joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fc00
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1c]
push eax
push 0x18
push ecx
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x14]
test ebx, ebx
push 0
cmove ebx, eax
mov dword [ebp - 0x40], eax
test esi, esi
mov dword [ebp - 0x24], ebx
cmove esi, ebx
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
mov ebx, eax
mov eax, dword [0x4bd734]
test eax, eax
je 0x41fc7d
mov eax, dword [eax + 0xdcc]
test eax, eax
je 0x41fc7d
push 0
push eax
push ebx
call edi
push ebx
mov dword [ebp - 0x34], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call esi
push ebx
mov dword [ebp - 0x20], eax
call esi
mov esi, eax
mov eax, dword [0x4bd734]
mov dword [ebp - 0x2c], esi
test eax, eax
je 0x41fcb4
mov eax, dword [eax + 0xdcc]
test eax, eax
je 0x41fcb4
push 0
push eax
push esi
call edi
push ebx
mov dword [ebp - 0x30], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp - 0x3c]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call edi
push dword [ebp - 0x38]
push esi
call edi
mov esi, eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp + 0xc]
push 0xcc0020
push dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x2c]
push esi
call edi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x41fd18
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x30]
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
test eax, eax
je 0x41fd2b
push 0
push eax
push esi
call edi
test esi, esi
je 0x41fd36
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x41fd43
push 0
push eax
push ebx
call edi
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x38]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046300c
mov esp, ebp
pop ebp
ret
Function at 0x4204c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4bd734]
test eax, eax
je 0x4204ff
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x4204ff
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x4204ea
mov dword [0x4bd738], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x4204ff
mov eax, dword [eax + 0x1f2c]
test eax, eax
je 0x4204ff
pop ebp
jmp eax
pop ebp
jmp fcn.00420310

Function at 0x420510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
test edi, edi
je 0x4205b8
mov al, byte [edi]
test al, al
je 0x4205b8
cmp al, 0x23
je 0x4205b8
mov esi, edi
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x420545
sub esi, edx
mov eax, esi
and eax, 3
je 0x42056f
push eax
mov eax, esi
and eax, 0xfc
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.004643e0
mov ecx, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x42057f
xor ecx, dword [edi + esi*4 - 4]
dec esi
test esi, esi
jg 0x420576
mov eax, 0x446f8657
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ecx, eax
mov esi, dword [ecx*4 + 0x520444]
test esi, esi
je 0x4205b8
push dword [esi + 4]
push edi
call fcn.0046ed36
add esp, 8
test eax, eax
je 0x4205cb
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x4205a1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi + 8]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
movups xmmword [ebx], xmm0
xor ecx, ebp
movq xmm0, qword [esi + 0x18]
pop esi
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.0046300c
mov esp, ebp
pop ebp
ret
Function at 0x420f80
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ADVAPI32.DLL
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x420faf
push str.ADVAPI32.DLL
call ebx
test eax, eax
je 0x420fbc
push str.SystemFunction036
push eax
call esi
mov dword [0x4abe10], eax
push str.Msimg32.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x420fd8
push str.Msimg32.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x420ff4
push str.AlphaBlend
push eax
call esi
push str.GradientFill
push dword [ebp - 4]
mov dword [0x4bd748], eax
call esi
mov dword [0x4bd744], eax
push 0x4806d8
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x421010
push 0x4806d8
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x42102c
push 0x4806e4
push eax
call esi
push str.UpdateLayeredWindow
push dword [ebp - 4]
mov dword [0x4bd74c], eax
call esi
mov dword [0x4bd750], eax
push str.UxTheme.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x421048
push str.UxTheme.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x421064
push str.SetThemeAppProperties
push eax
call esi
push str.SetWindowTheme
push dword [ebp - 4]
mov dword [0x4bd754], eax
call esi
mov dword [0x4bd758], eax
push str.Wtsapi32.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x421080
push str.Wtsapi32.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x42109c
push str.WTSQuerySessionInformationA
push eax
call esi
push str.WTSFreeMemory
push dword [ebp - 4]
mov dword [0x4bd75c], eax
call esi
mov dword [0x4bd760], eax
push str.Kernel32.dll
call edi
mov edi, eax
test edi, edi
jne 0x4210b6
push str.Kernel32.dll
call ebx
mov edi, eax
test edi, edi
je 0x4210d0
push str.WTSGetActiveConsoleSessionId
push edi
call esi
push str.ProcessIdToSessionId
push edi
mov dword [0x4bd764], eax
call esi
mov dword [0x4bd768], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422bc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4bd734]
sub esp, 0xc
push esi
test eax, eax
je 0x422c11
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x422c11
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x422bee
mov dword [0x4bd738], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x422c11
mov eax, dword [eax + 0x1f2c]
test eax, eax
je 0x422c11
push 0x4807d4
push dword [ebp + 8]
call eax
mov esi, eax
mov dword [ebp - 8], esi
jmp 0x422c23
push 0x4807d4
push dword [ebp + 8]
call fcn.00420310
mov esi, eax
mov dword [ebp - 8], eax
add esp, 8
test esi, esi
je 0x422d6a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x422d6a
mov dword [ebp - 0xc], 0
jle 0x422d48
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
nop dword [eax]
mov eax, dword [esi + 0xf4]
test edi, edi
js 0x422c74
cmp dword [ecx + eax + 0x3c], edi
jne 0x422d2d
lea edi, [ecx + eax]
test edi, edi
je 0x422ceb
xor esi, esi
nop dword [eax]
mov ecx, dword [edi + 8]
mov eax, dword [esi + ecx]
test eax, eax
je 0x422cf0
test edx, edx
js 0x422c9c
push 0
push edx
push 0x111
push eax
call ebx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x40]
mov eax, dword [esi + eax]
test eax, eax
je 0x422cca
cmp eax, dword [ebp + 8]
je 0x422cca
push 0
push dword [esi + ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x40]
push dword [esi + eax]
mov eax, dword [edi + 8]
push dword [esi + eax]
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x422cd5
push 0
push 0
push 0x10
push dword [esi + ecx]
call ebx
mov eax, dword [edi + 0xc]
push dword [eax + esi]
call fcn.00468056
mov edx, dword [ebp + 0x10]
add esp, 4
add esi, 4
jmp 0x422c80
mov ecx, dword [edi + 8]
jmp 0x422cf3
mov esi, dword [ebp - 8]
push ecx
call fcn.00468056
push dword [edi + 0xc]
call fcn.00468056
push dword [edi + 0x40]
call fcn.00468056
add esp, 0xc
push 0
push 0
push 0x1302
push dword [edi]
call ebx
test eax, eax
je 0x422d24
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
add ecx, 0x48
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp eax, dword [esi + 0xf0]
jl 0x422c60
pop edi
pop ebx
push dword [esi + 0xf4]
call fcn.00468056
add esp, 4
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf0], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427ea0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x427fab
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 0x19
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
mov dword [ebp - 0x134], eax
cmp eax, 0xf
jle 0x427f57
push 0xa
lea eax, [ebp - 0x130]
push str.pcanywhere
push eax
call fcn.00466b72
add esp, 0xc
test eax, eax
jne 0x427f51
lea eax, [ebp - 0x130]
push 0x480cfc
push eax
call fcn.0046f1bf
add esp, 8
test eax, eax
je 0x427f9c
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x134]
cmp eax, 6
jne 0x427f9c
lea eax, [ebp - 0x130]
push str.WinVNC
push eax
call fcn.0046ee32
add esp, 8
test eax, eax
jne 0x427f9c
push 0x19
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x130]
push str.WinVNC_desktop_sink
push eax
call fcn.0046ee32
add esp, 8
test eax, eax
je 0x427fd4
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x427ef2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4bd768]
test ecx, ecx
je 0x42800e
lea edx, [ebp - 0x138]
push edx
push eax
call ecx
test eax, eax
je 0x42800e
mov eax, dword [0x4bd764]
test eax, eax
jne 0x427fea
jmp 0x427fec
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
call eax
cmp dword [ebp - 0x138], eax
je 0x42808d
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4bd75c]
test eax, eax
je 0x428076
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x13c]
push ecx
push 4
push 0xffffffffffffffff
push 0
call eax
test eax, eax
je 0x428076
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x42808d
mov ecx, dword [0x4bd764]
test ecx, ecx
je 0x42804f
call ecx
mov ecx, eax
mov eax, dword [ebp - 0x13c]
cmp dword [eax], ecx
jne 0x42807c
mov ecx, dword [0x4bd760]
test ecx, ecx
je 0x428060
push eax
call ecx
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x42808d
mov ecx, dword [0x4bd760]
test ecx, ecx
je 0x42808d
push eax
call ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046300c
mov esp, ebp
pop ebp
ret

Function at 0x4282d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4bd734]
test eax, eax
je 0x42830f
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x42830f
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x4282fa
mov dword [0x4bd738], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x42830f
mov eax, dword [eax + 0x1f30]
test eax, eax
je 0x42830f
pop ebp
jmp eax
pop ebp
jmp fcn.004280a0
Function at 0x42b750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4bd734]
test eax, eax
je 0x42b78f
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x42b78f
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x42b77a
mov dword [0x4bd738], edx
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x42b78f
mov eax, dword [eax + 0x1f28]
test eax, eax
je 0x42b78f
pop ebp
jmp eax
pop ebp
jmp fcn.0042b4e0
Function at 0x42b810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], edi
test ebx, ebx
je 0x42ba06
mov al, byte [ebx]
test al, al
je 0x42ba06
cmp al, 0x23
je 0x42ba06
push esi
mov esi, ebx
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x42b850
sub esi, ecx
mov eax, esi
and eax, 3
je 0x42b87a
push eax
mov eax, esi
and eax, 0xfc
add eax, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.004643e0
mov edi, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x42b88a
xor edi, dword [ebx + esi*4 - 4]
dec esi
test esi, esi
jg 0x42b881
mov eax, 0x446f8657
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub edi, eax
mov esi, dword [edi*4 + 0x520444]
test esi, esi
je 0x42b8c7
nop dword [eax]
push dword [esi + 4]
push ebx
call fcn.0046ed36
add esp, 8
test eax, eax
je 0x42b91a
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x42b8b0
push 0x24
call fcn.0046dc45
mov esi, eax
add esp, 4
test esi, esi
je 0x42b99f
mov dword [esi + 4], 0
xor eax, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
jmp 0x42b9a1
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
test al, 2
je 0x42b957
lea ecx, [esi + 8]
mov edx, ebx
mov edi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x42b943
add ecx, 4
add edx, 4
sub edi, 4
jae 0x42b930
jmp 0x42b954
movups xmm0, xmmword [ebx]
or dword [esi], 1
movups xmmword [esi + 8], xmm0
or dword [0x520440], 1
mov eax, dword [ebp + 0x10]
test al, 1
je 0x42b970
mov ecx, dword [ebx + 0x10]
cmp dword [esi + 0x18], ecx
je 0x42b970
or dword [esi], 1
mov dword [esi + 0x18], ecx
or dword [0x520440], 1
test al, 4
je 0x42b989
mov eax, dword [ebx + 0x14]
cmp dword [esi + 0x1c], eax
je 0x42b989
or dword [esi], 1
mov dword [esi + 0x1c], eax
or dword [0x520440], 1
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push 0x186f
push str.D:MyProjectsProPilotLibLibMain.c
push fcn.00466ae4
or eax, 1
mov dword [esi], eax
lea eax, [esi + 4]
or dword [0x520440], 1
push 0
push ebx
push eax
call fcn.00408760
mov edx, dword [ebp + 0x10]
add esp, 0x18
mov ecx, dword [ebp + 0xc]
test dl, 2
je 0x42b9dd
movups xmm0, xmmword [ecx]
movups xmmword [esi + 8], xmm0
test dl, 1
je 0x42b9e8
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x18], eax
test dl, 4
je 0x42b9f3
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [edi*4 + 0x520444]
mov dword [esi + 0x20], eax
mov dword [edi*4 + 0x520444], esi
jmp 0x42b989
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0046300c
mov esp, ebp
pop ebp
ret
Function at 0x42d370
Capabilities:
Capture screenshot
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x28], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x2c], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x80
mov dword [ebp - 0x30], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 2
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [ebp - 0x28], 0
je 0x42d3e2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x42d3eb
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp - 0x38], eax
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x12c
push 0x1f4
mov edi, eax
push esi
mov dword [ebp - 0x20], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x34], eax
call edi
push 0xcc0020
push 0
push 0
push dword [ebp - 0x24]
mov esi, eax
push 0x12c
push 0x1f4
push 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x20]
push esi
call edi
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x42d45c
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x24]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x28], 0
je 0x42d4cd
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push dword [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
push dword [ebp - 0x30]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
sbb eax, dword [ebp - 0x10]
push 0
push 0x3e8
push eax
push ecx
call fcn.00463520
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00463470
mov esi, eax
jmp 0x42d4fc
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push dword [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
push dword [ebp - 0x30]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call eax
sub esi, dword [ebp - 0x38]
mov eax, esi
test ebx, ebx
je 0x42d50c
mov dword [ebx + 0xdc8], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046300c
mov esp, ebp
pop ebp
ret
Function at 0x42d710
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x520408], 0
je 0x42d777
mov eax, dword [0x5203e0]
test eax, eax
je 0x42d861
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push dword [0x5203e0]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x5203e0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x5203e0], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
cmp dword [0x5203e8], 0
je 0x42d850
push dword [0x5203ec]
push dword [0x5203f0]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [0x5203f0]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x5203e8]
test eax, eax
je 0x42d7bc
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x5203e8], 0
push esi
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [0x5203e0]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetParent]
lea eax, [ebp - 0x14]
push 2
push eax
push dword [0x5203e0]
call esi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 5
push dword [0x5203e0]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
push eax
push dword [0x5203e0]
call esi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [ebp - 0x10]
push dword [0x5203e0]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], eax
call esi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
call esi
push 0
push 0
push dword [0x5203e0]
call esi
push dword [0x5203e4]
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
push 0x2c
push 0
push 0x5203e0
call fcn.00464960
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
Function at 0x42da60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov al, byte [esi]
cmp al, 0x20
jne 0x42da91
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
je 0x42da86
mov dword [ebp + 8], esi
cmp al, 0x2d
je 0x42da99
cmp al, 0x2b
jne 0x42daaa
xor ecx, ecx
cmp al, 0x2d
mov al, byte [esi + 1]
sete cl
inc esi
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], esi
mov ecx, dword [ebp - 0x14]
push edi
mov edi, dword [ebp - 0x10]
cmp al, 0x20
jle 0x42db65
mov dword [ebp - 4], edi
nop dword [eax]
movzx edx, word [esi]
mov eax, edx
and eax, 0x3030
cmp eax, 0x3030
jne 0x42db17
mov eax, edx
movzx eax, ax
push 0
push 0x64
push dword [ebp - 4]
movzx eax, byte [eax + 0x507770]
cdq
push ecx
mov esi, eax
mov edi, edx
call fcn.00463520
add esi, eax
mov ecx, esi
mov esi, dword [ebp + 8]
adc edi, edx
add esi, 2
mov dword [ebp - 4], edi
mov dword [ebp + 8], esi
movzx edx, word [esi]
mov eax, edx
mov dword [ebp - 0x10], eax
and eax, 0x3030
cmp eax, 0x3030
mov eax, edx
je 0x42dad3
cmp dl, 0x20
jle 0x42db5c
cmp dl, 0x2e
je 0x42db55
cmp dl, 0x2c
je 0x42db55
mov dword [ebp + 8], ecx
mov eax, ecx
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add dword [ebp + 8], eax
movsx eax, dl
adc edi, ecx
cdq
mov ecx, dword [ebp + 8]
shld edi, ecx, 1
add ecx, ecx
add ecx, eax
adc edi, edx
sub ecx, 0x30
sbb edi, 0
mov dword [ebp - 4], edi
jmp 0x42db58
mov dword [ebp - 8], esi
inc esi
mov dword [ebp + 8], esi
cmp byte [esi], 0x20
jg 0x42dac0
mov edx, edi
call fcn.004635e0
mov eax, dword [ebp - 8]
pop edi
test eax, eax
je 0x42db7f
sub esi, eax
divsd xmm0, qword [esi*8 + 0x5076d8]
cmp dword [ebp - 0xc], 0
pop esi
je 0x42db8d
xorps xmm0, xmmword [0x480fd0]
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov esp, ebp
pop ebp
ret