joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8bd4
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
dec eax
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4c8d35
dec eax
je 0x4c8d31
sub eax, 0xffff
je 0x4c8c9c
dec eax
jne 0x4c8d31
cmp dword [ebx + 0x24], 3
jne 0x4c8d31
lea eax, [ebp - 0x14]
push eax
push 0
push 0x41a
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
dec dword [ebp - 8]
dec dword [ebp - 0xc]
inc dword [ebp - 0x14]
inc dword [ebp - 0x10]
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
push eax
push 0
movsd dword es:[edi], dword [esi]
push 0x419
push dword [ebx]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x666666
mov dword [ebp - 0x1c], eax
call esi
mov edi, dword [sym.imp.USER32.dll_FillRect]
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x10]
call edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x3f8500
call esi
mov esi, eax
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x10]
call edi
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 4
jmp 0x4c8d37
mov eax, dword [ebx + 0x24]
cmp eax, 2
jne 0x4c8d28
lea eax, [ebx + 0x14]
mov esi, eax
mov edi, 0x88f5f4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x42
mov ecx, 0x88f800
movsd dword es:[edi], dword [esi]
call fcn.00466ada
mov edi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
xor esi, esi
sub eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 3
push esi
push esi
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x4c8c95
cmp eax, 3
jne 0x4c8d31
push 0x14
jmp 0x4c8d37
xor eax, eax
jmp 0x4c8d38
push 0x30
pop eax
mov ecx, dword [ebp - 4]
or dword [ecx + 8], 0x40
pop edi
pop esi
mov dword [0x56bfa8], eax
pop ebx
leave
ret 4
Function at 0x4ca1bb
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push edi
mov ebx, edx
call sub.msvcrt.dll__waccess
pop ecx
pop ecx
test eax, eax
je 0x4ca1e1
xor al, al
jmp 0x4ca27f
cmp ebx, esi
je 0x4ca25f
push 0x230
lea eax, [ebp - 0x230]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x118
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp + eax*2 - 0x230]
push eax
mov eax, 0x534810
call fcn.004c9d65
push ebx
push edi
push 0x5347f4
lea eax, [ebp - 0x668]
push 0x438
push eax
call fcn.0049f973
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00466ca2
add esp, 0x1c
push 1
push esi
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x230]
push eax
jmp 0x4ca264
push 1
push esi
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
mov eax, ecx
xor ecx, ecx
cmp eax, esi
sete cl
mov al, cl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ca9a3
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x260
push ebx
push ebp
push esi
movzx esi, byte [0x88f8a3]
xor ebx, ebx
neg esi
push edi
mov edi, ecx
mov ecx, dword [0x88f9bc]
sbb esi, esi
mov byte [esp + 0x13], bl
and esi, 4
mov dword [esp + 0x14], ebx
call fcn.0049a515
mov ebp, eax
mov dword [esp + 0x18], ebp
call fcn.004a2796
mov ecx, eax
call fcn.004a26ed
mov edx, eax
mov ecx, ebp
call fcn.004b6a50
test al, al
je 0x4caa16
push 0x5349f8
call fcn.004263e6
pop ecx
mov ecx, dword [esp + 0x18]
mov dl, 1
call fcn.00479b79
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x260
ret 4
lea eax, [esp + 0x20]
push eax
mov edx, 0x5349e0
mov ecx, ebp
call fcn.004b7a3f
mov ecx, eax
call fcn.0049e702
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x4caaec
test byte [esp + 0x20], 0x10
jne 0x4caac4
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x4c]
call fcn.004b7a3f
push ebx
push ebx
push 3
push ebx
push ebx
mov ebp, eax
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4caaa6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc byte [edi + 0xb9]
push ebx
push 2
push ebx
push ebx
push ebx
mov ecx, ebp
call fcn.0042876e
push eax
push 0x4ca925
push ebx
mov edx, esi
push ebx
or edx, 0x100
mov ecx, ebp
call fcn.00426e8f
inc dword [esp + 0x14]
jmp 0x4caaab
mov byte [esp + 0x13], 1
mov dl, 1
mov ecx, ebp
call fcn.00479b79
cmp byte [edi + 0xb9], 0x19
jae 0x4caadd
cmp dword [esp + 0x14], 0x64
jae 0x4caadd
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4caa42
jmp 0x4caae2
mov byte [esp + 0x13], 1
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0x13]
jmp 0x4ca9fc
Function at 0x4caaf5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
push dword [esi + 4]
call edi
cmp byte [0x88f988], 0
mov eax, dword [esi + 4]
push 0x1bc
push eax
je 0x4cab2f
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x20]
push ecx
push eax
call edi
jmp 0x4cab42
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
and dword [esi + 0x64], 0
lea edx, [esi + 0x60]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x14]
mov dword [esi + 0x6c], eax
mov esi, dword [esi + 0x40]
test esi, esi
je 0x4cab6c
mov ecx, dword [esi + 4]
call fcn.00476058
pop edi
pop esi
leave
ret

Function at 0x4cadea
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4cadaa
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
cmp dword [ebp - 4], 2
setle al
leave
ret

Function at 0x4cb81a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x88f7d0], 0
push esi
mov esi, ecx
je 0x4cb8bf
push esi
lea eax, [ebp - 8]
push 0x534b44
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
mov ecx, eax
call fcn.0049e627
push eax
call sub.msvcrt.dll__wputenv
pop ecx
lea ecx, [ebp - 8]
call fcn.004a0c7d
push esi
lea eax, [ebp - 8]
push 0x534b34
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
mov ecx, eax
call fcn.0049e627
push eax
call sub.msvcrt.dll__wputenv
pop ecx
lea ecx, [ebp - 8]
call fcn.004a0c7d
push esi
lea eax, [ebp - 4]
push 0x5282c4
push eax
mov byte [0x567de4], 0
call fcn.004a1618
add esp, 0xc
push 0
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop esi
leave
ret

Function at 0x4cb91b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
lea eax, [ebp - 0x618]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x618]
push eax
push 0x514a20
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0049f973
lea eax, [ebp - 0x618]
push eax
push 0x5103ec
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0049f973
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x20
cmp word [ebp - 0x410], 0
mov edi, 0x534c00
je 0x4cb9aa
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
jne 0x4cb9aa
call esi
push eax
lea eax, [ebp - 0x410]
push eax
push edi
call fcn.00466ca2
add esp, 0xc
cmp word [ebp - 0x208], 0
je 0x4cb9d4
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
jne 0x4cb9d4
call esi
push eax
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.00466ca2
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d4916
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 5
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x58]
mov ecx, dword [esi + 0x4c]
push 0x254
sub edx, eax
push edx
mov edx, dword [esi + 0x54]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret

Function at 0x4d6f59
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x80]
push edi
call fcn.0046446d
lea edi, [esi + 0x124]
add esi, 0x120
mov eax, dword [esi]
cmp eax, dword [edi]
je 0x4d6f87
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
mov dword [esi], eax
pop edi
pop esi
ret

Function at 0x4d6f8a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x120]
push edi
mov edi, dword [esp + 0xc]
cmp edi, ecx
je 0x4d7052
mov eax, dword [esi + 0xcc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
cmp edi, eax
je 0x4d6fb6
cmp ecx, eax
jne 0x4d6fc8
xor ecx, ecx
cmp edi, eax
sete cl
push 0
push ecx
push 0x8084
push eax
call ebx
mov eax, dword [esi + 0xd0]
cmp edi, eax
je 0x4d6fda
cmp dword [esi + 0x120], eax
jne 0x4d6fec
xor ecx, ecx
cmp edi, eax
sete cl
push 0
push ecx
push 0x8086
push eax
call ebx
mov eax, dword [esi + 0x120]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp eax, dword [esi + 0x124]
jne 0x4d7011
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x4d7011
call fcn.0046447a
jmp 0x4d7045
mov ecx, dword [esi + 0xc8]
cmp eax, ecx
jne 0x4d703b
cmp edi, ecx
je 0x4d703b
call fcn.004ba25f
test al, al
je 0x4d703b
push 0
push 0
push 0x806e
push dword [esi + 0xc8]
call ebx
jmp 0x4d7045
push 0
push dword [esi + 0x120]
call ebp
push 5
push edi
call ebp
pop ebp
mov dword [esi + 0x120], edi
pop ebx
pop edi
pop esi
ret 4

Function at 0x4d7578
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x80]
test eax, eax
je 0x4d7591
cmp dword [eax], 0
je 0x4d7591
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4d83c0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 0xc]
cmp dword [esi], 1
mov dword [ebp - 4], ecx
jne 0x4d843f
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [esi + 8]
push 0x419
push dword [ecx + 0xb0]
call ebx
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4d843e
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push ecx
push 0x417
push dword [eax + 0xb0]
call ebx
mov eax, dword [esi + 0x1c]
push 0
push dword [esi + 0x20]
sub eax, 0xc
push eax
push dword [esi + 0x18]
push dword [ebp - 0x18]
push dword [0x8905e4]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4d957d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8905d4]
mov eax, dword [eax + 4]
sub esp, 0x14
push ebx
push esi
push edi
push 0x1b
push eax
mov edi, ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov ecx, ebx
call fcn.0042ff71
mov esi, eax
cmp esi, 0xffffffff
je 0x4d9666
cmp dword [edi + 0x3f0], esi
jne 0x4d9666
push 0xd
push ebx
mov ecx, edi
call fcn.004d77f4
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x1038
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cmp eax, 0x41
jle 0x4d95f3
add eax, 0xffffffbf
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
jmp 0x4d95f7
and dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push dword [ebx + 4]
lea eax, [ebp - 0x14]
push dword [ebx]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4d9666
mov eax, dword [edi + 0x60]
mov esi, dword [eax + esi*4]
cmp dword [esi + 0x1c], 0
jne 0x4d9666
cmp dword [esi + 0x150], 0
jne 0x4d9666
mov eax, dword [ebx]
sub eax, dword [ebp - 4]
push 0xd
sub eax, dword [ebp - 0x14]
pop ecx
add eax, 0xa
cdq
idiv ecx
mov edi, eax
test edi, edi
jge 0x4d963b
xor edi, edi
cmp edi, 5
jle 0x4d9643
push 5
pop edi
call fcn.0047cfd9
mov esi, dword [esi + 0xc4]
mov ecx, esi
call fcn.004a3a85
test al, al
je 0x4d9661
push edi
mov ecx, esi
call fcn.00410851
call fcn.0047cff8
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4daaa6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, ecx
call fcn.004da9fb
lea eax, [esi + ebx*4 + 0x154]
mov edi, dword [eax]
mov dword [ebp - 4], eax
test edi, edi
jne 0x4dab2b
cmp ebx, 7
ja case.default.0x4daad3
jmp dword [ebx*4 + 0x4dab9a]
mov ecx, esi
call fcn.004f1456
jmp 0x4dab20
mov ecx, esi
call fcn.004f644e
jmp 0x4dab20
mov ecx, esi
call fcn.004f264b
jmp 0x4dab20
mov ecx, esi
call fcn.004f2b82
jmp 0x4dab20
mov ecx, esi
call fcn.004ef952
jmp 0x4dab20
mov ecx, esi
call fcn.004f59a2
jmp 0x4dab20
mov ecx, esi
call fcn.004f1c7e
jmp 0x4dab20
mov ecx, esi
call fcn.004f3dc4
mov edi, eax
test edi, edi
je case.default.0x4daad3
mov eax, dword [ebp - 4]
mov dword [eax], edi
mov eax, dword [esi + 0x144]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4dab42
push 0
push dword [eax + 4]
call ebx
mov ecx, esi
mov dword [esi + 0x144], edi
call fcn.004d5e66
mov eax, dword [ebp + 8]
mov dword [0x88f9d8], eax
lea eax, [ebp - 0x14]
push eax
push 0x1a
mov ecx, esi
call fcn.004764bc
push 2
pop ecx
call fcn.00475719
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004d6ecc
mov ecx, dword [ebp + 8]
call fcn.00475889
mov eax, dword [esi + 0x144]
push 5
push dword [eax + 4]
call ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4dc7f5
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edi
test eax, eax
je 0x4dc839
mov dword [eax], ecx
mov edx, dword [esi + 0x3c8]
cmp eax, edx
jne 0x4dc839
cmp byte [esi + 0x3c0], 0
jne 0x4dc839
lea edi, [esi + 0x120]
mov eax, dword [edi]
cmp eax, dword [edx]
je 0x4dc841
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x3c8]
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x4dc841
push ecx
mov ecx, esi
call fcn.004d5bbf
mov ecx, esi
call fcn.004dac4d
pop edi
pop esi
ret 4
Function at 0x4e4a6b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
inc ecx
mov edx, ecx
call fcn.004050b5
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4e4b61
mov eax, dword [ebp + 8]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [edi + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [edi + 4]
push 0x67c
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
mov ecx, edi
push dword [ebp - 8]
call fcn.004d7410
test eax, eax
je 0x4e4b61
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
mov eax, dword [eax]
cmp eax, ebx
je 0x4e4b40
xor ecx, ecx
cmp byte [eax], bl
sete cl
cmp cl, bl
jne 0x4e4b40
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
cmp eax, 2
jne 0x4e4b40
mov eax, dword [esi]
push 3
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x50]
mov edx, eax
lea ecx, [ebp + 8]
call fcn.004a1636
push 1
push ebx
push ebx
lea ecx, [ebp + 8]
call fcn.004a0ff9
push eax
push 0x510edc
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
mov ecx, edi
call fcn.004d7443
lea ecx, [ebp + 8]
call fcn.004a0c7d
jmp 0x4e4b61
cmp byte [edi + 0x3c0], bl
jne 0x4e4b61
mov eax, dword [esi]
push 3
mov ecx, esi
call dword [eax + 0x10]
push esi
mov ecx, edi
call fcn.004d7443
push esi
mov ecx, edi
call fcn.004e3a45
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4e6bbc
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x8906fc]
test eax, eax
je 0x4e6bcf
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x9c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4e6bea
mov ecx, eax
call fcn.004e66ad
mov esi, eax
jmp 0x4e6bec
xor esi, esi
push 0
push 0x25
mov ecx, esi
call fcn.00476bc9
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x4e817a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov esi, ecx
lea ecx, [esi + 0x28]
call fcn.004764bc
mov eax, dword [esi + 0x68]
mov ecx, dword [ebp + 8]
mov edi, dword [eax + ecx*4]
movzx eax, word [ebp + 0xc]
mov esi, dword [esi + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0xfe
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
xor esi, esi
push esi
push dword [0x56bf8c]
push esi
push edi
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x210]
push dword [ebp - 0x10]
push 0x50010000
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push 0x537e44
push eax
call fcn.004a1618
add esp, 0x10
mov ecx, eax
call fcn.004a0ff9
push eax
push 0x510ecc
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea ecx, [ebp + 0xc]
call fcn.004a0c7d
pop edi
pop esi
leave
ret 0x10

Function at 0x4eb0a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x8907f8]
push esi
push edi
mov edi, ecx
test eax, eax
je 0x4eb0be
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [0x8907f8]
jmp 0x4eb0f0
push 0x1c0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4eb0d8
mov ecx, eax
call fcn.004eaaa9
mov esi, eax
jmp 0x4eb0da
xor esi, esi
push 0
push 0x13
mov ecx, esi
call fcn.00476bc9
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 0xffffffff
je 0x4eb0fd
push edi
mov ecx, esi
call fcn.004e7a98
pop edi
pop esi
ret

Function at 0x4eb1d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, ecx
push edi
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
mov ecx, ebx
call fcn.004771d8
mov eax, dword [ebp - 8]
xor edi, edi
cmp eax, edi
jne 0x4eb224
push 0xfe
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push edi
push dword [0x56bf8c]
push edi
push ebx
push ecx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x18]
or ecx, 0x50010000
push ecx
push eax
push 0x510ecc
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x4eb270
push edi
push edi
push 0x31
push dword [ebp - 4]
call esi
push edi
push eax
push 0x30
push ebx
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4eb539
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
movzx esi, dx
push 0
mov ebx, ecx
push esi
push ebx
call edi
xor edx, edx
mov ecx, eax
call fcn.004eb1d8
push esi
push ebx
mov ebp, eax
call edi
test ebp, ebp
je 0x4eb56e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4ecf4f
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x28]
lea edx, [eax + 1]
cmp edx, 2
jne 0x4ecf5f
jmp fcn.004ebb4f
test eax, eax
jne 0x4ecf64
inc eax
push 0
push 3
mov dword [ecx + 0x28], eax
pop edx
mov ecx, eax
call fcn.004ebf58
ret 4
Function at 0x4ed6bb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x890914]
test eax, eax
je 0x4ed6d3
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
leave
ret
cmp byte [0x890910], 0
jne 0x4ed6f2
mov edx, 0x538920
mov ecx, 0x890840
call fcn.00446dec
mov byte [0x890910], 1
push 0x27c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4ed70c
mov ecx, eax
call fcn.004ec5e9
mov ecx, eax
jmp 0x4ed70e
xor ecx, ecx
push esi
push 0
push 0xf8
mov dword [0x890914], ecx
call fcn.00476bc9
mov eax, dword [0x890914]
mov esi, dword [eax + 4]
push dword [0x896c14]
lea eax, [ebp - 4]
push eax
call fcn.004a1618
pop ecx
pop ecx
mov ecx, eax
call fcn.004a0ff9
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 4]
call fcn.004a0c7d
mov eax, dword [0x890914]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
leave
ret

Function at 0x4edcdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call fcn.005017e0
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push edi
mov edi, ecx
mov ecx, dword [eax + 8]
cmp ecx, 0xfffffffe
je 0x4edd00
cmp ecx, 0xfffffffc
jne 0x4edd4f
add eax, 0xc
push 0x10b8
push eax
lea eax, [ebp - 0x10b8]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 4]
add esp, 0xc
push 0x5c8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], eax
jne 0x4edd4f
xor eax, eax
cmp dword [ebp - 0x10b4], eax
jne 0x4edd4f
push 5
push eax
push eax
lea ecx, [ebp - 0x1048]
push ecx
push 0x510edc
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
leave
ret 4
Function at 0x4ee637
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0x80
mov esi, edx
mov edi, ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4ee659
push esi
push edi
mov ecx, eax
call fcn.004ee26c
mov esi, eax
jmp 0x4ee65b
xor esi, esi
push 0
push 0xfd
mov ecx, esi
call fcn.00476bc9
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret