joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4176b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x547110]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x41784a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x4177c3
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm1, xmm4
pcmpgtw xmm1, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm1
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm2, xmm3
psrlw xmm0, 8
paddw xmm2, xmm4
pmullw xmm3, xmm4
psllw xmm2, 1
add eax, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm3, 7
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x417750
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x417830
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm3, xmm2
paddw xmm3, xmm4
pmullw xmm2, xmm4
mov ecx, dword [ebp - 4]
movaps xmm1, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x417743
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x417b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x417b29
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x417b2c
sub eax, 1
jne 0x417b29
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x417b29
push esi
call fcn.00417e70
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x417b29
cmp esi, 0x100
jae 0x417b46
push esi
call fcn.00417cc0
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x417b50
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x547110]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x417cb4
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x417c41
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm2, xmm3
movaps xmm1, xmm3
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
pcmpgtw xmm2, xmm6
movaps xmm0, xmm2
psrlw xmm0, 8
pand xmm1, xmm2
psrlw xmm3, 7
psubw xmm1, xmm0
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x417be2
cmp dword [ebp - 4], 0
je 0x417c9a
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm1, xmm4
punpcklbw xmm3, xmm5
movaps xmm2, xmm4
pcmpgtw xmm1, xmm6
pmullw xmm4, xmm3
paddw xmm2, xmm3
psllw xmm2, 1
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm4, 7
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x417bd3
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x417cc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x547110]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x417e5a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x417dd3
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm1, xmm3
movaps xmm2, xmm3
pmullw xmm3, xmm4
paddw xmm2, xmm4
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psrlw xmm3, 7
psubw xmm2, xmm0
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x417d60
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x417e40
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm1, xmm2
movaps xmm3, xmm2
mov ecx, dword [ebp - 4]
paddw xmm3, xmm4
pmullw xmm2, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x417d53
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x420160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5177ef
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x55c2f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebx + 8]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0xc]
push 0
mov dword [esi], vtable.CDspObj.0
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00420b60
push 0
call fcn.00420be0
push 1
push 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x13c], 0
call fcn.00422230
push 1
call fcn.00420c00
push 0
mov ecx, esi
call fcn.00420c50
push 0
call fcn.00420c60
push 0
mov ecx, esi
call fcn.00420ca0
push 1
call fcn.00420cb0
push 1
call fcn.00420cd0
push 0
call fcn.00420cf0
push 1
mov ecx, esi
call fcn.00421e50
push 0
push 0
call fcn.00421e60
push 0
call fcn.00421ea0
push 0
push 0
push 0
call fcn.00421320
push 0
push 0
push 0
mov ecx, esi
call fcn.004214b0
push 0
push 0
push 0
mov ecx, esi
call fcn.00421510
push 0
push 0
mov ecx, esi
call fcn.00421260
push 0
push 0
mov ecx, esi
call fcn.004212c0
push 0x80
mov ecx, esi
call fcn.00421590
push 0
call fcn.004215b0
push 0
mov ecx, esi
call fcn.004215f0
push 0x100
mov ecx, esi
call fcn.00421640
push 0
mov ecx, esi
call fcn.00421680
push 0
mov ecx, esi
call fcn.00421850
push 0
mov ecx, esi
call fcn.00421ec0
push 0
call fcn.00421ed0
push 0
call fcn.004221b0
push 0x40
lea eax, [esi + 0xc8]
push 0
push eax
call fcn.004e61c0
push 0x10
call fcn.004d9e7d
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.00436390
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
push dword [ebx + 0x10]
mov dword [esi + 0x94], eax
mov ecx, esi
movups xmmword [esi + 0x98], xmm0
movq qword [esi + 0xa8], xmm0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x118], 1
call fcn.00422080
push 0
call fcn.00421df0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x436250
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push ecx
push 0
mov dword [ebp - 4], 0
call fcn.004ad6d0
mov ebx, eax
add esp, 8
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436270
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4362f4
push esi
push edi
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
sub ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4362b0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x576080]
call dword [sym.imp.USER32.dll_OpenClipboard]
pop esi
test eax, eax
je 0x4362f4
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 1
push ebx
call fcn.004d9e78
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436310
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
push 0xd
mov edi, ecx
xor esi, esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x436382
push dword [0x576080]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x436382
push ebx
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x43637b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test edi, edi
je 0x436362
mov ecx, esi
sub edi, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x436352
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x436365
sub esi, ecx
push ebx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x44c7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x14]
pop ebp
jmp fcn.00436ae0

Function at 0x4503d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x7c
push esi
mov esi, ecx
mov eax, ebx
xor ecx, ecx
mul edx
push edi
mov dword [esi], vtable.DCDstrbtdPrcssng.0
seto cl
mov dword [esi + 4], ebx
neg ecx
mov dword [esi + 8], ebx
or ecx, eax
mov dword [esi + 0xc], 2
push ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
call fcn.004d9ebb
imul ecx, ebx, 0x7c
mov dword [esi + 0x24], eax
push ecx
push 0
push eax
call fcn.004e61c0
add esp, 0x10
lea eax, [esi + 0x28]
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [esi + 0x24]
push 0
push 0
push 1
mov dword [eax], 1
mov eax, dword [esi + 0x24]
push 0
mov dword [eax + 8], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x24]
mov edi, 1
mov dword [ebp - 4], edi
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0x18], esi
cmp ebx, edi
jbe 0x4505ab
mov ebx, 0x7c
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x24]
push 0
push 1
push 1
mov dword [ebx + eax], 0
mov eax, dword [esi + 0x24]
push 0
mov dword [ebx + eax + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call edi
mov ecx, dword [esi + 0x24]
push 0
push 0
push 1
push 0
mov dword [ebx + ecx + 0xc], eax
call edi
mov ecx, dword [esi + 0x24]
mov edi, ebx
mov dword [ebx + ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x18], esi
mov ebx, 4
nop dword [eax + eax]
mov eax, dword [esi + 0x24]
add eax, 0x1c
push 0xfa0
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add edi, 0x18
sub ebx, 1
jne 0x450500
mov edi, dword [ebp - 4]
mov ecx, esi
push 2
push edi
call fcn.00450a90
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x24]
push ebx
mov ebx, dword [ebp - 8]
add eax, ebx
push eax
push 0x450c20
push 0
push 0
call fcn.004ead83
mov ecx, dword [esi + 0x24]
add esp, 0x18
push 0
push eax
mov dword [ebx + ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
cmp edi, eax
jb 0x4504a6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [eax - 1]
mov edi, 0x7c
mov dword [ebp + 8], ecx
nop
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
jne 0x4505a0
nop dword [eax]
push 1
call ebx
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
je 0x450590
mov ecx, dword [ebp + 8]
add edi, 0x7c
sub ecx, 1
mov dword [ebp + 8], ecx
jne 0x450580
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x450ce0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x566070
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x566088]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 0x566088
test esi, esi
je 0x450d53
nop
mov ecx, dword [esi]
cmp dword [ebp - 0xc], ecx
jne 0x450d36
cmp dword [ebp - 8], 0
jne 0x450d24
push 0
call fcn.00450b70
mov eax, dword [esi + 4]
push 8
push esi
mov dword [edi], eax
call fcn.004d9ead
add esp, 8
jmp 0x450d4a
call fcn.00420c40
mov edx, eax
call fcn.00434910
imul edx, eax
lea edi, [esi + 4]
add ebx, edx
mov esi, dword [edi]
test esi, esi
jne 0x450d10
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], 0
je 0x450d8f
push 8
call fcn.004d9e7d
mov edi, dword [ebp - 0xc]
mov esi, eax
add esp, 4
mov dword [esi], edi
mov ecx, dword [0x566088]
mov dword [esi + 4], ecx
mov ecx, edi
call fcn.00420c40
mov edx, eax
call fcn.00434910
imul edx, eax
mov dword [0x566088], esi
add ebx, edx
mov dword [ebp - 4], ebx
cmp ebx, 1
jb 0x450e3f
lea eax, [ebp - 0x40]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 0xc], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x566088]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x450e29
xor eax, eax
mov ecx, dword [ebx]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.00420c40
mov edx, eax
call fcn.00434910
imul eax, edx
mov esi, 1
xor edx, edx
imul eax, dword [ebp - 0x2c]
div dword [ebp - 4]
cmp eax, esi
cmovae esi, eax
push esi
call fcn.00450b70
mov edi, dword [ebx]
mov ecx, edi
add dword [ebp - 8], esi
call fcn.00434910
mov edx, eax
mov eax, dword [ebp - 0xc]
cmp eax, edx
jae 0x450e14
call fcn.00434910
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], edx
mov ebx, dword [ebx + 4]
cmovae esi, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
cmovae edi, dword [ebp - 0x1c]
test ebx, ebx
jne 0x450dc1
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x450e3f
sub esi, eax
add esi, ecx
mov ecx, edi
push esi
call fcn.00450b70
push 0x566070
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519d78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55c2f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, edx
call fcn.0046db70
mov dword [ebp - 0x10], eax
test eax, eax
je 0x46fa69
mov ecx, dword [eax + 0x48]
lea ebx, [eax + 0x44]
sub ecx, dword [ebx]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x18], esi
cmp esi, 3
jae 0x46fa52
push dword [ebp + 8]
push 0
call fcn.004ad6d0
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
add esi, 0x445
mov eax, dword [ebp - 0x10]
push edi
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp - 0x10]
push 1
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], edi
cmp dword [ebx + 8], ecx
je 0x46fa12
mov edx, edi
mov dword [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x46f9f6
sub edx, esi
sar edx, 1
push edx
push edi
call fcn.00451710
add dword [ebx + 4], 0x18
jmp 0x46fa1e
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.00470bd0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x46fa2a
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x46fa3e
push edi
call fcn.004d9e78
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80000006
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0xfffffffe
call fcn.00473de0
cmp eax, 0xffff0300
jb 0x473d73
push 0x540810
push 0x81
push dword [0x576084]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x473d6a
push edi
push dword [0x576084]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [0x576084]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [ebp - 4], eax
call fcn.004d9ebb
add esp, 4
mov dword [ebp - 0xc], eax
push 0x10000
call fcn.004d9ebb
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push dword [ebp - 4]
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.004e6320
add esp, 0xc
mov ecx, esi
call fcn.004ab5a0
test eax, eax
je 0x473d18
mov edx, esi
mov ecx, edi
call fcn.004ab550
jmp 0x473d31
push 0
push 0
push dword [ebp - 4]
lea edx, [ebp - 0xc]
push esi
lea ecx, [ebp - 8]
call fcn.00479700
mov edi, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [0x573f70]
lea edx, [ebp - 0x10]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1a8]
test eax, eax
js 0x473d58
call fcn.00473c50
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [0x573ee4], eax
push esi
call fcn.004d9e78
add esp, 4
push edi
call fcn.004d9e78
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xf
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474e60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x55c2f8]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x573fcc], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x474f67
call edi
cmp dword [0x5740a8], eax
ja 0x474f67
cmp dword [0x5740a4], 0
je 0x474f04
lea eax, [esp + 0x14]
push eax
push dword [0x576080]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00472f20
push eax
call fcn.00481a90
mov edx, dword [eax]
call fcn.00481a80
mov ecx, dword [eax]
call fcn.00474af0
add esp, 0xc
call fcn.00471b70
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
div ecx
mov esi, eax
call edi
mov dword [0x5740a4], 0
jmp 0x474f4b
call fcn.00472f20
cmp eax, 1
jne 0x474f53
call fcn.00471ec0
test eax, eax
je 0x474f53
push 0
push 0
call fcn.00472f20
push eax
call fcn.00481a90
mov edx, dword [eax]
call fcn.00481a80
mov ecx, dword [eax]
call fcn.00474af0
add esp, 0xc
call fcn.00471b70
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
div ecx
mov esi, eax
call edi
inc eax
add eax, esi
mov dword [0x574098], eax
mov dword [0x573fcc], 0
mov dword [0x5740a8], 0
cmp dword [0x5740bc], 0
je 0x474fdd
cmp dword [0x5763f4], 0
je 0x474fd3
call fcn.004a78b0
test eax, eax
jne 0x474fd3
call fcn.004a7c60
test eax, eax
jne 0x474fd3
call fcn.00477e00
test eax, eax
jne 0x474fd3
call fcn.00472f20
neg eax
sbb esi, esi
inc esi
call fcn.00481a90
mov edx, dword [eax]
call fcn.00481a80
push 0
push 0
push esi
mov ecx, dword [eax]
call fcn.00474af0
add esp, 0xc
test eax, eax
je 0x474fd3
push 0
call fcn.00472f20
mov edx, eax
mov ecx, 1
call fcn.004afe60
add esp, 4
mov dword [0x5740bc], 0
cmp dword [0x574098], 0
je 0x474fff
call edi
cmp dword [0x574098], eax
ja 0x474fff
call fcn.004759c0
mov dword [0x574098], 0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.004d9e67
mov esp, ebp
pop ebp
ret

Function at 0x478130
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
call fcn.00477e00
test eax, eax
je 0x478199
mov eax, edi
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [0x57452c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
test edi, edi
push 0
cmovne eax, dword [0x574418]
push eax
push 0x30
push dword [0x57452c]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x576080]
call dword [sym.imp.IMM32.dll_ImmGetDefaultIMEWnd]
xor ecx, ecx
test edi, edi
push 0
setne cl
add ecx, 0x21
push ecx
push 0x283
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x574528], edi
pop edi
ret