4], esi
inc edx
mov edi, esi
mov dword [ebp - 0x54], edx
xor eax, eax
mov ecx, edi
inc eax
shl eax, cl
test ebx, eax
je 0x59d3b8
lea eax, [edi + 0x41]
push eax
lea eax, [ebp - 0x50]
push str._c:_
push eax
call fcn.00445d3c
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x59d3b5
lea ebx, [edi + 0x41]
push ebx
call fcn.0059d3ea
cmp eax, 1
jne 0x59d3cd
push ebx
lea ecx, [ebp - 0x68]
call fcn.0044bf51
mov ebx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
inc edi
cmp edi, 0x20
jb 0x59d36c
cmp dword [ebp - 0x64], 0
ja 0x59d3da
test edx, edx
jne 0x59d3d7
xor esi, esi
inc esi
jmp 0x59d3da
mov ebx, dword [ebp - 0x58]
mov edx, esi
mov dword [ebp - 0x54], edx
jmp 0x59d3b8
push 2
pop esi
lea ecx, [ebp - 0x68]
call fcn.0044bf8d
mov eax, esi
call fcn.004db46d
ret

Function at 0x59d3ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x50
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.004e0bc0
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x54]
push str._c:_test.txt
push eax
call fcn.00445d79
lea eax, [ebp - 0x54]
push 0x6396b8
push eax
call fcn.00506f56
add esp, 0x20
test eax, eax
je 0x59d445
push eax
call fcn.00506850
pop ecx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
jmp 0x59d447
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da623
leave
ret 4
Function at 0x5a1c2c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 8], ecx
lea eax, [esi + edi]
mov dword [ebp - 0x14], eax
cmp esi, eax
jge 0x5a1cb7
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add edx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
cmp ecx, edx
jge 0x5a1cac
cmp ebx, edi
mov ecx, edi
mov edi, dword [ebp + 0x10]
cmovl ecx, ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x24], edi
mov eax, edi
push 0xcc0020
push dword [ebp + 0x1c]
cmovl eax, dword [ebp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push ecx
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add ebx, dword [ebp + 0x24]
sub edi, dword [ebp + 0x24]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ebx, edx
jl 0x5a1c6c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add esi, ebx
sub edi, ebx
mov dword [ebp + 0xc], edi
cmp esi, eax
jl 0x5a1c55
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5a1d9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x6714c8]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
and dword [ebp - 0xc], 0
mov edi, eax
lea eax, [ebp - 0xc]
movzx esi, si
push eax
push 0x5a1f3e
push esi
push 0xf0
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov eax, 0x804
cmp word [ebp - 0xc], ax
jne 0x5a1df1
mov edi, 0x3a8
jmp 0x5a1e00
mov ecx, 0x404
cmp word [ebp - 0xc], cx
lea eax, [ecx - 0x4e]
cmove edi, eax
push 0xf0
push esi
push ebx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5a1f2a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x5a1f2a
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x5a1f1e
mov esi, 0x180
lea edx, [esi - 0x3d]
movzx eax, word [ebx]
test ax, ax
je 0x5a1f1b
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], eax
movzx eax, word [ebx + 2]
add ebx, 8
mov dword [ebp - 0x18], ecx
cmp ax, si
je 0x5a1ec9
mov ecx, 0x401
cmp ax, cx
je 0x5a1ec9
cmp ax, dx
je 0x5a1e82
add ecx, 2
cmp ax, cx
jne 0x5a1f0f
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
call fcn.0053eb10
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
push edi
push 0
push 0x143
movzx eax, ax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov esi, 0x180
jmp 0x5a1f0a
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
call fcn.0053eb10
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov esi, 0x180
push edi
push 0
push esi
movzx eax, ax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov edx, 0x143
mov edi, dword [ebp - 8]
add ebx, dword [ebp - 0x18]
jne 0x5a1e46
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
jmp 0x5a1f2c
xor eax, eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da623
leave
ret
Function at 0x5a1fc4
Capabilities:
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x5a206e
xor eax, eax
cmp word [esi], ax
je 0x5a206e
push ebx
push edi
push 0x5c
pop ebx
push ebx
push esi
call fcn.004e115a
pop ecx
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x5a202f
movzx eax, word [esi + 2]
cmp eax, 0x3a
jne 0x5a2005
cmp word [esi + 4], bx
je 0x5a2021
cmp word [esi], bx
jne 0x5a202f
cmp ax, bx
jne 0x5a202f
lea eax, [edi + 4]
push ebx
push eax
call fcn.004e115a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5a2038
lea eax, [edi + 2]
push ebx
push eax
call fcn.004e115a
pop ecx
pop ecx
mov edi, eax
test edi, edi
je 0x5a2038
xor eax, eax
mov word [edi], ax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x5a2055
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x5a2060
mov word [edi], bx
test eax, eax
jne 0x5a2021
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
pop ebx
and eax, 0x10
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5a9239
Capabilities:
Check os version
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x140]
push eax
mov esi, edx
mov dword [ebp - 0x140], 0x11c
mov ebx, ecx
call edi
test eax, eax
jne 0x5a9283
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x114
push eax
call edi
cmp dword [ebp - 0x13c], 6
jb 0x5a92ec
lea eax, [ebp - 0x24]
push str.runas
push eax
call fcn.00504cbe
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x17c]
push 0
push eax
call fcn.004e0bc0
and dword [ebp - 0x160], 0
lea eax, [ebp - 0x24]
add esp, 0x14
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], esi
push eax
mov dword [ebp - 0x178], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x5a92f3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004da623
leave
ret
Function at 0x5a9c01
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
mov esi, ecx
push 0
push 0x188
mov dword [ebp - 4], esi
push dword [esi + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5a9d1f
push edi
push ebx
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.005aa0e1
mov esi, dword [ebp - 0xc]
mov eax, dword [0x668294]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push dword [esi + 0x10]
push 0x81a7
push eax
call fcn.0041c926
mov eax, dword [ebp - 4]
add esp, 0xc
mov edi, dword [ebp - 8]
push 0x24
push dword [0x674764]
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x5a9d07
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
push 0
push ebx
push 0x199
push dword [eax + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5a9caf
mov ecx, eax
call fcn.004878ba
push 0x24
push dword [ebp - 0xc]
call fcn.004dadca
pop ecx
pop ecx
mov eax, dword [ebp - 4]
push 0
push ebx
push 0x182
push dword [eax + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
push 0
push 0
push 0x18b
push dword [eax + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp ebx, eax
push ecx
cmovge ebx, ecx
push ebx
mov ebx, dword [ebp - 4]
push 0x186
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x10428
push 0x111
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [edi - 0xc]
pop edi
cmp ecx, 0x668010
je 0x5a9d18
call fcn.00407965
mov ecx, esi
call fcn.00416f38
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x5ac126
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov edx, 0x102
push edi
mov dword [ebp - 0x1c], esi
lea ebx, [esi + 4]
mov ecx, dword [ebx]
call fcn.005b3ac6
push 0x49d
push dword [ebx]
lea edi, [esi + 0x5c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x81ee
mov dword [edi], eax
mov eax, dword [0x668294]
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
call fcn.0041129f
mov esi, dword [ebp - 0x18]
mov ecx, edi
push esi
push 0
call fcn.0048a76b
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5ac192
call fcn.00407965
mov eax, dword [0x668294]
push 0x81ef
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
call fcn.0041129f
mov esi, dword [ebp - 0x18]
mov ecx, edi
push esi
push 1
call fcn.0048a76b
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5ac1c5
call fcn.00407965
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x14]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x5c]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0040390c
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1328
push dword [esi + 0x5c]
call edi
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
lea ecx, [esi + 0x60]
call fcn.00489cf5
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
lea ecx, [esi + 0x84]
call fcn.00489c97
push 5
push dword [esi + 0x64]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
mov eax, dword [ebp - 0x1c]
push 0
push dword [eax + 0x88]
call esi
mov esi, dword [0x6751d8]
add esi, 0x88e
push esi
push ecx
push ecx
mov ecx, ebx
call fcn.00480648
push 0
push esi
push 0x111
push dword [ebx]
call edi
push dword [0x6751dc]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x85f
push dword [ebx]
call esi
push 0
push dword [0x6751e0]
push 0x860
push dword [ebx]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push dword [0x6751e4]
push 0x888
push dword [ebx]
call esi
push dword [0x6751e8]
push 0x889
push dword [ebx]
call esi
push dword [0x673cd8]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
push 0x87d
push dword [ebx]
call esi
push dword [0x673cdc]
push 0x880
push dword [ebx]
call esi
push 0x881
push dword [ebx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
mov dword [ebx + 0xa8], eax
call fcn.005ac2fd
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
inc eax
xor ecx, ebp
pop esi
mov dword [ebx + 0xac], eax
pop ebx
call fcn.004da623
leave
ret 0x10
Function at 0x5ac330
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x17e
push edi
mov edi, ecx
jne 0x5ac36c
push 0
push 1
push 0x130c
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [edi + 0x64]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x88]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5ac386
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebp
ret 4

Function at 0x5ac61d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, ecx
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea edi, [eax + 4]
push 0
mov ecx, edi
call fcn.00403895
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x49a
push dword [edi]
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x10005
push 0
push 0x465
push eax
call esi
push 0x3ff
push dword [edi]
call ebx
push 0
push 0
push dword [0x67329c]
push eax
call esi
test eax, eax
je 0x5ac68a
push 0xc0c0c0
push ecx
push 0x3ff
mov ecx, eax
call fcn.0040f15b
push 0x498
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x673d24]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
push 0x49e
push dword [edi]
call esi
push dword [0x673d18]
push 0x497
push dword [edi]
call esi
push dword [0x673d1c]
push 0x498
push dword [edi]
call esi
push dword [0x673d20]
push 0x49c
push dword [edi]
call esi
push dword [0x673d14]
push 0x49b
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor esi, esi
inc esi
push esi
push dword [0x673d28]
push 0x499
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, dword [ebp - 4]
pop edi
mov dword [eax + 0x20], esi
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x5ac8f3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], eax
push edi
push dword [ebp + 0x10]
lea esi, [eax + 4]
push 0
mov ecx, esi
call fcn.00403895
mov eax, dword [0x673d08]
mov ecx, 0x258
push dword [0x673cfc]
cmp eax, ecx
mov dword [0x673ce4], edi
push 0x8cb
cmovb eax, ecx
mov ecx, 0x7d0
cmp eax, ecx
cmova eax, ecx
mov dword [0x673d08], eax
push dword [esi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push edi
push dword [0x673d08]
push 0x8cc
push dword [esi]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x8cd
push dword [esi]
call edi
push 0x25807d0
push 0
push 0x465
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x673ce0]
push 0x8c9
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
call esi
push dword [0x673ce4]
mov eax, dword [ebp - 4]
push 0x8ca
push dword [eax + 4]
call esi
mov eax, dword [ebp - 4]
push 0x8cc
push dword [eax + 4]
call edi
push dword [0x673ce4]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
mov eax, dword [ebp - 4]
push 0x3ff
push dword [eax + 4]
call edi
push dword [0x673ce4]
push eax
call esi
mov esi, dword [ebp - 4]
push 0x8ca
push dword [esi + 4]
call edi
xor edi, edi
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x673d30], edi
jne 0x5aca0c
push 1
push 0x48d
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
call esi
push edi
jmp 0x5aca1f
push edi
push 0x48d
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_CheckDlgButton]
call esi
push 1
mov eax, dword [ebp - 4]
push 0x48e
push dword [eax + 4]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 0x20], 1
xor eax, eax
leave
ret 0x10

Function at 0x5ad435
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push dword [ebx + 0x64]
call esi
test eax, eax
je 0x5ad4ec
push dword [ebx + 0x174]
call esi
test eax, eax
je 0x5ad4ec
push edi
xor esi, esi
push esi
push esi
push 0x130b
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x5ad4b2
push dword [ebx + 0x174]
call esi
push 5
push dword [ebx + 0x64]
call esi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7e5
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push eax
call esi
push 0x7e8
push dword [ebx + 4]
call edi
push 1
jmp 0x5ad4e8
push dword [ebx + 0x64]
call esi
push 5
push dword [ebx + 0x174]
call esi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7e5
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push eax
call esi
push 0x7e8
push dword [ebx + 4]
call edi
push 0
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc