joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae690
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x4ae6cb
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x4ae6cb
cmp esi, dword [edi + 0xe4]
je 0x4ae6cb
cmp byte [edi + 0xdc], 0
jne 0x4ae6cb
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe4]
cmp esi, eax
je 0x4ae7c6
test eax, eax
je 0x4ae73a
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x20], 0x14
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.004ae200
mov dword [edi + 0xe4], 0
test esi, esi
je 0x4ae7c6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x4ae7c6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x4ae7c6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x4ae7c6
xorps xmm0, xmm0
mov dword [edi + 0xe4], esi
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 4], 0
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe4]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x120]
push 1
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0xe4]
mov ecx, edi
call fcn.004ae200
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4af5b0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xfffffffffffffff0
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4af65f
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
mov ecx, 0x55163c
mov dword [ebp - 4], ebx
call fcn.0047eea0
dec eax
mov dword [ebp + 8], eax
js 0x4af6a1
push eax
mov ecx, 0x55163c
call fcn.004a61d0
cmp dword [ebp - 4], 0
mov edi, eax
je 0x4af648
mov ecx, edi
call fcn.004a9e40
cmp dword [esi], eax
je 0x4af61b
mov ecx, edi
call fcn.004a9e40
cmp ebx, eax
jne 0x4af63b
push esi
mov ecx, edi
call fcn.004af550
test al, al
jne 0x4af656
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.004ad2d0
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
test ebx, ebx
jne 0x4af605
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
js 0x4af6a1
mov ebx, dword [ebp - 4]
jmp 0x4af5f2
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x55163c
xor edi, edi
call fcn.0047eea0
test eax, eax
jle 0x4af6a1
nop
mov ecx, 0x55163c
call fcn.0047eea0
push edi
mov ecx, 0x55163c
call fcn.004a61d0
mov ebx, eax
mov ecx, ebx
call fcn.004a9e40
cmp dword [esi], eax
je 0x4af6aa
mov ecx, 0x55163c
inc edi
call fcn.0047eea0
cmp edi, eax
jl 0x4af670
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.004af550
test al, al
jne 0x4af656
cmp dword [esi + 8], 0xe5
jne 0x4af6c9
push dword [esi]
call sub.IMM32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
lea eax, [ebp - 8]
mov ecx, ebx
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.004ad2d0
pop edi
test al, al
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b1220
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b1265
cmp byte [ebp + 8], 0
je 0x4b1259
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x4bae40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50390b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push eax
mov dword [edi + 0x10], esi
call fcn.004ba4c0
mov ecx, esi
call fcn.004b6670
mov ecx, dword [edi + 0x10]
mov esi, eax
or esi, 0x40000080
call fcn.004c9ef0
test al, 1
je 0x4baea2
or esi, 1
jmp 0x4baea9
test al, 2
je 0x4baea9
or esi, 2
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.004bb080
test al, al
je 0x4baeba
or esi, 0x20
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov ecx, ebx
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ebx]
push esi
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.004a9e40
push eax
mov ecx, edi
call fcn.004b0b70
mov ecx, dword [edi + 0x10]
call fcn.004b86a0
cmp eax, 0xffffffff
je 0x4baf09
mov ecx, dword [edi + 0x10]
push eax
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.004a9720
test eax, eax
jne 0x4baf1a
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.004a9640
mov eax, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
push 0
call fcn.004baa60
push eax
push 0xc5
push dword [edi + 4]
call esi
mov ebx, dword [edi + 0x10]
mov ecx, ebx
call fcn.004bb080
test al, al
je 0x4baf64
push 0
mov ecx, ebx
call fcn.004baa90
movzx eax, ax
push eax
push 0xcc
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0041d430
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.004a60c0
push 0
push 0
push 0xb9
push dword [edi + 4]
call esi
push 0
push 3
push 0xd3
mov ecx, edi
call fcn.004b1090
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [edi + 0x10]
push 0
call fcn.004bb090
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push 0xcf
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x10]
call fcn.004bb070
push dword [edi + 4]
test al, al
je 0x4bb02d
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
mov ecx, 1
cmove eax, ecx
push eax
push 0
jmp 0x4bb035
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push eax
push eax
push 0xb1
push dword [edi + 4]
call esi
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb0a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b2350
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x4bb131
lea eax, [ebp - 0x14]
push eax
call fcn.004ba4c0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4bb107
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4bb150
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4bb1db
cmp dword [esi + 0x10], 0
je 0x4bb1db
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004f1ca0
mov ebx, esp
test ebx, ebx
je 0x4bb1db
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1e4
call fcn.004a6160
mov ecx, dword [esi + 0x10]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call fcn.004ae200
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.004aa590
test al, al
je 0x4bb1db
mov ecx, dword [esi + 0x10]
call fcn.004b2220
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4bbfe0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.004b4ad0
mov ecx, dword [esi + 0x7e8]
test ecx, ecx
je 0x4bc079
lea eax, [ebp - 0x14]
push eax
call fcn.004ba4c0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4bc04f
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x7e8]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4db2e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50361b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp - 4], 1
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4db33d
mov esi, dword [esi]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x810]
push esi
push 0x400
push ecx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x50d8cc
push eax
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
cmp word [ebp - 0x810], ax
jne 0x4db390
xor ecx, ecx
jmp 0x4db3af
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4db3a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.0040aeb0
cmp dword [ebp - 0x818], 0
setne bl
cmp dword [ebp - 0x814], 8
jb 0x4db3e3
push dword [ebp - 0x828]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
je 0x4db470
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
cmp word [ebp - 0x810], ax
jne 0x4db415
xor ecx, ecx
jmp 0x4db42f
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4db420
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.0040aeb0
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x551978
call fcn.00491120
cmp dword [ebp - 0x814], 8
jb 0x4db47e
push dword [ebp - 0x828]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x4db47e
lea eax, [ebp + 0x20]
mov ecx, 0x551978
push eax
call fcn.00493780
cmp dword [ebp + 0x1c], 8
jb 0x4db48f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x4db4b4
push dword [ebp + 0x20]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret
Function at 0x4de590
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x79c], 0
je 0x4de5ff
cmp dword [ebp + 8], 0x100
jne 0x4de5ef
cmp word [ebp + 0xc], 0xd
jne 0x4de5ef
cmp byte [esi + 0x7a2], 0
je 0x4de5ce
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4de5ef
cmp byte [esi + 0x7a3], 0
jne 0x4de5ef
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x4de5e8
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.004ae200
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x79c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x4e2400
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50390b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [eax + 0x7f8], 0
cmp dword [edi + 4], 0
jne 0x4e24ad
lea eax, [ebp - 0xa4]
push eax
call fcn.004e1f50
mov ecx, dword [edi + 0x10]
movdqu xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movdqu xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
call dword [eax + 0x24]
mov ecx, eax
call fcn.004a9e40
push eax
mov ecx, edi
call fcn.004b0b70
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.004b86a0
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.004a98c0
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.004a6a90
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.004a60c0
test bl, bl
je 0x4e24f1
mov eax, dword [edi + 0x10]
add eax, 0x7e8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, 0x7e8
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 4
Function at 0x4e2540
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b2350
mov ecx, dword [esi + 0x800]
test ecx, ecx
je 0x4e25d1
lea eax, [ebp - 0x14]
push eax
call fcn.004e1f50
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4e25a7
mov ecx, dword [esi + 0x800]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x800]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4e26e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x546320]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movdqu xmmword [eax], xmm0
call fcn.004b4ad0
mov ecx, dword [esi + 0x800]
test ecx, ecx
je 0x4e2779
lea eax, [ebp - 0x14]
push eax
call fcn.004e1f50
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4e274f
mov ecx, dword [esi + 0x800]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [esi + 0x800]
push 0
call fcn.0047eea0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f14ca
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4e62c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.004a9e70
mov edi, eax
add esp, 8
test edi, edi
jne 0x4e6364
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e6359
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
test eax, eax
je 0x4e6359
push eax
mov dword [ebp + 8], edi
call fcn.004f139a
add esp, 4
mov edi, eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp dword [ebp + 8], eax
je 0x4e6355
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x4e6367
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push edi
mov ecx, ebx
call fcn.004e6390
push edi
mov esi, eax
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ede30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x4ede57
cmp eax, edi
jge 0x4ede4f
push esi
call fcn.004e9ca0
add esp, 4
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4ede80
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4ede63
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4ede9c
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4ede8d
xor dl, dl
jmp 0x4ede92
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4ede83
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4eded1
pop edi
pop esi
mov dword [ebp + 8], str.zlib_corrupt
pop ebp
jmp fcn.004e9bb0
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4edee9
pop edi
pop esi
mov dword [ebp + 8], str.read_past_buffer
pop ebp
jmp fcn.004e9bb0
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4edf07
push edi
push ecx
push esi
call fcn.004f10b0
add esp, 0xc
test eax, eax
jne 0x4edf07
pop edi
pop esi
pop ebp
ret
push edi
push dword [esi]
push dword [esi + 0x10]
call sub.MSVCR120.dll_memcpy
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
Function at 0x43b652
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
mov ecx, ebx
sub ecx, 0x34736d7d
add ecx, 0x4b0ed7bf
call fcn.0043b69c
mov ecx, 0x50c4f94e
inc ecx
xor dword [edx], eax
add ecx, 1
mov ecx, ecx
or ebx, ecx
inc edx
mov ebx, 0xae45e1d7
cmp edx, esi
jne fcn.0043b652
mov ebx, 0xaa7a90d
and ecx, ebx
ret
Function at 0x40b2d0
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
cmpsd dword [esi], dword es:[edi]
jne 0x40b2e0
cmp eax, dword [esi + 0x2c]
test al, al
je 0xcf40b3a1
add byte [eax], al
iretd
mov ecx, dword [esi + 0x48]
xor eax, eax
push ebx
cmp ecx, 0x66
push edi
mov dword [ebp + 0x35], eax
mov dword [ebp + 8], eax
jne 0x49b395
mov edi, dword [esi + 0x3c]
mov byte [0x91840ff8], al
add byte [eax], al
add byte [edi], bh
pop esi
cmp byte [ebx + 0x52affff], al
xor ecx, 0xffffffff
jmp 0x40b313
cmp edi, 0xffffffff
sub al, byte [0xebfff183]
add cl, byte [ebx + 0x456fdc7]
lea ecx, [ebp - 4]
std
push esi
add al, 0x8d
dec ebp
cld
push 0
push ecx
push eax
pop ss
push edx
call dword [0x40c0ef]
test eax, eax
je 0x40b358
mov eax, dword [ebp - 4]
mov edx, edi
push eax
mov ebx, ecx
push esp
rol byte gs:[ebx - 0x7d4ff2f], 1
xchg ebp, eax
mov ecx, edi
push esi
push eax
test edi, edi
mov dword [esi + 0x64], ecx
ja 0x40b307
mov eax, dword [ebp + 8]
pop edi
xchg dword [edi + 0x3c], esp
add byte [eax], al
add dh, ah
pop ebx
pop esi
mov esp, ebp
jl 0x40b318
str word [ebx + 0x7a6e983d]
add bh, bh
xlatb
mov edi, dword [0x7a6e98]
call edi
test eax, eax
jne 0x40b369
mov dword [ebp - 0x75], eax
jmp 0x40b3bb
jmp [ecx + 0xad28005]
pop ds
jp 0x40b413
imul ecx
mov ecx, edx
shr ecx, 0x1f
rcl cl, cl
lea eax, [edx*4 + 0xfd01]
pop ebp
mov esp, 0x90900004
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sahf
test ecx, ecx
leave
jle 0x40b483
xor edx, edx
lds ecx, [ebp - 0x76]
adc al, 0x37
sbb dword [esi + 0x2efc103], 0x40
mov bh, byte [ecx]
sbb bh, al
inc eax
add byte [eax - 0x2075aeb0], cl
aaa
jb 0x40b3be
pop esp
inc eax
inc byte [ebx - 0x1d3efc1e]
add al, 0xc1
jmp 0x40b444
inc eax
mov dl, byte [edx + 0x40c724]
mov byte [eax - 1], dl
mov bh, byte [eax + 0x37]
dec byte [edx + 0x38d6375c]
loop 0x40b468
shl edx, 2
call 0xd34bbb4c
inc eax
jp 0x40b494
sbb bh, al
or ecx, dword [edx + 0x706980d0]
loop 0x40b434
jae 0x40b415
stosb byte es:[edi], al
and edi, esp
dec esp
and al, 0xa7

Function at 0x40b590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40b59e
mov ebx, dword [eax + 0x20]
mov ecx, dword [eax + 0x18]
jmp 0x40b5ae
add ebx, edx
nop
jmp 0x40b5bd
test ecx, ecx
nop
je 0x40b6bc
nop
nop
xor edi, edi
jmp 0x40b5d8
dec ecx
nop
mov esi, dword [ebx + ecx*4]
jmp 0x40b5ee
add esi, edx
jmp 0x40b601
jmp 0x40b611
xor eax, eax
nop
ror edi, 0xd
nop
lodsb al, byte [esi]
nop
add edi, eax
cmp al, ah
nop
jne 0x40b601
nop
nop
jmp 0x40b633
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jne 0x40b5b0
nop
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
add ebx, edx
nop
jmp 0x40b664
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
mov dword [esp + 0x24], eax
nop
pop ebx
jmp 0x40b67a
pop ebx
nop
popal
nop
jmp 0x40b68f
pop ecx
nop
jmp 0x40b69b
pop edx
nop
jmp 0x40b6ad
push ecx
jmp eax
nop
jmp 0x40b6c8
pop eax
jmp 0x40b6dd