joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, 0x56b808
push 1
push dword [ebx]
call sub.USER32.dll_ShowWindow
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.dll_SetWindowPos
push dword [ebx]
call sub.USER32.dll_SetActiveWindow
push dword [ebx]
call sub.USER32.dll_UpdateWindow
push dword [ebp + 8]
push 0x68
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call fcn.00510952
push 0x12c
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
pop ebx
pop ebp
ret 4
Function at 0x5027b0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, dword [ebp + 8]
push dword [ebx + 0x3c8]
call fcn.00412773
test eax, eax
jne 0x5027de
push 0x56b908
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x5029c5
mov dword [ebx + 0x33c], 1
xor edx, edx
mov dword [ebx + 0x39c], edx
lea ecx, [ebx + 0xcc]
push ecx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x50285c
cmp dword [0x563d64], 0
je 0x502817
cmp dword [0x563d60], 0
jne 0x50285c
cmp dword [ebx + 0x374], 0
je 0x502840
push 8
push 0
lea eax, [ebx + 0xcc]
push eax
lea edx, [ebx + 4]
push edx
push dword [ebx]
call fcn.0047177d
mov eax, 1
jmp 0x5029c5
push 0
push 0x138d
call fcn.0042c564
push eax
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x5029c5
cmp dword [0x563d64], 0
je 0x5028c0
push 0
push 0x138e
call fcn.0042c564
push eax
push 1
push 0
push 1
push 1
push ebx
call fcn.00516d09
cmp dword [ebx + 0x340], 0
jne 0x502894
call fcn.0042e194
mov dword [ebx + 0x340], eax
push dword [ebx + 0x3c8]
push dword [ebx + 0x340]
push 0
mov dx, word [ebx + 0x350]
push edx
add ebx, 0xcc
push ebx
call fcn.00488cd0
mov eax, 1
jmp 0x5029c5
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x22], 4
mov word [ebp - 0x24], 2
lea esi, [ebp - 0x2c]
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0054c150
add esp, 0xc
mov word [ebp - 0x1c], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x18]
push eax
call fcn.0054c0e0
add esp, 0xc
mov dx, word [ebx + 0x350]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x1a], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
push 0
push 2
push 0
mov cx, word [0x561bee]
push ecx
mov ax, word [0x561bec]
push eax
call fcn.004f196d
mov esi, eax
mov dword [ebx + 0x3c4], esi
cmp esi, 0xffffffff
jne 0x502966
push 0
push 0x138f
call fcn.0042c564
push eax
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x5029c5
push dword [ebx + 0x3c4]
call fcn.00525bcd
push 0x10
push 0x8014
push dword [0x56cee8]
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_WSAAsyncSelect
push 0x10
lea edx, [ebp - 0x1c]
push edx
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x5029c3
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5029c3
push 0
push 0x1390
call fcn.0042c564
push eax
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x5029c5
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x503718
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x503721
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x50373f
xor eax, eax
jmp 0x50393b
xor edx, edx
mov dword [ebx + 0x39c], edx
push 1
push 2
push dword [ebx + 0x3c4]
push 0x8017
call fcn.00526a8c
test eax, eax
je 0x503766
xor eax, eax
jmp 0x50393b
inc dword [ebx + 0x3c0]
cmp dword [ebx + 0x3c0], 0x14
jl 0x50379c
xor edx, edx
mov dword [ebx + 0x3c0], edx
push 0
push 2
push dword [ebx + 0x3c4]
push 0x8017
call fcn.00526a8c
test eax, eax
je 0x50379c
xor eax, eax
jmp 0x50393b
cmp dword [ebx + 0x33c], 2
je 0x5037ac
xor eax, eax
jmp 0x50393b
cmp dword [0x56b8ac], 0
jne 0x5037d3
cmp dword [0x56b8a0], 0
jne 0x5037d3
mov edx, dword [ebx + 0x34c]
cmp edx, dword [ebx + 0x354]
jae 0x5037d3
xor eax, eax
jmp 0x50393b
mov esi, dword [ebx + 0x348]
cmp dword [ebx + 0x3ac], 0
je 0x503812
push ebx
call fcn.00501bbe
mov esi, eax
test esi, esi
jne 0x503812
push 0
push 2
push dword [ebx + 0x3c4]
push 0x8017
call fcn.00526a8c
test eax, eax
je 0x50380d
xor eax, eax
jmp 0x50393b
mov esi, pe_nt_image_headers32
cmp esi, 0x2000
jle 0x50381f
mov esi, 0x2000
push dword [ebx + 0x338]
call fcn.0055137c
pop ecx
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebx + 0x338]
call fcn.005503cc
add esp, 0xc
mov esi, eax
test esi, esi
jge 0x503866
push 0
push 0x1397
call fcn.0042c564
push eax
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x50393b
test esi, esi
jne 0x503871
xor eax, eax
jmp 0x50393b
push 0
push esi
lea edx, [ebp - 0x2004]
push edx
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x5038cc
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x5038b3
push 0
push dword [ebp - 4]
push dword [ebx + 0x338]
call fcn.00550328
add esp, 0xc
xor eax, eax
jmp 0x50393b
push 0
push 0x139a
call fcn.0042c564
push eax
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x50393b
cmp esi, edi
jle 0x5038e8
push 0
mov edx, dword [ebp - 4]
add edx, edi
push edx
push dword [ebx + 0x338]
call fcn.00550328
add esp, 0xc
mov esi, edi
mov eax, esi
add dword [ebx + 0x354], eax
add dword [ebx + 0x3b0], eax
push ebx
call fcn.005034a4
mov edx, dword [ebx + 0x354]
sub edx, dword [ebx + 0x34c]
mov ecx, dword [ebx + 0x348]
add ecx, ecx
lea ecx, [ecx + ecx*4]
cmp edx, ecx
setb al
and eax, 1
cmp dword [0x56b8ac], 0
jne 0x503766
cmp dword [0x56b8a0], 0
je 0x503939
test eax, eax
jne 0x503766
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x503944
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x503957
xor eax, eax
jmp 0x503a74
cmp dword [ebx + 0x33c], 2
je 0x503967
xor eax, eax
jmp 0x503a74
xor edx, edx
mov dword [ebx + 0x39c], edx
push 0
push 4
lea ecx, [ebp - 4]
push ecx
push dword [ebx + 0x3c4]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x5039b6
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x50399a
xor eax, eax
jmp 0x503a74
push 0
push 0x139a
call fcn.0042c564
push eax
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x503a74
test eax, eax
jg 0x5039ce
push 0x56ba2e
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x503a74
push dword [ebp - 4]
call sub.WSOCK32.dll_ntohl
cmp eax, dword [ebx + 0x34c]
ja 0x5039f2
push 0x56ba32
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x503a74
mov edx, eax
mov dword [ebx + 0x34c], edx
mov eax, dword [ebx + 0x360]
cmp edx, eax
jb 0x503a1b
mov dword [ebx + 0x34c], eax
push 0x56ba36
push 0
push ebx
call fcn.00503b09
xor eax, eax
jmp 0x503a74
push ebx
call fcn.005034a4
mov eax, dword [ebx + 0x354]
cmp eax, dword [ebx + 0x360]
jae 0x503a72
sub eax, dword [ebx + 0x34c]
mov edx, dword [ebx + 0x348]
add edx, edx
lea edx, [edx + edx*4]
cmp eax, edx
setb cl
and ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0x34c]
cmp eax, dword [ebx + 0x354]
jae 0x503a68
cmp dword [0x56b8a0], 0
je 0x503a72
cmp dword [ebp - 4], 0
je 0x503a72
push ebx
call fcn.00503718
xor eax, eax
jmp 0x503a74
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x5065a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x57ac8f
push 0x3e7
push 0xd
push 0x480
push esi
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57ac8f], 0
je 0x50663d
push 0x57a8a8
push 0x3e7
call sub.KERNEL32.dll_GetCurrentDirectoryA
push 0x57a8a8
call fcn.0042e417
push 0x57ac8f
push 0x57a8a8
call fcn.0054c1f4
add esp, 8
push 0x57a8a8
call fcn.00554294
pop ecx
push 0x56bc2f
push 0x57a8a8
call fcn.0054c5e4
add esp, 8
test eax, eax
je 0x506639
mov ebx, 1
cmp dword [ebp + 0xc], 0
je 0x50663f
call fcn.004127e5
push eax
push 0x63
push 0x57a8a8
call fcn.0050b5a6
jmp 0x50663f
xor ebx, ebx
jmp 0x50663f
xor ebx, ebx
push ebx
push 9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_EnableWindow
push ebx
push 9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5066f9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_GetParent
mov ebx, eax
push 0x461
push ebx
call sub.USER32.dll_GetDlgItem
mov edi, eax
call sub.USER32.dll_GetFocus
cmp edi, eax
jne 0x506729
xor eax, eax
jmp 0x5067b6
push 0x57ac8f
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57ac8f], 0
je 0x50676f
push 0x2a
push 0x57ac8f
call fcn.0054c230
add esp, 8
test eax, eax
jne 0x50676f
push 0x3f
push 0x57ac8f
call fcn.0054c230
add esp, 8
test eax, eax
je 0x506773
xor eax, eax
jmp 0x5067b6
test esi, esi
jne 0x50677b
xor eax, eax
jmp 0x5067b6
push 0x12
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x5067b4
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x5067b4
cmp byte [ebx], 0
je 0x5067b4
call fcn.004127e5
push eax
push 0
push ebx
call fcn.0050b5a6
mov eax, 1
jmp 0x5067b6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x50686c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x57a8a8
push edi
call sub.USER32.dll_GetParent
mov ebx, eax
mov eax, dword [0x56bbdc]
test eax, eax
je 0x506891
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [0x56bbdc], edx
mov eax, dword [0x56bbd8]
test eax, eax
je 0x5068a8
push eax
call sub.GDI32.dll_DeleteObject
xor edx, edx
mov dword [0x56bbd8], edx
push 0x57ac8f
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57ac8f], 0
je 0x50699c
push esi
push 0x3e7
call sub.KERNEL32.dll_GetCurrentDirectoryA
push esi
call fcn.0042e417
push 0x57ac8f
push esi
call fcn.0054c1f4
add esp, 8
push esi
call fcn.0042f42c
test eax, eax
je 0x506913
push 0x56bbd8
push 0x56bbdc
push edi
push esi
call fcn.0042f47c
jmp 0x50699c
xor ebx, ebx
test ebx, ebx
jne 0x506929
push str..bmp
push esi
call fcn.0054c1f4
add esp, 8
jmp 0x506978
push 0x2e
push esi
call fcn.0054c5b8
add esp, 8
test eax, eax
je 0x50693b
mov byte [eax], 0
cmp ebx, 1
jne 0x506950
push str..jpg
push esi
call fcn.0054c1f4
add esp, 8
jmp 0x506978
cmp ebx, 2
jne 0x506965
push str..png
push esi
call fcn.0054c1f4
add esp, 8
jmp 0x506978
cmp ebx, 3
jne 0x506978
push str..gif
push esi
call fcn.0054c1f4
add esp, 8
push 0x56bbd8
push 0x56bbdc
push edi
push esi
call fcn.0042f47c
cmp dword [0x56bbdc], 0
jne 0x50699c
inc ebx
cmp ebx, 4
jl 0x506915
mov eax, dword [0x56bbdc]
test eax, eax
je 0x5069bf
push 0
push 1
push 1
push dword [0x56bbd8]
push eax
push 0x8b
push edi
call fcn.0042f9c1
jmp 0x5069d4
push 0
push 1
push 2
push 0
push 0
push 0x8b
push edi
call fcn.0042f9c1
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x508731
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x64]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x50875b
mov eax, 3
jmp 0x508901
lea eax, [ebp - 0xc]
mov dword [ebp - 0x88], eax
lea edx, [ebp - 4]
mov dword [eax], edx
xor ecx, ecx
mov dword [eax + 4], ecx
mov word [ebp - 0x8a], 4
mov word [ebp - 0x8c], 2
lea esi, [ebp - 0x94]
push 0x10
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.0054c150
add esp, 0xc
mov word [ebp - 0x84], 2
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
push dword [ecx]
lea eax, [ebp - 0x80]
push eax
call fcn.0054c0e0
add esp, 0xc
mov dx, word [ebx + 0xc8]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x82], ax
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x80], edx
push 0x58465c
push 0x64
lea ecx, [ebp - 0x74]
push ecx
call fcn.0042e322
mov esi, dword [0x56acac]
cmp byte [ebx + 0xca], 0
je 0x508812
lea eax, [ebx + 0xca]
push eax
push 0x64
push 0x58465c
call fcn.0042e322
mov dword [0x56acac], 2
push 0
push 2
push 0
mov dx, word [0x561bee]
push edx
mov cx, word [0x561bec]
push ecx
call fcn.004f196d
mov dword [ebx + 0x18c], eax
lea eax, [ebp - 0x74]
push eax
push 0x64
push 0x58465c
call fcn.0042e322
mov dword [0x56acac], esi
mov eax, dword [ebx + 0x18c]
cmp eax, 0xffffffff
jne 0x50885e
mov eax, 1
jmp 0x508901
push eax
call fcn.00525bcd
push 0x10
push 0x8039
push dword [0x56cee8]
push dword [ebx + 0x18c]
call sub.WSOCK32.dll_WSAAsyncSelect
cmp dword [ebx + 0x18c], 0xffffffff
je 0x5088d4
mov dword [ebp - 0x10], 0x10
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0xa4]
push ecx
push dword [ebx + 0x18c]
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x5088d4
push dword [ebp - 0xa0]
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x64
lea eax, [ebx + 0xca]
push eax
call fcn.0042e322
mov dx, word [ebp - 0xa2]
push edx
call sub.WSOCK32.dll_ntohs
mov word [ebx + 0x12e], ax
push 0x10
lea ecx, [ebp - 0x84]
push ecx
push dword [ebx + 0x18c]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x5088ff
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5088ff
mov eax, 2
jmp 0x508901
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x508b5e
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00507220
mov ebx, eax
test ebx, ebx
je 0x508c62
mov eax, esi
shr eax, 0x10
and ax, 0xffff
test ax, ax
je 0x508bc3
movzx edx, ax
mov dword [ebx + 0x184], edx
cmp dword [0x56acb4], 0
je 0x508baa
push 3
push 0x3d
push ebx
push 0x56be98
call fcn.005072cb
push ebx
call fcn.005071c0
test eax, eax
je 0x508c62
push ebx
call fcn.005070ff
jmp 0x508c62
mov dword [ebx + 0x14c], 2
push 0
call fcn.0055aa70
pop ecx
mov esi, eax
mov dword [ebx + 0x17c], esi
mov dword [ebx + 0x180], esi
push 0x23
push 0x8038
push dword [0x56cee8]
push dword [ebx + 0x18c]
call sub.WSOCK32.dll_WSAAsyncSelect
cmp dword [ebx + 0x18c], 0xffffffff
je 0x508c4a
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x14]
push edx
push dword [ebx + 0x18c]
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x508c4a
push dword [ebp - 0x10]
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x64
lea ecx, [ebx + 0xca]
push ecx
call fcn.0042e322
mov ax, word [ebp - 0x12]
push eax
call sub.WSOCK32.dll_ntohs
mov word [ebx + 0x12e], ax
cmp dword [0x56acb4], 0
je 0x508c62
push 0
push 0x3d
push ebx
push str.SOCKOPEN
call fcn.005072cb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50d78c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
mov dword [0x55d008], eax
lea edx, [ebp + 0x14]
mov dword [0x55d008], edx
push ebx
call fcn.0051df69
test eax, eax
jne 0x50d7c0
mov eax, 1
jmp 0x50d989
mov edx, dword [ebp + 0x18]
sub edx, 1
jb 0x50d7cf
je 0x50d826
jmp 0x50d984
cmp edi, 9
jne 0x50d7f3
push 0x11
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
je 0x50d7f3
xor eax, eax
jmp 0x50d989
cmp edi, 0xd
je 0x50d801
cmp edi, 0xa
jne 0x50d984
mov dword [ebx + 0x840], 1
push 3
push dword [ebp + 0x1c]
push dword [ebx]
call fcn.00478118
test eax, eax
je 0x50d984
xor eax, eax
jmp 0x50d989
cmp edi, 0xd
je 0x50d830
cmp edi, 0xa
jne 0x50d83e
push dword [ebx]
call fcn.0043bbd5
xor eax, eax
jmp 0x50d989
mov edx, edi
xor ecx, ecx
mov cl, dl
test byte [ecx*2 + 0x57614f], 1
je 0x50d857
push edi
call fcn.005542dc
pop ecx
mov edi, eax
push 0
push 0
push 0x19f
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
mov esi, eax
cmp esi, 0xffffffff
je 0x50d984
mov dword [ebp - 4], esi
inc esi
cmp esi, dword [ebp - 4]
je 0x50d980
cmp dword [ebx + 0x6bc], 4
jne 0x50d8d0
lea eax, [ebp - 8]
push eax
push esi
push 0x189
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
cmp dword [ebp - 8], 0
je 0x50d8aa
inc eax
jne 0x50d8b1
xor esi, esi
jmp 0x50d87a
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp byte [eax], 0x20
je 0x50d8ae
push dword [ebx + 0xb6c]
push dword [ebp - 8]
call fcn.004ed8a9
test al, al
je 0x50d92c
inc dword [ebp - 8]
jmp 0x50d92c
push 0x5836b2
push esi
push 0x189
push dword [ebx + 0x820]
call sub.USER32.dll_SendMessageA
inc eax
jne 0x50d8ed
xor esi, esi
jmp 0x50d87a
mov dword [ebp - 8], 0x5836b2
mov eax, dword [ebx + 0x6bc]
dec eax
je 0x50d90a
add eax, 0xfffffffb
sub eax, 2
jb 0x50d924
dec eax
je 0x50d90a
jmp 0x50d92c
push dword [ebx + 0xb6c]
push dword [ebp - 8]
call fcn.004ed8ea
test al, al
je 0x50d92c
inc dword [ebp - 8]
jmp 0x50d92c
inc dword [ebp - 8]
mov edx, dword [ebp - 8]
cmp byte [edx], 0x20
je 0x50d921
mov ecx, dword [ebp - 8]
mov al, byte [ecx]
test al, al
je 0x50d976
xor edx, edx
mov dl, al
test byte [edx*2 + 0x57614f], 1
je 0x50d956
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ecx]
push eax
call fcn.005542dc
pop ecx
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebp - 8]
xor eax, eax
mov al, byte [ecx]
cmp eax, edi
jne 0x50d976
push 1
push 1
push esi
push 0x8098
push dword [ebx]
call fcn.0042d472
xor eax, eax
jmp 0x50d989
inc esi
cmp esi, dword [ebp - 4]
jne 0x50d883
xor eax, eax
jmp 0x50d989
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x18
Function at 0x50e404
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edi
call fcn.00412773
test eax, eax
jne 0x50e424
xor eax, eax
jmp 0x50e5df
test esi, esi
je 0x50e481
mov ebx, dword [edi + 0x1bfc]
test ebx, ebx
je 0x50e47a
push esi
push dword [ebx]
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x50e473
cmp dword [ebx + 0x1c], 0
je 0x50e457
cmp dword [ebx + 0x40], 0
je 0x50e457
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x1c], 1
push ebx
push dword [edi + 0x1bfc]
call fcn.004c6cb6
mov dword [edi + 0x1bfc], eax
mov eax, 1
jmp 0x50e5df
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x50e432
xor eax, eax
jmp 0x50e5df
push dword [ebp + 8]
call fcn.0051dd0a
mov ebx, eax
test ebx, ebx
jne 0x50e496
xor eax, eax
jmp 0x50e5df
call sub.USER32.dll_GetFocus
mov dword [ebp - 4], eax
mov edx, dword [ebx + 0x818]
cmp edx, dword [ebp - 4]
je 0x50e4bb
mov ecx, dword [ebx + 0x81c]
cmp ecx, dword [ebp - 4]
je 0x50e4bb
xor eax, eax
jmp 0x50e5df
lea edx, [ebp - 8]
push edx
push dword [ebx + 0x84c]
push dword [ebp - 4]
call fcn.00478b7f
cmp dword [ebp - 8], 0
jle 0x50e4ed
cmp dword [edi + 0x1c04], 0
jne 0x50e4ed
push 0
call fcn.0042c4bf
mov eax, 1
jmp 0x50e5df
push 0x578211
push 0x3e6
push 0xd
push dword [ebp - 4]
call sub.USER32.dll_SendMessageA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x50e514
mov eax, 1
jmp 0x50e5df
mov edx, dword [ebp - 8]
mov byte [edx + 0x578211], 0
mov esi, 0x578211
jmp 0x50e526
inc esi
cmp byte [esi], 0x20
je 0x50e525
cmp byte [esi], 0
jne 0x50e53a
mov eax, 1
jmp 0x50e5df
push 5
push 0x56c578
push esi
call fcn.0054c52c
add esp, 0xc
test eax, eax
je 0x50e558
mov eax, 1
jmp 0x50e5df
add esi, 5
jmp 0x50e55e
inc esi
cmp byte [esi], 0x20
je 0x50e55d
cmp byte [esi], 0
jne 0x50e56f
mov eax, 1
jmp 0x50e5df
push 0x20
push esi
call fcn.0054c230
add esp, 8
test eax, eax
je 0x50e581
mov byte [eax], 0
mov ebx, dword [edi + 0x1bfc]
test ebx, ebx
je 0x50e5d3
push esi
push dword [ebx]
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x50e5cc
push ebx
push dword [edi + 0x1bfc]
call fcn.004c6cb6
mov dword [edi + 0x1bfc], eax
xor eax, eax
mov dword [edi + 0x1c04], eax
push 0x56c57f
push 0
push 0xc
push dword [ebp - 4]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x50e5df
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x50e58b
push 0
call fcn.0042c4bf
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc
Function at 0x50e8b4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push dword [ebp + 8]
call fcn.0051dd0a
mov ebx, eax
test ebx, ebx
jne 0x50e8d1
xor eax, eax
jmp 0x50e9c9
push dword [ebx + 0xb6c]
call fcn.00412773
test eax, eax
jne 0x50e8e7
xor eax, eax
jmp 0x50e9c9
call sub.USER32.dll_GetFocus
mov esi, eax
cmp esi, dword [ebx + 0x818]
je 0x50e905
cmp esi, dword [ebx + 0x81c]
je 0x50e905
xor eax, eax
jmp 0x50e9c9
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push dword [ebx + 0x84c]
push esi
call fcn.00478d41
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jge 0x50e92a
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jge 0x50e938
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
push edx
push dword [ebx + 0x84c]
push esi
call fcn.00478b7f
cmp dword [ebp - 0xc], 0
jg 0x50e952
xor eax, eax
jmp 0x50e9c9
push 0x578211
push 0x3e6
push 0xd
push esi
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x50e971
xor eax, eax
jmp 0x50e9c9
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x578211], 0
push 5
push 0x56c59f
push 0x578211
call fcn.0054c52c
add esp, 0xc
test eax, eax
jne 0x50e99a
mov eax, 1
jmp 0x50e9c9
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jle 0x50e9a6
xor eax, eax
jmp 0x50e9c9
dec dword [ebp - 4]
cmp dword [ebp - 4], 0
jge 0x50e9b4
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0x578211], 0x20
jne 0x50e9c4
xor eax, eax
jmp 0x50e9c9
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x514c52
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00501a6b
test eax, eax
je 0x514d20
cmp dword [ebx + 0x3a4], 0
je 0x514ce4
push 0
push 0x15be
call fcn.0042c564
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
cmp dword [ebx + 0x344], 0
je 0x514cb7
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x514d20
push 0
push 0x15bf
call fcn.0042c564
push eax
push 0
push 0xc
push 0x77
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 5
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x514d20
push 0
push 0x15bd
call fcn.0042c564
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop ebx
pop ebp
ret 4

Function at 0x514d25
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0048be97
test eax, eax
je 0x514dea
cmp dword [ebx + 0x380], 0
je 0x514dae
push 0
push 0x15be
call fcn.0042c564
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 5
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
cmp dword [ebx + 0x344], 0
je 0x514d9b
push 1
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_EnableWindow
jmp 0x514dea
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_EnableWindow
jmp 0x514dea
push 0
push 0x15bd
call fcn.0042c564
push eax
push 0
push 0xc
push 0x79
push dword [ebx]
call sub.USER32.dll_SendDlgItemMessageA
push 0
push 0x78
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x77
push dword [ebx]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop ebx
pop ebp
ret 4