joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461730
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x531fc0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x4618ca
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x461843
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm1, xmm3
movaps xmm2, xmm3
pmullw xmm3, xmm4
paddw xmm2, xmm4
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psrlw xmm3, 7
psubw xmm2, xmm0
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x4617d0
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x4618b0
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm1, xmm2
movaps xmm3, xmm2
mov ecx, dword [ebp - 4]
paddw xmm3, xmm4
pmullw xmm2, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x4617c3
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x461cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x531fc0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x461e8a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x461e03
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm1, xmm4
pcmpgtw xmm1, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm1
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm2, xmm3
psrlw xmm0, 8
paddw xmm2, xmm4
pmullw xmm3, xmm4
psllw xmm2, 1
add eax, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm3, 7
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x461d90
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x461e70
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm3, xmm2
paddw xmm3, xmm4
pmullw xmm2, xmm4
mov ecx, dword [ebp - 4]
movaps xmm1, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x461d83
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x462400
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x531fc0]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x461a44
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x4619d1
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm2, xmm3
movaps xmm1, xmm3
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
pcmpgtw xmm2, xmm6
movaps xmm0, xmm2
psrlw xmm0, 8
pand xmm1, xmm2
psrlw xmm3, 7
psubw xmm1, xmm0
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x461972
cmp dword [ebp - 4], 0
je 0x461a2a
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm1, xmm4
punpcklbw xmm3, xmm5
movaps xmm2, xmm4
pcmpgtw xmm1, xmm6
pmullw xmm4, xmm3
paddw xmm2, xmm3
psllw xmm2, 1
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm4, 7
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x461963
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x462429
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x46242c
sub eax, 1
jne 0x462429
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x462429
push esi
call fcn.00461490
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x462429
cmp esi, 0x100
jae 0x462446
push esi
call fcn.00461730
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x4618e0
Function at 0x462450
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x531fc0]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x462004
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x461f91
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm2, xmm4
pcmpgtw xmm2, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm2
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm1, xmm3
psrlw xmm0, 8
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
add eax, 8
pand xmm1, xmm2
psubw xmm1, xmm0
psrlw xmm3, 7
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x461f32
cmp dword [ebp - 4], 0
je 0x461fea
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm2, xmm4
punpcklbw xmm3, xmm5
pmullw xmm4, xmm3
paddw xmm2, xmm3
movaps xmm1, xmm3
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm2, xmm1
psrlw xmm0, 8
psrlw xmm4, 7
psubw xmm2, xmm0
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x461f23
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x462479
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x46247c
sub eax, 1
jne 0x462479
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x462479
push esi
call fcn.00461a50
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x462479
cmp esi, 0x100
jae 0x462496
push esi
call fcn.00461cf0
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x461ea0
Function at 0x46a0e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506cba
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x5462f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebx + 8]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0xc]
push 0
mov dword [esi], vtable.CDspObj.0
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00469970
push 0
call fcn.004698f0
push 1
push 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x13c], 0
call fcn.00468260
push 1
call fcn.004698a0
push 0
mov ecx, esi
call fcn.00469880
push 0
call fcn.00469840
push 0
mov ecx, esi
call fcn.00469830
push 1
call fcn.00469820
push 1
call fcn.00469800
push 0
call fcn.004697c0
push 1
mov ecx, esi
call fcn.00468660
push 0
push 0
call fcn.00468640
push 0
call fcn.00468610
push 0
push 0
push 0
call fcn.004690e0
push 0
push 0
push 0
mov ecx, esi
call fcn.00468ff0
push 0
push 0
push 0
mov ecx, esi
call fcn.00468f70
push 0
push 0
mov ecx, esi
call fcn.00469240
push 0
push 0
mov ecx, esi
call fcn.004691e0
push 0x80
mov ecx, esi
call fcn.00468f40
push 0
call fcn.00468f00
push 0
mov ecx, esi
call fcn.00468eb0
push 0x100
mov ecx, esi
call fcn.00468e70
push 0
mov ecx, esi
call fcn.00468e40
push 0
mov ecx, esi
call fcn.00468c70
push 0
mov ecx, esi
call fcn.004685f0
push 0
call fcn.004685d0
push 0
call fcn.00468300
push 0x40
lea eax, [esi + 0xc8]
push 0
push eax
call fcn.0042fca0
push 0x10
call fcn.00424a9d
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.0047e690
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
push dword [ebx + 0x10]
mov dword [esi + 0x94], eax
mov ecx, esi
movups xmmword [esi + 0x98], xmm0
movq qword [esi + 0xa8], xmm0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x118], 1
call fcn.00468430
push 0
call fcn.004686c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x47e4a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
push 0xd
mov edi, ecx
xor esi, esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x47e512
push dword [0x55eaa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x47e512
push ebx
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x47e50b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test edi, edi
je 0x47e4f2
mov ecx, esi
sub edi, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x47e4e2
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47e4f5
sub esi, ecx
push ebx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x47e520
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push ecx
push 0
mov dword [ebp - 4], 0
call fcn.004f1180
mov ebx, eax
add esp, 8
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e540
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x47e5c4
push esi
push edi
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
sub ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x47e580
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x55eaa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
pop esi
test eax, eax
je 0x47e5c4
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 1
push ebx
call fcn.00424a98
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x14]
pop ebp
jmp fcn.0047f620

Function at 0x497240
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x54ea90
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x54eaa8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 0x54eaa8
test esi, esi
je 0x4972b3
nop
mov ecx, dword [esi]
cmp dword [ebp - 0xc], ecx
jne 0x497296
cmp dword [ebp - 8], 0
jne 0x497284
push 0
call fcn.00497480
mov eax, dword [esi + 4]
push 8
push esi
mov dword [edi], eax
call fcn.00424acd
add esp, 8
jmp 0x4972aa
call fcn.00497ad0
mov edx, eax
call fcn.004977b0
imul edx, eax
lea edi, [esi + 4]
add ebx, edx
mov esi, dword [edi]
test esi, esi
jne 0x497270
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], 0
je 0x4972ef
push 8
call fcn.00424a9d
mov edi, dword [ebp - 0xc]
mov esi, eax
add esp, 4
mov dword [esi], edi
mov ecx, dword [0x54eaa8]
mov dword [esi + 4], ecx
mov ecx, edi
call fcn.00497ad0
mov edx, eax
call fcn.004977b0
imul edx, eax
mov dword [0x54eaa8], esi
add ebx, edx
mov dword [ebp - 4], ebx
cmp ebx, 1
jb 0x49739f
lea eax, [ebp - 0x40]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 0xc], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x54eaa8]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x497389
xor eax, eax
mov ecx, dword [ebx]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.00497ad0
mov edx, eax
call fcn.004977b0
imul eax, edx
mov esi, 1
xor edx, edx
imul eax, dword [ebp - 0x2c]
div dword [ebp - 4]
cmp eax, esi
cmovae esi, eax
push esi
call fcn.00497480
mov edi, dword [ebx]
mov ecx, edi
add dword [ebp - 8], esi
call fcn.004977b0
mov edx, eax
mov eax, dword [ebp - 0xc]
cmp eax, edx
jae 0x497374
call fcn.004977b0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], edx
mov ebx, dword [ebx + 4]
cmovae esi, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
cmovae edi, dword [ebp - 0x1c]
test ebx, ebx
jne 0x497321
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x49739f
sub esi, eax
add esi, ecx
mov ecx, edi
push esi
call fcn.00497480
push 0x54ea90
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497ae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x7c
push esi
mov esi, ecx
mov eax, ebx
xor ecx, ecx
mul edx
push edi
mov dword [esi], vtable.DCDstrbtdPrcssng.0
seto cl
mov dword [esi + 4], ebx
neg ecx
mov dword [esi + 8], ebx
or ecx, eax
mov dword [esi + 0xc], 2
push ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
call fcn.00424adb
imul ecx, ebx, 0x7c
mov dword [esi + 0x24], eax
push ecx
push 0
push eax
call fcn.0042fca0
add esp, 0x10
lea eax, [esi + 0x28]
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [esi + 0x24]
push 0
push 0
push 1
mov dword [eax], 1
mov eax, dword [esi + 0x24]
push 0
mov dword [eax + 8], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x24]
mov edi, 1
mov dword [ebp - 4], edi
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0x18], esi
cmp ebx, edi
jbe 0x497cbb
mov ebx, 0x7c
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x24]
push 0
push 1
push 1
mov dword [ebx + eax], 0
mov eax, dword [esi + 0x24]
push 0
mov dword [ebx + eax + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call edi
mov ecx, dword [esi + 0x24]
push 0
push 0
push 1
push 0
mov dword [ebx + ecx + 0xc], eax
call edi
mov ecx, dword [esi + 0x24]
mov edi, ebx
mov dword [ebx + ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x18], esi
mov ebx, 4
nop dword [eax + eax]
mov eax, dword [esi + 0x24]
add eax, 0x1c
push 0xfa0
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add edi, 0x18
sub ebx, 1
jne 0x497c10
mov edi, dword [ebp - 4]
mov ecx, esi
push 2
push edi
call fcn.004975e0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x24]
push ebx
mov ebx, dword [ebp - 8]
add eax, ebx
push eax
push 0x4973c0
push 0
push 0
call fcn.00435f2d
mov ecx, dword [esi + 0x24]
add esp, 0x18
push 0
push eax
mov dword [ebx + ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
cmp edi, eax
jb 0x497bb6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [eax - 1]
mov edi, 0x7c
mov dword [ebp + 8], ecx
nop
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
jne 0x497cb0
nop dword [eax]
push 1
call ebx
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
je 0x497ca0
mov ecx, dword [ebp + 8]
add edi, 0x7c
sub ecx, 1
mov dword [ebp + 8], ecx
jne 0x497c90
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b18c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5096ab
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5462f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, edx
call fcn.004b30c0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4b19f9
mov ecx, dword [eax + 0x48]
lea ebx, [eax + 0x44]
sub ecx, dword [ebx]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x18], esi
cmp esi, 3
jae 0x4b19e2
push dword [ebp + 8]
push 0
call fcn.004f1180
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
add esi, 0x445
mov eax, dword [ebp - 0x10]
push edi
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp - 0x10]
push 1
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], edi
cmp dword [ebx + 8], ecx
je 0x4b19a2
mov edx, edi
mov dword [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4b1986
sub edx, esi
sar edx, 1
push edx
push edi
call fcn.00404230
add dword [ebx + 4], 0x18
jmp 0x4b19ae
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.00406320
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4b19ba
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4b19ce
push edi
call fcn.00424a98
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80000006
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b57e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0xfffffffe
call fcn.004b5770
cmp eax, 0xffff0300
jb 0x4b58e3
push 0x52b62c
push 0x81
push dword [0x55eaa4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4b58da
push edi
push dword [0x55eaa4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [0x55eaa4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [ebp - 4], eax
call fcn.00424adb
add esp, 4
mov dword [ebp - 0xc], eax
push 0x10000
call fcn.00424adb
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push dword [ebp - 4]
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.0042fe00
add esp, 0xc
mov ecx, esi
call fcn.004edce0
test eax, eax
je 0x4b5888
mov edx, esi
mov ecx, edi
call fcn.004edc90
jmp 0x4b58a1
push 0
push 0
push dword [ebp - 4]
lea edx, [ebp - 0xc]
push esi
lea ecx, [ebp - 8]
call fcn.004bfa90
mov edi, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [0x55c990]
lea edx, [ebp - 0x10]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1a8]
test eax, eax
js 0x4b58c8
call fcn.004b58f0
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [0x55c904], eax
push esi
call fcn.00424a98
add esp, 4
push edi
call fcn.00424a98
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xf
pop ebx
mov esp, ebp
pop ebp
ret