joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469d2c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 4
pushal
mov esi, eax
mov dword [esp + 0x20], esi
cmp ebx, 0xd
je 0x469d45
cmp ebx, 0x1b
je 0x469d45
cmp ebx, 9
jne 0x469d51
mov eax, esi
call fcn.00464738
jmp 0x469f22
cmp ebx, 0x2d
jne 0x469d7c
mov eax, dword [esi + 0x7b]
and eax, 0x20
cmp eax, 0
jne 0x469f22
cmp dword [0x545ae8], 0
sete al
movzx eax, al
mov dword [0x545ae8], eax
jmp 0x469f22
cmp ebx, 0x24
jne 0x469db2
mov eax, esi
mov ebx, 0
call fcn.00469ff4
push 0x10
call sub.USER32.dll_GetKeyState
mov bx, ax
mov eax, esi
cmp bx, 0
setl bl
movzx ecx, bl
mov ebx, 0
call fcn.0044d578
jmp 0x469f22
cmp ebx, 0x23
jne 0x469dee
mov eax, esi
mov ebx, 0x7fffffff
call fcn.00469ff4
push 0x10
call sub.USER32.dll_GetKeyState
mov cx, ax
mov eax, esi
movsx ebx, word [esi + 0x88]
cmp cx, 0
setl al
movzx ecx, al
mov eax, dword [esp + 0x20]
call fcn.0044d578
jmp 0x469f22
cmp ebx, 0x25
jne 0x469e7e
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x469e4f
movsx ebx, word [esi + 0x92]
jmp 0x469e27
mov ecx, dword [esi + 0x84]
mov eax, ebx
movzx eax, byte [ecx + eax - 1]
call fcn.0047b090
cmp eax, 0
jne 0x469e26
jmp 0x469e48
dec ebx
cmp ebx, 0
jg 0x469e0d
jmp 0x469e48
mov ecx, dword [esi + 0x84]
mov eax, ebx
movzx eax, byte [ecx + eax - 1]
call fcn.0047b090
cmp eax, 0
je 0x469e47
jmp 0x469e57
dec ebx
cmp ebx, 0
jg 0x469e2e
jmp 0x469e57
movsx ebx, word [esi + 0x92]
dec ebx
mov eax, esi
call fcn.00469ff4
push 0x10
call sub.USER32.dll_GetKeyState
mov cx, ax
mov eax, esi
cmp cx, 0
setl cl
movzx ecx, cl
call fcn.0044d578
jmp 0x469f22
cmp ebx, 0x27
jne 0x469ee5
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x469ef8
movsx ebx, word [esi + 0x92]
jmp 0x469eb2
mov ecx, dword [esi + 0x84]
mov eax, ebx
movzx eax, byte [ecx + eax]
call fcn.0047b090
cmp eax, 0
je 0x469eb1
jmp 0x469ed8
inc ebx
movsx eax, word [esi + 0x88]
cmp ebx, eax
jl 0x469e99
jmp 0x469ed8
mov ecx, dword [esi + 0x84]
mov eax, ebx
movzx eax, byte [ecx + eax]
call fcn.0047b090
cmp eax, 0
jne 0x469ed7
jmp 0x469f00
inc ebx
movsx eax, word [esi + 0x88]
cmp ebx, eax
jl 0x469ebf
jmp 0x469f00
cmp ebx, 0x2e
jne 0x469f22
mov eax, esi
mov ebx, 0x7f
call fcn.00469a54
jmp 0x469f36
movsx ebx, word [esi + 0x92]
inc ebx
mov eax, esi
call fcn.00469ff4
push 0x10
call sub.USER32.dll_GetKeyState
mov cx, ax
mov eax, esi
cmp cx, 0
setl cl
movzx ecx, cl
call fcn.0044d578
mov eax, dword [esi + 0xc]
and eax, 0x800
cmp eax, 0
je 0x469f36
mov eax, esi
call fcn.0044d510
popal
add esp, 4
ret
Function at 0x472524
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 4
pushal
mov esi, eax
mov dword [esp + 0x20], esi
jmp 0x47253f
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jl 0x472546
jmp 0x47255f
cmp ebx, 9
je 0x472530
jmp 0x47255f
push 0x10
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x47255a
mov ebx, 0x25
jmp 0x47255f
mov ebx, 0x27
cmp ebx, 0x25
jne 0x4725ac
mov eax, esi
mov ebx, dword [esi + 0xa0]
mov eax, dword [esp + 0x20]
mov ecx, 0xffffffff
mov edx, 1
call fcn.0047165c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4725e2
cmp esi, 0
jne 0x47258f
mov eax, esi
jmp 0x472594
mov eax, esi
add eax, 0x7b
mov ebx, dword [eax + 4]
mov eax, esi
mov ecx, 0xffffffff
mov edx, 1
call fcn.0047165c
mov ebx, eax
jmp 0x4725e2
cmp ebx, 0x27
jne 0x47260a
cmp dword [esi + 0xa0], 0xffffffff
jne 0x4725c5
mov eax, esi
call fcn.00471974
mov ebx, eax
jmp 0x4725e2
mov eax, esi
mov ebx, dword [esi + 0xa0]
mov eax, dword [esp + 0x20]
mov ecx, 1
mov edx, 1
call fcn.0047165c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4725f0
mov eax, esi
call fcn.00471974
mov ebx, eax
mov eax, esi
call fcn.00472704
mov eax, esi
mov ecx, 1
call fcn.00472778
mov eax, esi
call fcn.004740c4
popal
add esp, 4
ret
Function at 0x476be8
Capabilities:
Get graphical window text

Disassembly:
pushal
mov edi, eax
push 0
push 0
push 0xb8
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
cmp eax, 0
je 0x476c64
or dword [edi + 0x87], 1
push 0
push 0
push 0xe
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov ecx, ebx
inc ecx
mov eax, ecx
call fcn.004c51f0
mov esi, eax
mov eax, esi
push eax
push ecx
push 0xd
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb9
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov ecx, ebx
mov ebx, esi
mov eax, dword [edi + 0x3b]
mov eax, dword [eax]
call fcn.0051adc8
mov eax, dword [edi + 0x3b]
call fcn.004792c8
mov eax, esi
call fcn.004c51e8
popal
ret

Function at 0x4771ac
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
pushal
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
push 0
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowThreadProcessId
cmp ebx, eax
je 0x4771d7
mov eax, 0x21e
mov ebx, str.CTLTEXT
call fcn.0053d5f4
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
inc ebx
mov eax, ebx
call fcn.004c51f0
mov esi, eax
push ebx
push esi
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowTextA
push 0xfffffffffffffff0
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowLongA
mov edx, eax
mov eax, dword [edi + 0xc]
and eax, 0x200
cmp eax, 0
je 0x477217
or edx, 0x800000
mov eax, edi
lea ebx, [esp + 0x24]
lea ecx, [esp + 0x20]
call fcn.00477168
mov eax, edi
mov ebx, edx
mov edx, esi
mov ecx, dword [0x70aef4]
call fcn.004647e0
mov eax, edi
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00477180
mov eax, esi
call fcn.004c51e8
popal
add esp, 8
ret

Function at 0x477da8
Capabilities:
Hide graphical window

Disassembly:
push ecx
push edx
push esi
mov esi, eax
cmp dword [esi], 2
jne 0x477dbd
push 0
mov eax, dword [esi + 4]
push eax
call sub.USER32.dll_ShowWindow
mov dword [esi], 0
cmp ebx, 0
je 0x477dcf
mov eax, esi
call fcn.00478164
pop esi
pop edx
pop ecx
ret
Function at 0x4b5e94
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
push ebx
push ecx
push edx
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esi + 9], 0xcc
je 0x4b5ec7
mov eax, esi
mov ebx, dword [esi + 0x16b]
mov eax, dword [esp + 0x14]
call dword [ebx]
mov dword [esi + 0x66], 0
mov dword [esi + 9], 0xcc
mov eax, dword [esi + 0x16b]
cmp byte [eax + 8], 0
je 0x4b5f31
mov eax, dword [esi + 0x4e]
cmp dword [esi + 0x66], eax
jae 0x4b5f0b
mov eax, dword [esi + 0x66]
mov dword [esp + 0x18], eax
mov eax, esi
lea ecx, [esi + 0x66]
mov edi, dword [esi + 0x16f]
mov eax, dword [esp + 0x14]
mov ebx, 0
mov edx, 0
call dword [edi + 4]
mov eax, dword [esp + 0x18]
cmp dword [esi + 0x66], eax
jne 0x4b5ed3
mov al, 0
jmp 0x4b5f48
mov eax, esi
mov ebx, dword [esi + 0x16b]
mov eax, dword [esp + 0x14]
call dword [ebx + 4]
mov eax, esi
mov ebx, dword [esi + 0x16b]
mov eax, dword [esp + 0x14]
call dword [ebx]
mov dword [esi + 0x66], 0
jmp 0x4b5ec7
cmp byte [esi + 0x36], 0
je 0x4b5f3e
mov eax, 0xce
jmp 0x4b5f43
mov eax, 0xcd
mov dword [esi + 9], eax
mov al, 1
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 8
ret

Function at 0x4b5f54
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 4
push ebx
push ecx
mov ecx, eax
mov dword [esp + 8], ecx
cmp dword [ecx + 9], 0xca
jne 0x4b5f87
mov eax, ecx
call fcn.004bac30
cmp byte [ecx + 0x35], 0
je 0x4b5f80
mov dword [ecx + 9], 0xcf
mov al, 1
jmp 0x4b5fda
mov dword [ecx + 9], 0xcb
cmp dword [ecx + 9], 0xcb
jne 0x4b5fc0
mov eax, dword [ecx + 0x17b]
cmp byte [eax + 0x10], 0
je 0x4b5fb8
mov eax, ecx
mov ebx, dword [ecx + 0x17b]
mov eax, dword [esp + 8]
call dword [ebx]
cmp eax, 0
jne 0x4b5fb3
mov al, 0
jmp 0x4b5fda
cmp eax, 2
jne 0x4b5f9c
mov eax, dword [ecx + 0x6a]
mov dword [ecx + 0x72], eax
jmp 0x4b5fd3
cmp dword [ecx + 9], 0xcc
je 0x4b5fd3
mov eax, ecx
mov ebx, dword [ecx]
mov eax, dword [esp + 8]
call dword [ebx]
mov eax, ecx
call fcn.004b5e94
pop ecx
pop ebx
add esp, 4
ret
Function at 0x4c44dc
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ecx
push edx
push esi
mov ebx, eax
cmp ebx, 0
jne 0x4c44f2
mov ebx, 0x73da30
lea esi, [esp + 0x10]
push esi
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push ebx
push 0
push 0x553160
push esi
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, ebx
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x104
ret
Function at 0x4f30a4
Capabilities:
Enumerate files on windows

Disassembly:
enter 0x10, 2
pushal
mov edi, dword [ebp - 4]
mov eax, dword [edi - 0xbe]
mov ebx, 0x565e10
mov ecx, 0
call fcn.00432b7c
lea eax, [edi - 0x1cd]
mov dword [ebp - 0x18], eax
call fcn.004353d4
lea esi, [edi - 0x2e9]
mov eax, esi
call fcn.004353d4
lea ecx, [edi - 0xa3]
mov eax, ecx
call fcn.00435120
call fcn.0042f50f
mov eax, 0x565dbc
mov ebx, 3
call fcn.00434fc0
call fcn.00434674
lea eax, [edi - 0x2d9]
mov dword [ebp - 0x14], eax
mov ebx, 0x100
call fcn.0043508c
mov eax, ecx
call fcn.00435120
call fcn.0042f50f
call fcn.00434834
cmp eax, 3
jne 0x4f3146
mov eax, ecx
call fcn.00435120
mov eax, dword [edi - 0x1d1]
lea eax, [eax]
mov ebx, 0xff
call fcn.00434d3c
jmp 0x4f3172
mov eax, ecx
call fcn.00435120
call fcn.0042f50f
call fcn.00434834
mov edx, eax
mov eax, dword [edi - 0x1d1]
lea eax, [eax]
lea ecx, [edi - 0xa3]
dec edx
mov ebx, 0xff
call fcn.0042f6ca
mov eax, dword [edi - 0x1d1]
mov dword [eax + 0xff], 1
mov eax, dword [edi - 0x1d1]
mov dword [eax + 0x103], 1
mov eax, esi
call fcn.00435490
mov eax, dword [edi - 0xbe]
push eax
push dword [ebp - 0x14]
call sub.KERNEL32.dll_FindFirstFileA
mov dword [edi - 0x1d5], eax
call fcn.004f3010
mov eax, dword [edi - 0xbe]
push eax
mov eax, dword [edi - 0x1d5]
push eax
call sub.KERNEL32.dll_FindNextFileA
cmp eax, 0
je 0x4f31d2
call fcn.004f3010
jmp 0x4f31b3
push 0
push 1
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004352b8
add esp, 0xc
mov eax, ecx
call fcn.00435264
mov edx, eax
mov dword [edi - 0x1d9], 1
cmp dword [edi - 0x1d9], edx
jg 0x4f3260
mov eax, ecx
mov ebx, dword [edi - 0x1d9]
call fcn.004353a8
mov eax, dword [edi - 0x1d1]
mov dword [eax + 0xff], 2
mov eax, dword [edi - 0x1d1]
mov dword [eax + 0x103], 2
lea eax, [edi - 0x1bd]
mov ebx, 0xff
call fcn.00434fc0
call fcn.00433c98
mov eax, dword [edi - 0x1d1]
lea eax, [eax]
mov ebx, 0xff
call fcn.00434d3c
mov eax, esi
call fcn.00435490
inc dword [edi - 0x1d9]
jmp 0x4f31f5
mov eax, dword [edi - 0x1d1]
lea eax, [eax]
mov ebx, 0xff
call fcn.00434fc0
call fcn.00434890
mov eax, dword [edi - 0x1d1]
mov eax, dword [eax + 0x103]
call fcn.0042ee3a
call fcn.0042f024
call fcn.0042fed4
fstp qword [ebp - 0x10]
sub esp, 8
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.00434b64
mov eax, esi
call fcn.00435284
mov eax, 0x24
call fcn.0051bc0c
popal
leave
ret
Function at 0x4f7674
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ecx
push edx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004f69e0
mov eax, esi
call fcn.004f7628
mov edi, eax
cmp dword [edi], 0
jne 0x4f7782
cmp ebx, 0
jge 0x4f76b4
mov eax, dword [esi + 0xa]
mov dword [edi], eax
call fcn.004f7bf0
mov ebx, eax
mov eax, esi
call fcn.004f936c
jmp 0x4f7782
mov eax, esi
mov ebx, edi
call fcn.004f6a78
mov ecx, eax
mov dword [esp + 0x14], ecx
mov edx, 0xd
cmp byte [ecx + 0xc], 0
je 0x4f76d7
movzx eax, word [ecx + 0xa]
shl eax, 2
add edx, eax
movzx ebx, word [ecx + 4]
movzx eax, word [ecx + 6]
cmp ebx, eax
jae 0x4f7721
call fcn.004b3d54
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x14]
mov ecx, edx
call fcn.0042f617
mov eax, dword [esp + 0x18]
lea eax, [eax + edx]
mov ecx, dword [esp + 0x14]
lea ebx, [ecx + edx]
movzx ecx, word [ecx + 6]
sub ecx, edx
call fcn.004f7f7c
mov eax, dword [esp + 0x14]
call fcn.004c51e8
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov al, byte [ecx + 0xc]
mov byte [edi + 0x2d], al
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0xa]
lea ebx, [ecx + edx]
movzx ecx, word [ecx + 0xa]
lea edx, [edi]
call fcn.004f79ac
mov ecx, dword [esp + 0x14]
sub eax, ecx
movzx ebx, word [ecx + 6]
cmp eax, ebx
je 0x4f775d
mov eax, 0x642
call fcn.004f90e4
cmp byte [edi + 0x2d], 0
je 0x4f776d
mov eax, dword [edi]
lea ebx, [ecx + 0xd]
call fcn.004f7984
movzx eax, word [ecx + 8]
mov dword [edi + 0x28], eax
mov eax, ecx
call fcn.004c51e8
mov dword [edi + 0xc], 0
cmp byte [edi + 0x2c], 0
jne 0x4f779a
mov eax, esi
mov ebx, edi
call fcn.004f8798
mov eax, esi
mov ebx, edi
call fcn.004f7ec4
mov eax, edi
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0xc
ret

Function at 0x4f77e8
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
pushal
mov dword [esp + 0x24], ecx
mov ecx, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ebx
mov esi, dword [esp + 0x24]
mov edi, edx
mov eax, edi
and eax, 0x3f
cmp eax, 0
je 0x4f7814
mov eax, 0x8ee
call fcn.004f90e4
cmp dword [ecx + 0x49], 0xffffffff
je 0x4f78b1
cmp dword [ecx], 0
jne 0x4f78b1
cmp dword [ecx + 0x4d], 0
je 0x4f7846
mov edx, 0
cmp edx, edi
jae 0x4f7846
mov eax, dword [ecx + 0x4d]
lea ebx, [esi + edx]
call fcn.004f94b8
add edx, 0x40
jmp 0x4f7832
push 0
call sub.KERNEL32.dll_SetLastError
push 0
push 0
push dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx + 0x49]
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [esp + 0x30]
push eax
push edi
push esi
mov eax, dword [ebx + 0x49]
push eax
call sub.KERNEL32.dll_WriteFile
cmp eax, 0
jne 0x4f7882
call fcn.004f6374
mov dword [ebx], eax
jmp 0x4f788e
cmp dword [esp + 0x2c], edi
je 0x4f788e
mov dword [ebx], 5
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 0x4d], 0
je 0x4f78b1
mov edx, 0
cmp edx, edi
jae 0x4f78b1
mov eax, dword [ecx + 0x4d]
lea ebx, [esi + edx]
call fcn.004f9460
add edx, 0x40
jmp 0x4f789d
popal
add esp, 0x10
ret
Function at 0x4f8bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ecx
push edx
push esi
push edi
mov dword [esp + 0x18], ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov esi, ecx
mov edi, edx
mov eax, edi
and eax, 0x3f
cmp eax, 0
je 0x4f8be2
mov eax, 0x8e0
call fcn.004f90e4
cmp dword [ebx + 0x49], 0xffffffff
jne 0x4f8c14
mov eax, 0
jmp 0x4f8c69
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x4d], 0
jne 0x4f8bfb
jmp 0x4f8c65
mov edx, 0
cmp edx, edi
jae 0x4f8c65
mov eax, dword [ecx + 0x4d]
lea ebx, [esi + edx]
call fcn.004f9460
add edx, 0x40
jmp 0x4f8c00
push 0
call sub.KERNEL32.dll_SetLastError
push 0
push 0
push dword [esp + 0x24]
mov eax, dword [ebx + 0x49]
push eax
call sub.KERNEL32.dll_SetFilePointer
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
je 0x4f8c3e
mov eax, 0x925
call fcn.004f90e4
push 0
lea eax, [esp + 0x24]
push eax
push edi
push esi
mov eax, dword [ebx + 0x49]
push eax
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
jne 0x4f8c5f
mov eax, 0x8e5
call fcn.004f90e4
cmp dword [esp + 0x20], edi
je 0x4f8bef
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x10
ret
Function at 0x50ac58
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
pushal
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
mov edi, edx
push 0xf00021
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 4]
push eax
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
push eax
mov eax, dword [ecx + 4]
push eax
mov eax, dword [ecx]
push eax
push ebx
call sub.GDI32.dll_PatBlt
push 0x400
lea eax, [esp + 0x34]
mov dword [esp + 0x30], eax
push eax
push dword [esp + 0x28]
call sub.USER32.dll_GetWindowTextA
cmp eax, 0
je 0x50ad16
mov eax, edi
and eax, 0xf
cmp eax, 0xc
jne 0x50acb9
mov eax, 0x140
mov dword [esp + 0x24], eax
jmp 0x50acc7
mov eax, edi
and eax, 0xf
or eax, 0x150
mov dword [esp + 0x24], eax
mov ecx, edi
and ecx, 0x80
cmp ecx, 0
je 0x50acdd
or eax, 0x800
mov dword [esp + 0x24], eax
and edi, 0x8000000
cmp edi, 0
je 0x50acf6
push dword [0x78d8cc]
push ebx
call sub.GDI32.dll_SetTextColor
mov esi, eax
push dword [esp + 0x24]
push dword [esp + 0x2c]
push 0xffffffffffffffff
push dword [esp + 0x38]
push ebx
call sub.USER32.dll_DrawTextA
cmp edi, 0
je 0x50ad16
push esi
push ebx
call sub.GDI32.dll_SetTextColor
popal
add esp, 0x410
ret

Function at 0x50d414
Capabilities:
Check for software breakpoints

Disassembly:
pushal
mov esi, eax
mov ecx, 0
mov ebx, ecx
mov eax, dword [esi + 0x20]
cmp ebx, eax
jae 0x50d4d9
mov eax, ecx
movzx eax, byte [esi + eax*4 + 0x2a]
mov ebx, ecx
movzx ebx, byte [esi + ebx*4 + 0x28]
add eax, ebx
mov ebx, ecx
movzx ebx, byte [esi + ebx*4 + 0x29]
add eax, ebx
mov ebx, 3
cdq
idiv ebx
cmp eax, 0x33
jge 0x50d466
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0
jmp 0x50d4d3
cmp eax, 0x66
jge 0x50d482
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0x40
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0x40
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0x40
jmp 0x50d4d3
cmp eax, 0x99
jge 0x50d4a0
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], pe_nt_image_headers32
mov eax, ecx
mov byte [esi + eax*4 + 0x29], pe_nt_image_headers32
mov eax, ecx
mov byte [esi + eax*4 + 0x28], pe_nt_image_headers32
jmp 0x50d4d3
cmp eax, 0xcc
jge 0x50d4be
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0xc0
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0xc0
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0xc0
jmp 0x50d4d3
mov eax, ecx
mov byte [esi + eax*4 + 0x2a], 0xff
mov eax, ecx
mov byte [esi + eax*4 + 0x29], 0xff
mov eax, ecx
mov byte [esi + eax*4 + 0x28], 0xff
inc ecx
jmp 0x50d41c
popal
ret
Function at 0x50f6fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x38
push ebx
push ecx
push edx
push esi
push edi
mov dword [esp + 0x1a], ebx
mov ebx, eax
mov eax, dword [esp + 0x1a]
mov dword [esp + 0x1e], eax
mov dword [esp + 0x16], 0
mov dword [esp + 0x22], 1
mov ecx, eax
cmp ecx, 0x3e4
jne 0x50f736
mov eax, 1
jmp 0x50f84a
cmp ecx, 0x3e6
jne 0x50f748
mov dword [esp + 0x16], 0x3e5
jmp 0x50f75c
cmp ecx, 0x3e1
jne 0x50f75c
mov dword [esp + 0x16], eax
mov dword [esp + 0x22], 0
mov esi, 0
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
mov ecx, dword [0x78debf]
cmp eax, ecx
jb 0x50f80f
jmp 0x50f82d
push 1
lea eax, [esp + 0x34]
mov ecx, 0x3e4
mov edx, 0x3e4
call fcn.0050f8d4
cmp eax, 0
jne 0x50f7a4
jmp 0x50f81a
lea eax, [esp + 0x26]
push eax
lea eax, [esp + 0x2e]
push eax
push dword [esp + 0x44]
push dword [esp + 0x40]
call sub.USER32.dll_UnpackDDElParam
push dword [esp + 0x3c]
push dword [esp + 0x38]
call sub.USER32.dll_FreeDDElParam
mov ax, word [esp + 0x2a]
mov word [esp + 0x2e], ax
mov ax, word [esp + 0x2e]
and ax, 0x8000
shr ax, 0xf
movzx esi, ax
cmp dword [esp + 0x1e], 0x3e8
je 0x50f82d
mov ax, word [esp + 0x26]
call fcn.0050f8c0
jmp 0x50f82d
push 0
lea eax, [esp + 0x34]
mov edx, ecx
call fcn.0050f8d4
cmp eax, 0
jne 0x50f828
jmp 0x50f76e
cmp dword [esp + 0x22], 0
jne 0x50f788
mov ecx, dword [esp + 0x16]
cmp ecx, 0
jne 0x50f7f8
jmp 0x50f76e
mov esi, 1
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
mov ebx, dword [0x78debf]
cmp eax, ebx
jb 0x50f848
mov eax, 0x25d
call fcn.00421f94
mov eax, esi
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x38
ret

Function at 0x50fabc
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x114
pushal
mov eax, 0x78dbc0
lea eax, [eax]
push eax
call sub.KERNEL32.dll_EnterCriticalSection
cmp byte [0x78dbe0], 0
jne 0x50fae0
mov byte [0x78dbe0], 1
cmp dword [0x568918], 0
jne 0x50fbcb
inc dword [0x568918]
mov byte [esp + 0x133], 0
lea ecx, [esp + 0x13c]
cmp dword [esp + 0x138], 0
je 0x50fb20
lea esi, [esp + 0x34]
mov eax, esi
mov ebx, dword [esp + 0x138]
call fcn.004c51f8
jmp 0x50fb26
lea eax, [ecx + 4]
mov esi, dword [eax - 4]
cmp byte [esp + 0x133], 0
je 0x50fb44
mov eax, str.Error:_Output_corrupted_stack
mov ebx, str.wsldebug.cpp
mov ecx, 0xa4
call fcn.0050fbd4
cmp dword [0x568914], 0
jne 0x50fb79
push 0x14
lea eax, [esp + 0x24]
push eax
push 0x5678a4
push str.auxtrace
push str.Clarion_5.5_Tracing
call sub.KERNEL32.dll_GetProfileStringA
cmp byte [esp + 0x20], 0
je 0x50fb79
mov dword [0x56891c], 1
mov eax, esi
call dword [0x568a20]
cmp dword [0x56891c], 0
je 0x50fbb8
cmp dword [0x78dbe4], 0
jne 0x50fba4
push 1
push 0x5678c8
call sub.KERNEL32.dll__lopen
mov dword [0x78dbe4], eax
mov eax, esi
call fcn.0042f564
push eax
push esi
push dword [0x78dbe4]
call sub.KERNEL32.dll__lwrite
dec dword [0x568918]
mov eax, 0x78dbc0
lea eax, [eax]
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
popal
add esp, 0x114
ret
Function at 0x512a50
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
pushal
mov esi, eax
mov dword [esp + 0x24], esi
mov eax, dword [0x5677e4]
cmp dword [esi + 0x83], eax
jne 0x512a71
mov dword [0x5677e4], 0
mov eax, dword [0x5677e8]
cmp esi, eax
jne 0x512a84
mov dword [0x5677e8], 0
cmp dword [esi + 0x83], 0
je 0x512c88
lea ebx, [esi + 0x1e7]
call fcn.0050b90c
jmp 0x512aad
mov eax, dword [0x567808]
cmp dword [esi + 0xfb], eax
je 0x512aba
jmp 0x512adc
mov eax, dword [0x567808]
cmp dword [esi + 0x83], eax
jne 0x512a9e
mov eax, esi
mov ebx, dword [esi + 4]
mov eax, dword [esp + 0x24]
call dword [ebx + 0x60]
cmp eax, 0
je 0x512ad2
mov eax, 0
jmp 0x512ad7
mov eax, dword [0x567818]
mov dword [0x567808], eax
mov eax, 0
mov eax, dword [esi + 0x83]
push eax
call sub.USER32.dll_IsWindow
cmp eax, 0
je 0x512c20
mov ebx, dword [esi + 0x1b2]
mov dword [esp + 0x20], ebx
jmp 0x512b1f
mov eax, dword [ebx + 0x83]
push eax
call sub.USER32.dll_IsWindowVisible
cmp eax, 0
je 0x512b15
jmp 0x512b24
mov ebx, dword [ebx + 0x1b2]
mov dword [esp + 0x20], ebx
cmp ebx, 0
jne 0x512b02
cmp ebx, 0
jne 0x512b33
mov ebx, dword [esi + 0x1ae]
mov dword [esp + 0x20], ebx
cmp ebx, 0
jne 0x512b42
mov ebx, dword [0x5677e0]
mov dword [esp + 0x20], ebx
cmp ebx, 0
je 0x512b7d
mov eax, ebx
mov ecx, dword [ebx + 4]
mov eax, dword [esp + 0x20]
call dword [ecx + 0x5c]
cmp eax, 0
je 0x512b71
push dword [0x567818]
call sub.USER32.dll_SetActiveWindow
mov eax, dword [ebx + 0x83]
push eax
call sub.USER32.dll_SetFocus
jmp 0x512b7d
mov eax, dword [ebx + 0x83]
push eax
call sub.USER32.dll_SetActiveWindow
push 0
mov eax, dword [esi + 0x83]
push eax
call sub.USER32.dll_ShowWindow
push 0
mov eax, dword [esi + 0x83]
push eax
call sub.USER32.dll_SetMenu
mov eax, esi
mov ebx, dword [esi + 4]
mov eax, dword [esp + 0x24]
call dword [ebx + 0x5c]
cmp eax, 0
je 0x512bf7
push 0
mov eax, dword [esi + 0x83]
push eax
push 0x221
push dword [0x56781c]
call sub.USER32.dll_SendMessageA
mov eax, dword [esi + 0x83]
push eax
call sub.USER32.dll_IsWindow
cmp eax, 0
je 0x512be0
mov eax, dword [esi + 0x83]
push eax
call sub.USER32.dll_DestroyWindow
dec dword [0x5677d4]
call fcn.00516fe4
mov eax, dword [0x5677e0]
call fcn.005354fc
jmp 0x512c03
mov eax, dword [esi + 0x83]
push eax
call sub.USER32.dll_DestroyWindow
mov eax, dword [esi + 0xfb]
push eax
call sub.USER32.dll_IsWindow
cmp eax, 0
je 0x512c20
mov eax, dword [esi + 0xfb]
push eax
call sub.USER32.dll_DestroyWindow
mov dword [esi + 0xfb], 0
mov dword [esi + 0x83], 0
cmp dword [esi + 0x11c], 0
je 0x512c88
mov eax, esi
call fcn.00512a28
lea ebx, [esp + 0x28]
push ebx
push eax
push dword [0x78d994]
call sub.USER32.dll_GetClassInfoA
mov eax, esi
call fcn.00512a28
push dword [0x78d994]
push eax
call sub.USER32.dll_UnregisterClassA
cmp dword [esp + 0x3c], 0
je 0x512c78
push dword [esp + 0x3c]
call sub.USER32.dll_DestroyIcon
cmp dword [esp + 0x40], 0
je 0x512c88
push dword [esp + 0x40]
call sub.USER32.dll_DestroyCursor
popal
add esp, 0x30
ret