joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5914bc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5914d3
add esp, 0xfffffff0
call fcn.00408024
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bbaf8
mov eax, dword [0x5dc9c4]
cmp byte [eax], 0
jne 0x591500
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5dccf4]
cmp word [eax + 2], 0
jne 0x59151a
mov eax, dword [0x5dccf4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00593790
mov eax, dword [0x5dce20]
cmp word [eax + 2], 0
jne 0x591534
mov eax, dword [0x5dce20]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00593994
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4e77c0]
call fcn.004ed924
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x593f0c
mov dl, 1
mov eax, dword [0x4848f8]
call fcn.00407988
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x4848f8]
call fcn.00407988
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4ec1e8]
call fcn.004f6f34
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x59171c
mov eax, dword [0x5dcbac]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004f73cc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5941f4
mov dl, 1
mov eax, dword [0x4848f8]
call fcn.00407988
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5dcbac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421a28
test eax, eax
je 0x59164e
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421864
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421a0c
test eax, eax
je 0x591666
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a39c
push ebx
push 0x59316c
call fcn.00586bb0
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5dc9c4]
cmp byte [eax], 0
jne 0x5916b7
mov eax, ebx
call fcn.00591900
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.0059442c
mov eax, ebx
call fcn.00595098
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x591714
call fcn.0040807c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x591c44
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x591ce6
cmp dword [ebx + 0xac], 0
jne 0x591ce0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x591b80
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x591ce0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x591ca6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x591ce0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a6adc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x591cb5
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x591f24
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5e374c]
cmp dword [eax + 0x188], 0
je 0x59209e
test bl, bl
jne 0x591fe9
cmp dword [esi + 0xb4], 0
jne 0x591fde
mov eax, esi
call fcn.00594ee8
push eax
push 0x591e18
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x591faf
mov eax, dword [0x5e374c]
cmp byte [eax + 0xeb], 0
je 0x591faf
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x591f90
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x591faf
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x591f98
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x591fde
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6adc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x591fbe
inc dword [esi + 0xb4]
jmp 0x59209e
cmp dword [esi + 0xb4], 0
jle 0x59209e
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x59209e
cmp dword [esi + 0x58], 0
je 0x592053
mov eax, dword [0x5e374c]
cmp byte [eax + 0xeb], 0
je 0x592053
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x592034
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x592053
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x59203c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x592082
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6adc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x592062
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x583a10]
call fcn.0040b898
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x592cf8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x592d55
cmp byte [ebx + 0xeb], 0
jne 0x592d55
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409940
mov eax, dword [esi]
test eax, eax
je 0x592d42
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x592d62
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409b98
jmp 0x592d62
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409b98
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x594614
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x594685
mov eax, esi
call fcn.005c2024
test al, al
je 0x594685
mov eax, dword [ebx + 0x98]
call fcn.005c1c54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x594685
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x594676
push 0
mov eax, dword [ebx + 0x98]
call fcn.005c1c54
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.005b8898
jmp 0x594685
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.0059444c
pop esi
pop ebx
ret
Function at 0x598f7c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x598ff6
mov eax, dword [ebx + 8]
call fcn.005c1c54
mov ecx, eax
mov dl, 1
mov eax, dword [0x50f48c]
call fcn.005bbf54
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.005155c0
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x59884c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005c1c54
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005c1c54
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x59906c
mov eax, dword [ebx + 8]
call fcn.005c1c54
mov ecx, eax
mov dl, 1
mov eax, dword [0x50f48c]
call fcn.005bbf54
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.005155c0
mov dword [esi + 0x2bc], ebx
mov dword [esi + 0x2b8], 0x598898
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005c1c54
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005c1c54
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5990d8
mov eax, dword [ebx + 8]
call fcn.005c1c54
mov ecx, eax
mov dl, 1
mov eax, dword [0x510c1c]
call fcn.005bbf54
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x290], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005c1c54
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005c1c54
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5a28a4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.004097b8
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x5a28f6
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x5a28ef
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040a39c
jmp 0x5a28f6
mov eax, esi
call fcn.004097b8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5a81d0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a832f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5dc830], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4e1b70]
call fcn.004e2cbc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5a8305
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004e2da4
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a39c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5a8348
call fcn.0040a54c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004e3030
test al, al
je 0x5a82ef
lea ecx, [ebp - 4]
mov edx, 0x5a83bc
mov eax, dword [ebp - 0xc]
call fcn.004e38bc
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042926c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5a82ef
xor edx, edx
push ebp
push 0x5a82e8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5a83d4
mov eax, dword [ebp - 8]
push eax
call fcn.00412cd0
test eax, eax
je 0x5a82d1
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5a82d1
call fcn.005a815c
test eax, eax
je 0x5a82c1
mov eax, dword [ebx + 0x50]
jmp 0x5a82c4
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x5dc830]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a82ef
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a830c
mov eax, dword [ebp - 0xc]
call fcn.004079b8
ret

Function at 0x5a8438
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x5a847f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5a8462
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5a8473
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x5a847f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5b5e60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5e37f0], 0
je 0x5b5fa1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x5dcdec]
mov edx, dword [edx]
xor al, byte [edx + 0xd4]
je 0x5b5fa1
mov eax, dword [0x5e37f4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5e37f0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x5b5f70
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5e37f0]
call fcn.004a6adc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x5b5f68
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x205], 0
je 0x5b5f68
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x6c]
test al, al
je 0x5b5f68
mov eax, dword [ebp - 0x14]
call fcn.005c1c54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5b5f68
push ebp
call fcn.005b5e1c
pop ecx
test al, al
jne 0x5b5f68
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffb9
call fcn.00407d74
test al, al
je 0x5b5f68
mov byte [ebp - 9], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 9]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407d74
cmp byte [ebp - 9], 0
je 0x5b5f68
lea edx, [ebp - 8]
lea eax, [ebp - 0x28]
call fcn.004108d4
test al, al
je 0x5b5f68
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5e37f4]
call fcn.005b5564
inc edi
dec ebx
jne 0x5b5ec5
mov eax, dword [0x5e37f4]
cmp dword [eax + 8], 0
jle 0x5b5f88
mov eax, dword [0x5e37f4]
call fcn.005b5618
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5b5fa1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005b5c84
pop ecx
test al, al
jne 0x5b5fa1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5be6e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00410dbc
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.005b84a4
test ebx, ebx
jne 0x5be73b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.005be560
mov ebx, eax
test ebx, ebx
je 0x5be831
cmp esi, ebx
je 0x5be764
mov eax, dword [esp]
sub eax, dword [ebx + 0x50]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x54]
mov dword [esp + 0x118], eax
jmp 0x5be779
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x5be7b1
add eax, 0xffffff5f
sub eax, 2
jb 0x5be7c9
dec eax
sub eax, 2
jb 0x5be7dd
dec eax
sub eax, 2
jb 0x5be7d3
jmp 0x5be7e7
add eax, 0xfffffdff
sub eax, 2
jb 0x5be7c9
dec eax
sub eax, 2
jb 0x5be7dd
dec eax
sub eax, 2
jb 0x5be7d3
jmp 0x5be7e7
mov byte [esp + 0x120], 0
jmp 0x5be7ef
mov byte [esp + 0x120], 2
jmp 0x5be7ef
mov byte [esp + 0x120], 1
jmp 0x5be7ef
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00586c60
mov esi, eax
call fcn.005b4f10
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.005b9f00
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x5be833
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x5cedd4
Capabilities:
Create thread

Disassembly:
push ecx
dec eax
jne 0x5ceded
push esp
push 0
push 0
push 0x5ced94
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
ret
pop edx
ret
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
add byte [ecx + 0x5604244c], cl
push edi
test al, 1
je 0x40b536
mov edi, dword [ebp + 0x10]
xor eax, eax
shr byte [edx + 8], 0x66
mov dword [esp + 0x5c], 0x7c890001
and al, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420ff6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b68a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x40a10a
or eax, 1
mov dword [0x4c7488], 0
push 0x43b83c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422f80
add esp, 4
jmp 0x40a01f
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x40a064

Function at 0x40a010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
add byte [ecx + 0x5604244c], cl
push edi
test al, 1
je 0x40b536
mov edi, dword [ebp + 0x10]
xor eax, eax
shr byte [edx + 8], 0x66
mov dword [esp + 0x5c], 0x7c890001
and al, 0x24
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], 1
call fcn.00420ff6
mov edx, eax
mov dword [esp + 0x20], eax
add esp, 4
test edx, edx
je 0x40b68a
mov dword [edx], 0x14
mov esi, dword [ebp + 0xc]
mov dword [edx + 4], 0
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [esp + 0x50], 1
mov dword [esp + 0x10], 0x17
mov eax, dword [edx + 4]
mov eax, dword [eax + ecx*4]
movsx eax, word [eax + 0xa]
mov dword [esp + 0x5c], eax
jmp 0x40a10a
or eax, 1
mov dword [0x4c7488], 0
push 0x43b83c
mov dword [0x4c7480], eax
mov dword [0x4c7490], 0
mov dword [0x4c7494], 1
call fcn.00422f80
add esp, 4
jmp 0x40a01f
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x40a064
Function at 0x486a0a
Capabilities:
Encode data using xor

Disassembly:
add bh, bh
aaa
call esi
cmp dword [0x4c67b8], ebx
jne 0x486a23
mov ecx, 0xfa7d0275
mov word [edi - 0x74f7ff7a], cx
mov al, 1
pop edi
xor eax, eax
cmc
clc
sub byte [eax], al
dec dword [ecx + 0x7d835174]
adc al, 0xff
clc
xor esi, dword [ebp + 0x3f]
and al, 0xec
push esi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x50107da0], 0
jne 0xc342e7f8
call 0x493f7aaa
add dword [ecx + 0x107da086], ecx
push eax
mov dword [esi + 0x50107da4], eax
mov dword [edi + 0xc], eax
cmp dword [esi + 0x50107da0], 0
jne 0x474bd4f8
xor al, al
pop edi
xor ebp, esp
inc eax
add al, 0x47
adc byte [ebx], dh
lea eax, [ebp - 4]
mov ecx, 0x4c67b0
push eax
adc byte [ebx], dh
fist dword [eax + 0x48]
add al, 0x14
call 0x58402434
push 0x8bdd74b8
dec ebp
or byte [ecx + 0x6a4c6810], ah
mov esi, dword [ebp - 4]
cld
add al, 0x88
mov edi, dword [0xa1144589]
and al, 0x68
dec esp
push 0xffffffffffffff8b
add al, 0xb0
mov ecx, dword [eax]
mov al, byte [ecx + 0x28105e90]
cmp al, 0xe
je 0x486a6d
cmp al, 0xf
je 0x486a6d
cmp al, 2
je 0x486a6d
cmp al, 3
je 0x486a6d
cmp dword [ecx + 0xc], 0
jne 0x486a6d
call 0x493f7b28
add eax, edi
jle 0x486ad4
mov ecx, dword [ebp + 0x14]
mov dword [edi + 0xc], eax
mov dword [ecx + 0x50107da4], eax
mov eax, dword [0x6a4c6824]
mov eax, dword [eax + esi*4]
adc al, 0x89
inc edi
or al, 0x89
and dword [ebp + edi*2 + 0x24a15010], 0x8b6a4c68
add al, 0xb0
mov ecx, dword [eax]
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
cmp dword [edi + 0xc], 0
xor eax, dword [ebp + esi*2 - 0x3900af10]
xchg dword [edx - 0x74f80000], edx
mov al, 1
jmp 0xff995b6f
Function at 0x48e551
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + 0xc]
dec ecx
mov dword [ebx], esi
mov dword [eax], ecx
xor eax, eax
jmp 0x48e56c
pop edi
or byte [esp + ebp*8], dl
inc eax
add al, 0xc3
dec dword [ecx + 0x50ec8374]
add byte [edx - 0x740606ee], ch
fimul dword [ecx + 0x378bf87d]
add esi, 2
movzx eax, word [esi]
mov si, word [esp + esi*2 + 0x36]
xor edx, edx
mov dword [ebx], edx
cmp eax, 0x7b
jne 0x48e5e3
cmp word [esi + 2], 0x5e
jne 0x48e5a9
mov dword [ebx], 0x48de851
add esi, 2
mov eax, edx
add esi, 2
movzx ecx, word [esi]
test cx, cx
je 0x48e5c6
cmp ecx, 0x7d
je 0x48e5da
mov word [ebp + eax*2 - 0x50], cx
inc eax
cmp eax, 0x1f
jl 0x48e5ab
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xab006a2e
sub al, 0x53
mov dword [edi], esi
pop edi
or byte [esp + ebp*8], dl
inc eax
add al, 0xc3
xor ecx, ecx
mov word [ebp + eax*2 - 0x50], cx
jmp 0x48e5ed
mov word [ebp - 0x50], ax
jne 0xb28e6f70
mov eax, 0xf800a9
mov dword [edi], esi
mov dword [ebp - 0xc], eax
lea ecx, [eax + edx]
lea eax, [ebp - 0x50]
sar ecx, 1
mov dword [ebp - 4], eax
imul eax, ecx, 6
movzx ebx, word [eax + 0x4b8f80]
add ebx, 0x54b8a20
add dword [ebp - 4], edi
movzx edi, word [eax]
test di, di
jne 0x48e622
cmp byte [ebx], 0x78
je 0x48e66e
movzx edi, word [eax]
add eax, 2
mov dword [ebp - 4], eax
movzx eax, byte [ebx]
inc ebx
mov dword [ebp - 0x10], edi
cmp di, ax
mov edi, dword [ebp - 8]
je 0x48e612
cmp ax, word [ebp - 0x10]
sbb eax, eax
neg eax
lea eax, [eax*2 - 1]
pushal
xor dword [ecx + 0x7e], 8
mov eax, dword [ebp - 0xc]
lea edx, [ecx + 1]
jmp 0x48e65c
cmp edx, eax
jl 0x48e5f7
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x1a2ae82f
jmp 0x48e5cf
imul esi, ecx, 6

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219