joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49cee8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov eax, 0x5b09fc
call fcn.004d57f0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
xor ebx, ebx
mov word [ebp - 0x14], 8
mov dword [ebp - 0x28], 1
test edi, edi
je 0x49cf3e
push 0xfffffffffffffff0
push edi
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_GetWindowLongA
test eax, 0x800000
je 0x49cf3e
mov bl, 1
push ebx
lea eax, [ebp - 0x1028]
push eax
call fcn.00469760
add esp, 8
sub eax, 0xffffffff
je 0x49cf9d
dec eax
je 0x49cf59
dec eax
je 0x49cf62
mov dword [ebp - 0x28], 0xa
jmp 0x49cfd6
mov dword [ebp - 0x28], 0x32
push 5
mov edx, dword [ebp + 0x10]
push edx
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x33
push 0
mov ecx, dword [ebp + 0x14]
push ecx
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x34
jmp 0x49cfd6
mov dword [ebp - 0x28], 0x50
push 0
mov eax, dword [ebp + 0x10]
push eax
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x51
push 5
mov edx, dword [ebp + 0x14]
push edx
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov dword [ebp - 0x28], 0x52
mov dword [ebp - 0x28], 0x96
lea ecx, [ebp - 0x1028]
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
call sub.USER32.dll_SetDlgItemTextA
mov dword [ebp - 0x28], 0x97
mov word [ebp - 0x14], 0
jmp 0x49d020
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov esp, ebp
mov edi, dword [ebp - 0x1034]
mov esi, dword [ebp - 0x1030]
mov ebx, dword [ebp - 0x102c]
pop ebp
ret
Function at 0x4a5b58
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
mov ecx, 0x104
push ebx
push esi
push edi
lea edi, [ebp - 0x410]
mov esi, dword [ebp + 8]
push esi
mov esi, 0x5b1590
rep movsd dword es:[edi], dword [esi]
pop esi
call fcn.004a3a3c
sub al, 0xff
je 0x4a5bf5
dec al
je 0x4a5b91
dec al
je 0x4a5bc3
jmp 0x4a5c25
push 0
push 0x65
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x66
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x67
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4a5c25
push 5
push 0x65
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x66
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x67
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
jmp 0x4a5c25
push 0
push 0x65
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x66
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x67
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x528ff8
call fcn.0047cb8c
push eax
call fcn.0047cb94
push eax
mov bl, byte [0x52e3f9]
test bl, bl
jne 0x4a5c56
cmp byte [0x52e3fd], 0
jne 0x4a5c56
cmp byte [0x52e3ff], 0
jne 0x4a5c56
xor eax, eax
jmp 0x4a5c5b
mov eax, 1
shl eax, 0x10
cmp byte [0x52e3fe], 0
setne dl
and edx, 1
shl edx, 0xc
add eax, edx
test bl, bl
setne cl
and ecx, 1
mov dl, byte [0x52e3fd]
shl ecx, 8
add eax, ecx
test dl, dl
setne cl
and ecx, 1
mov dl, byte [0x52e3ff]
shl ecx, 4
add eax, ecx
test dl, dl
setne cl
and ecx, 1
add eax, ecx
push eax
movsx eax, byte [0x52a67c]
push eax
call fcn.004a5a78
push eax
call fcn.0047d3d8
push eax
call fcn.0047d3e0
push eax
call fcn.0047d3d0
push eax
push 0x6126c4
push 0x5f6cf2
lea eax, [ebp - 0x410]
push eax
call fcn.004d75f8
add esp, 0x30
call fcn.00456628
test al, al
je 0x4a5d0c
call fcn.00456614
push eax
push 0x5f6d15
lea edx, [ebp - 0x410]
push edx
call fcn.004d2f1c
pop ecx
lea ecx, [ebp - 0x410]
add eax, ecx
push eax
call fcn.004d75f8
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
push 0x64
push esi
call sub.USER32.dll_SetDlgItemTextA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a87a0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov al, byte [0x52e3f9]
test al, al
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
je 0x4a87c2
mov eax, 1
jmp 0x4a8967
mov dl, byte [ebp + 0xc]
test dl, dl
jne 0x4a87d3
mov eax, 1
jmp 0x4a8967
push 0
push 0x5f72f6
call sub.USER32.dll_FindWindowA
test eax, eax
jne 0x4a87f4
mov byte [0x5b1d01], 0
mov eax, 1
jmp 0x4a8967
push 1
push esi
call fcn.004a7950
add esp, 8
test eax, eax
setne bl
and ebx, 1
mov byte [0x5b1d01], bl
test bl, bl
je 0x4a881b
mov eax, 1
jmp 0x4a8967
mov dl, byte [0x52e3fe]
test dl, dl
je 0x4a8839
mov cl, byte [0x52e3f9]
test cl, cl
je 0x4a8839
mov eax, 1
jmp 0x4a8967
mov dl, byte [0x52e3fe]
test dl, dl
je 0x4a88ab
mov cl, byte [0x52e3ff]
test cl, cl
je 0x4a88ab
mov eax, dword [0x5b1d04]
test eax, eax
jne 0x4a886b
push 0x5f7304
call fcn.00401288
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x5b1d04], eax
mov edx, dword [0x5b1d08]
test edx, edx
jne 0x4a888a
push 0x5f7310
call fcn.00401288
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x5b1d08], eax
mov ecx, dword [0x5b1d0c]
test ecx, ecx
jne 0x4a8907
push 0x5f7320
call fcn.00401288
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x5b1d0c], eax
jmp 0x4a8907
mov eax, dword [0x5b1d04]
test eax, eax
jne 0x4a88c9
push 0x5f7330
call fcn.00401288
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x5b1d04], eax
mov edx, dword [0x5b1d08]
test edx, edx
jne 0x4a88e8
push 0x5f733a
call fcn.00401288
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x5b1d08], eax
mov ecx, dword [0x5b1d0c]
test ecx, ecx
jne 0x4a8907
push 0x5f7348
call fcn.00401288
push eax
call sub.USER32.dll_LoadIconA
mov dword [0x5b1d0c], eax
push esi
mov esi, 0x5b1d14
lea edi, [ebp - 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x104]
push eax
push 1
call fcn.00452a6c
add esp, 8
lea edx, [ebp - 0x104]
push 1
push 0x40b
push esi
push edx
push 0
call fcn.004a7990
add esp, 0x14
mov ebx, eax
mov byte [0x5b1d01], bl
test bl, bl
je 0x4a8962
mov eax, dword [0x5b1d04]
push eax
push 1
push esi
call fcn.004a7900
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a952c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push 0x7c9
push ebx
call sub.USER32.dll_KillTimer
cmp byte [ebp + 0x24], 0
je 0x4a95ef
push 0
mov eax, dword [ebp + 0x20]
push eax
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
mov edx, dword [ebp + 0xc]
push edx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push edi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
mov eax, dword [ebp + 0x1c]
push eax
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4a95db
push 1
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
push 0x28
push ebx
call sub.USER32.dll_PostMessageA
jmp 0x4a9655
push 1
push edi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
push 0x28
push ebx
call sub.USER32.dll_PostMessageA
jmp 0x4a9655
push 5
mov edx, dword [ebp + 0x20]
push edx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push esi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push edi
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
mov eax, dword [ebp + 0x18]
push eax
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
mov edx, dword [ebp + 0x1c]
push edx
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4aa2e0
Capabilities:
Hide graphical window

Disassembly:
push 0x5b2008
call fcn.00401b34
pop ecx
cmp dword [0x5b2004], 1
jne 0x4aa305
push 0x5b2008
call fcn.00401b48
pop ecx
mov eax, 1
ret
push 0x5b2008
call fcn.00401b48
pop ecx
call fcn.004614b0
mov dl, byte [0x5b232c]
test dl, dl
je 0x4aa352
push 0
call fcn.00443644
pop ecx
push 5
mov ecx, dword [0x529088]
push ecx
call sub.USER32.dll_ShowWindow
push 0
push 0x1388
push 0x7c9
mov eax, dword [0x529088]
push eax
call sub.USER32.dll_SetTimer
mov eax, 1
ret
call fcn.00458a58
test eax, eax
je 0x4aa361
mov eax, 1
ret
mov byte [0x5b232c], 1
push 0
call fcn.00443644
pop ecx
push 0
push 0
mov edx, dword [0x529090]
push edx
push 0x5b232d
call fcn.0040de38
add esp, 0x10
mov eax, 1
ret
Function at 0x4acd54
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
je 0x4acdf0
push 0
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 1
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0
call fcn.00401400
add esp, 8
push 0
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00401400
add esp, 8
jmp 0x4ace89
push 0x5f7a70
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetWindowTextA
push 0
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0xc8
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 1
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 2
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x64
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
push 0
call fcn.00401400
add esp, 8
push 0
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.00401400
add esp, 8
pop ebx
pop ebp
ret
Function at 0x4adaf4
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x55fa10], 0
jne 0x4adb0f
test byte [0x52fca8], 2
jne 0x4adb0f
test byte [0x52fca8], 1
je 0x4adb15
mov eax, 1
ret
mov edx, dword [0x52ede5]
cmp edx, 0xebc
jne 0x4adb29
mov eax, 1
ret
mov edx, dword [0x529088]
push edx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4adb3f
mov eax, 1
ret
mov dl, byte [0x52e401]
test dl, dl
je 0x4adb4f
mov eax, 1
ret
mov edx, dword [0x52a63c]
test edx, edx
je 0x4adb80
xor ecx, ecx
mov dword [0x52a63c], ecx
mov byte [0x612a5e], 0
mov byte [0x612bde], 0
mov byte [0x612c1e], 0
call fcn.004ade54
call fcn.0046aaf8
mov eax, dword [0x52a634]
test eax, eax
je 0x4adba5
push 0
call fcn.00443644
pop ecx
push 5
mov edx, dword [0x529094]
push edx
call sub.USER32.dll_ShowWindow
mov eax, 1
ret
mov dword [0x52a634], 1
push 0
call fcn.00443644
pop ecx
push 0
push 0
mov edx, dword [0x529090]
push edx
push 0x5b3850
call fcn.0040de38
add esp, 0x10
mov eax, 1
ret

Function at 0x4ae200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb80
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x17f
lea eax, [ebp - 0x180]
push eax
push esi
push ebx
call sub.USER32.dll_GetDlgItemTextA
push 0x17f
lea edx, [ebp - 0x300]
push edx
push edi
push ebx
call sub.USER32.dll_GetDlgItemTextA
push 0x5f7ac3
push esi
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0x5f7ac4
push edi
push ebx
call sub.USER32.dll_SetDlgItemTextA
lea ecx, [ebp - 0x480]
push ecx
lea eax, [ebp - 0x300]
push eax
lea edx, [ebp - 0x180]
push edx
call fcn.004adebc
add esp, 0xc
mov ebx, eax
mov eax, ebx
sub eax, 0xfffffffe
je 0x4ae301
dec eax
je 0x4ae291
add eax, 0xfffffffe
sub eax, 2
jb 0x4ae344
jmp 0x4ae349
mov byte [0x52a638], 1
push 0x5f7ac5
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [0x529094]
push ecx
call sub.USER32.dll_SetDlgItemTextA
push 5
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [0x529094]
push edx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0
push 0x88b8
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [0x529094]
push eax
call sub.USER32.dll_SetTimer
test byte [0x528c3c], 0x40
je 0x4ae2fd
lea edx, [ebp - 0x180]
push edx
push 0x5f7aeb
push 0x528c40
call fcn.004541dc
add esp, 0xc
xor eax, eax
jmp 0x4ae34b
mov byte [0x52a638], 1
lea edx, [ebp - 0x480]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [0x529094]
push eax
call sub.USER32.dll_SetDlgItemTextA
test byte [0x528c3c], 0x40
je 0x4ae340
lea edx, [ebp - 0x180]
push edx
push 0x5f7b02
push 0x528c40
call fcn.004541dc
add esp, 0xc
xor eax, eax
jmp 0x4ae34b
call fcn.004adc14
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ae470
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb58
mov eax, 0x5b40e8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d57f0
xor edx, edx
mov dword [ebp - 0x28], edx
mov word [ebp - 0x14], 8
mov ecx, dword [0x52ede5]
cmp ecx, 0xebc
jne 0x4ae4bd
call fcn.0046aaf8
call fcn.004ade54
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4ae627
push ebx
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4ae4fd
push 0x400
lea ecx, [ebp - 0x428]
push ecx
push ebx
call sub.USER32.dll_GetWindowTextA
test byte [0x528c3c], 0x40
je 0x4ae544
lea eax, [ebp - 0x428]
push eax
push 0x5f7b18
push 0x528c40
call fcn.004541dc
add esp, 0xc
jmp 0x4ae544
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [0x528c3c], 0x40
je 0x4ae544
lea eax, [ebp - 0x428]
push eax
push 0x5f7b24
push 0x528c40
call fcn.004541dc
add esp, 0xc
lea edx, [ebp - 0x468]
lea ecx, [ebp - 0x428]
push edx
push 0x5f7b30
push ecx
call fcn.0041caf4
add esp, 0xc
test al, al
jne 0x4ae574
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4ae627
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x428]
push ecx
push 0x5f7b35
push eax
call fcn.0041caf4
add esp, 0xc
test al, al
jne 0x4ae5a4
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4ae627
lea ecx, [ebp - 0x428]
push ecx
lea eax, [ebp - 0x4a8]
push eax
lea edx, [ebp - 0x468]
push edx
call fcn.004adebc
add esp, 0xc
dec eax
sub eax, 2
jb 0x4ae5c9
jmp 0x4ae5d7
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4ae627
push 0x8400
lea ecx, [ebp - 0x428]
push ecx
push 0x5f7b3a
call fcn.0046a8a0
add esp, 0xc
mov word [ebp - 0x14], 0
jmp 0x4ae61b
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x4b4]
mov esi, dword [ebp - 0x4b0]
mov ebx, dword [ebp - 0x4ac]
pop ebp
ret
Function at 0x4be1ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 8]
inc byte [0x5df1bc]
movsx eax, byte [0x5df1bc]
cmp eax, 4
jle 0x4be210
mov byte [0x5df1bc], 1
movsx edx, byte [0x5df1bc]
push edx
push 0x5ff921
lea ecx, [ebp - 0x20]
push ecx
call fcn.004d75f8
add esp, 0xc
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push 1
push eax
call fcn.00401288
push eax
call sub.USER32.dll_LoadImageA
mov esi, eax
push 0
push esi
push 0x170
push 0x2d3
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
push eax
call sub.USER32.dll_DestroyIcon
push 5
push 0x2f9
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
movsx eax, byte [0x5df1bd]
push 0
push eax
push 0x402
push 0x2f9
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
inc byte [0x5df1bd]
movsx edx, byte [0x5df1bd]
cmp edx, 0x64
jle 0x4be2ad
mov byte [0x5df1bd], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c258c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call fcn.00401298
mov edx, eax
sub edx, dword [0x5dfd24]
cmp edx, 0x1388
jae 0x4c25b0
mov eax, 1
pop ebx
pop ebp
ret
mov dword [0x5dfd24], eax
call fcn.004c2550
mov ecx, dword [ebp + 0xc]
dec ecx
je 0x4c25cb
dec ecx
je 0x4c25f2
dec ecx
je 0x4c2602
dec ecx
je 0x4c2610
jmp 0x4c2610
push ebx
call fcn.0040f8f8
pop ecx
push 6
push ebx
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_MessageBeep
push 9
push ebx
call sub.USER32.dll_ShowWindow
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4c2610
push ebx
call fcn.0040f8f8
pop ecx
push 0
call sub.USER32.dll_MessageBeep
jmp 0x4c2610
push ebx
call fcn.0040f8f8
pop ecx
push 0
call sub.USER32.dll_MessageBeep
call fcn.004c256c
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x4c6850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
cmp byte [ebp + 8], 0
je 0x4c68db
push 0
push 0x2001
push 0x601a7d
lea eax, [ebp - 0x104]
push eax
call fcn.004563e8
add esp, 0x10
mov dl, byte [ebp + 0xc]
test dl, dl
je 0x4c6897
push 0x601a89
lea ecx, [ebp - 0x104]
push ecx
call fcn.004d2e40
add esp, 8
jmp 0x4c68ab
push 0x601a93
lea eax, [ebp - 0x104]
push eax
call fcn.004d2e40
add esp, 8
test byte [0x528c3d], 2
je 0x4c68cd
lea edx, [ebp - 0x104]
push edx
push 0x601a9b
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 5
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.dll_WinExec
mov esp, ebp
pop ebp
ret

Function at 0x4ca4cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x4ca4d5
add esp, 4
mov eax, dword [ebp - 4]
lea eax, [ebp - 0x2000]
push ebx
mov ebx, dword [ebp + 8]
push 0x2000
push eax
push 0x3e7
push ebx
call sub.USER32.dll_GetDlgItemTextA
mov dl, byte [ebp - 0x2000]
test dl, dl
je 0x4ca51e
push 0x602458
lea ecx, [ebp - 0x2000]
push ecx
call fcn.004d2e40
add esp, 8
push 0x60245b
lea eax, [ebp - 0x2000]
push eax
call fcn.004d2e40
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x2000]
push ecx
call fcn.004d2e40
add esp, 8
lea eax, [ebp - 0x2000]
push eax
push 0x3e7
push ebx
call sub.USER32.dll_SetDlgItemTextA
push 0
push 0x12c
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 5
push 0x3e7
push ebx
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
push 0x7c8
push ebx
call sub.USER32.dll_KillTimer
push 0
push 0xbb8
push 0x7c8
push ebx
call sub.USER32.dll_SetTimer
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cb4bc
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc8
mov eax, 0x5e36d1
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
call fcn.004d57f0
mov dword [ebp - 0x28], 1
mov word [ebp - 0x14], 8
test byte [ebp + 0x15], 4
je 0x4cb725
push esi
push edi
lea edi, [ebp - 0x130]
mov esi, 0x5e33c5
mov ecx, 0x41
lea eax, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov word [ebp - 0x14], 8
push esi
push edi
lea edi, [ebp - 0x234]
mov esi, 0x5e34c9
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x338]
mov esi, 0x5e35cd
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp - 0x28], 0x65
push eax
push edi
call fcn.004cb478
add esp, 8
mov dword [ebp - 0x28], 0x66
test byte [0x528c3d], 4
je 0x4cb57a
lea edx, [ebp - 0x234]
push edx
push 0x6024a3
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov dword [ebp - 0x28], 0x67
mov dword [ebp - 0x28], 0x68
push ebx
push esi
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x6024ac
lea ecx, [ebp - 0x130]
push ecx
call fcn.004d75f8
add esp, 0x14
lea eax, [ebp - 0x130]
push eax
lea edx, [ebp - 0x338]
push edx
call fcn.0047965c
add esp, 8
mov dword [ebp - 0x28], 0x69
push ebx
push esi
call fcn.0044fb90
add esp, 8
mov dword [ebp - 0x28], 0x6b
push 0x2100
lea ecx, [ebp - 0x234]
push ecx
call fcn.00405c58
add esp, 8
test eax, eax
jne 0x4cb615
test byte [0x528c3d], 4
je 0x4cb725
lea eax, [ebp - 0x234]
push eax
push 0x6024bc
push 0x528c40
call fcn.004541dc
add esp, 0xc
jmp 0x4cb725
mov dword [ebp - 0x28], 0xc9
push pe_nt_image_headers32
lea edx, [ebp - 0x338]
push edx
call fcn.00405c58
add esp, 8
test eax, eax
je 0x4cb65f
test byte [0x528c3d], 4
je 0x4cb725
lea ecx, [ebp - 0x338]
push ecx
push 0x6024cc
push 0x528c40
call fcn.004541dc
add esp, 0xc
jmp 0x4cb725
lea eax, [ebp - 0x338]
push eax
lea edx, [ebp - 0x234]
push edx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x4cb6c2
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x338]
push ecx
lea eax, [ebp - 0x234]
push eax
push 0x6024dd
lea edx, [ebp - 0x130]
push edx
call fcn.004d75f8
add esp, 0x14
test byte [0x528c3d], 4
je 0x4cb725
lea ecx, [ebp - 0x130]
push ecx
push 0x6024eb
push 0x528c40
call fcn.004541dc
add esp, 0xc
jmp 0x4cb725
push 0xb
lea eax, [ebp - 0x234]
push eax
call fcn.00403dc0
add esp, 8
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x4cb6e7
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00403e94
pop ecx
test byte [0x528c3d], 4
je 0x4cb709
lea eax, [ebp - 0x338]
push eax
push 0x6024fb
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov edx, dword [ebp + 0x20]
push edx
lea edx, [ebp - 0x338]
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
push edi
push edx
call fcn.004ce078
add esp, 0x14
push ebx
push 0x602509
push 0x400
call fcn.004542bc
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4cb778
mov esp, ebp
mov edi, dword [ebp - 0x344]
mov esi, dword [ebp - 0x340]
mov ebx, dword [ebp - 0x33c]
pop ebp
ret