joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73ec00
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x7ccea9], 0
push 0x73ed8c
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x73eda8
push ebx
call fcn.00412f74
mov esi, eax
test esi, esi
je 0x73eca8
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x73eca8
cmp word [esp], 0
je 0x73eca8
mov byte [0x7ccea9], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x73ec6c
sub ax, 0xb4
je 0x73ec78
sub ax, 0x8464
je 0x73ec84
sub ax, 0x2400
je 0x73ec90
jmp 0x73ec9c
mov byte [0x7afdad], 1
jmp 0x73ed44
mov byte [0x7afdad], 3
jmp 0x73ed44
mov byte [0x7afdad], 2
jmp 0x73ed44
mov byte [0x7afdad], 4
jmp 0x73ed44
mov byte [0x7afdad], 0
jmp 0x73ed44
push 0x73edc8
push ebx
call fcn.00412f74
test eax, eax
je 0x73ecf0
lea edx, [esp + 8]
push edx
call eax
push 0x73edf0
push ebx
call fcn.00412f74
mov esi, eax
test esi, esi
je 0x73ecfa
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x73ecfa
cmp dword [esp + 4], 0
je 0x73ecfa
mov byte [0x7ccea9], 1
jmp 0x73ecfa
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x73ed19
sub ax, 5
je 0x73ed22
sub ax, 3
je 0x73ed2b
sub ax, 3
je 0x73ed34
jmp 0x73ed3d
mov byte [0x7afdad], 1
jmp 0x73ed44
mov byte [0x7afdad], 3
jmp 0x73ed44
mov byte [0x7afdad], 2
jmp 0x73ed44
mov byte [0x7afdad], 4
jmp 0x73ed44
mov byte [0x7afdad], 0
cmp byte [0x7ccea9], 0
je 0x73ed85
call fcn.006e3450
test al, al
je 0x73ed7e
push 0x73ee10
push ebx
call fcn.00412f74
test eax, eax
je 0x73ed7e
push 0x73ee44
push 0x73ee64
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412f74
test eax, eax
jne 0x73ed85
mov byte [0x7ccea9], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x73ee80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x73eef0
mov edx, 0x80000002
xor eax, eax
call fcn.00605358
test eax, eax
jne 0x73eee9
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x73ef44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x73eee0
cmp dword [ebp - 0xc], 4
jne 0x73eee0
cmp dword [ebp - 8], 4
jne 0x73eee0
movzx eax, word [ebp - 0x10]
mov word [0x7ccec0], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x73f0ec
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x73f19b
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x7ccebc], eax
cmp byte [0x7ccea8], 0
je 0x73f19b
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x73f18c
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x73f19b
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x7ccec0], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x7ccec2], al
movzx eax, word [esp + 0x22c]
mov word [0x7ccec4], ax
jmp 0x73f19b
cmp eax, 4
jne 0x73f19b
call fcn.0073ee80
call fcn.0073ef5c
add esp, 0x230
ret

Function at 0x740138
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7401e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7401fc
push ebx
push 0x74020c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00409b5c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405d3c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x7401be
mov eax, dword [0x7b0f88]
mov eax, dword [eax + 0x1c8]
call fcn.00740090
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7401e7
lea eax, [ebp - 4]
call fcn.004087b4
ret
Function at 0x740b54
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x740d42
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00604f28
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.006e4884
test al, al
jne 0x740bc1
xor eax, eax
push ebp
push 0x740bb7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.006e4d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x740bc1
push 0
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
mov eax, dword [0x7ccf9c]
call fcn.00409868
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x740bf0
mov eax, dword [0x7b0f88]
mov eax, dword [eax + 0x1c4]
call fcn.00740090
push 0x80
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x7b5634]
push eax
push 0
mov ecx, 0x740d50
mov edx, 0x740d54
xor eax, eax
call fcn.00413ec4
mov dword [ebp - 8], eax
push 0x740250
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x7ccfc8], eax
xor eax, eax
push ebp
push 0x740d0b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x7b0f6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.006048f4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x740d70
call fcn.004231fc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.006047d4
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00409a7c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00740138
mov dword [ebp - 0xc], eax
call fcn.00740214
test al, al
jne 0x740ceb
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x740cc9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x740d12
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x74217c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x742435
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7b0f6c]
mov eax, dword [eax]
mov edx, 0x742450
call fcn.005f6f8c
push 5
mov eax, dword [0x7b0f6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x7423fc
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.007420e0
call fcn.0073907c
lea eax, [ebp - 0x10]
call fcn.00604da0
mov eax, dword [ebp - 0x10]
call fcn.00422d24
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.006048f4
mov edx, dword [ebp - 0x14]
mov eax, 0x7ccf9c
call fcn.00408b94
call fcn.00740420
lea ecx, [ebp - 0x18]
mov edx, 0x742470
mov eax, dword [0x7ccf9c]
call fcn.006039b4
mov edx, dword [ebp - 0x18]
mov eax, 0x7ccfa0
call fcn.00408b94
lea ecx, [ebp - 0x1c]
mov edx, 0x742488
mov eax, dword [0x7ccf9c]
call fcn.006039b4
mov edx, dword [ebp - 0x1c]
mov eax, 0x7ccfa4
call fcn.00408b94
push 2
push 0
push 1
mov ecx, dword [0x7ccf9c]
mov dl, 1
mov eax, dword [0x608fb4]
call fcn.00609910
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7422d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.006098d0
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.006098a8
cmp dword [ebp - 0xc], 0x67734d49
je 0x7422b4
mov cl, 1
xor edx, edx
mov eax, dword [0x7ccfa4]
call fcn.0060b00c
jmp 0x7422c3
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x7ccf9c]
call fcn.0060b00c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7422e0
mov eax, dword [ebp - 4]
call fcn.00406a20
ret
Function at 0x7425cc
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x742709
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x742724
mov edx, ebx
call fcn.00409ad4
mov eax, dword [ebp - 0x25c]
call fcn.00409868
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x7426e3
xor eax, eax
push ebp
push 0x7426dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x742740
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.00422ea4
test eax, eax
jne 0x7426ad
test byte [ebp - 0x258], 0x10
jne 0x7426ad
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00409924
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409ad4
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x7426a5
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.00409868
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00422594
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x74263d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7426e3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x742710
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00408814
lea eax, [ebp - 4]
call fcn.004087b4
ret
Function at 0x74274c
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x74284a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.004087b4
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00603e4c
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x742864
call fcn.004231fc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409ad4
mov eax, dword [ebp - 8]
call fcn.00409868
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x7427ea
test esi, 0x10
jne 0x74281a
test esi, 1
je 0x7427ea
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.00409868
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.00409868
push eax
mov eax, dword [ebp - 0xc]
call fcn.00409868
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x742814
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00408b94
jmp 0x742827
inc edi
cmp edi, 0xa
je 0x742827
inc ebx
cmp ebx, 0x3e8
jne 0x74278b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x742851
lea eax, [ebp - 0x14]
call fcn.004087b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408814
ret
Function at 0x745478
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff9c
mov dword [esp + 4], ecx
mov dword [esp], edx
xor edx, edx
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x7454b7
mov eax, dword [esp + 4]
push eax
push 0x3000
mov eax, dword [esp + 8]
push eax
push 0
call dword [0x7cd054]
mov dword [esp + 8], eax
jmp 0x745621
lea eax, [esp + 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jb 0x745621
cmp eax, dword [esp + 0x14]
ja 0x745621
push 0x1c
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [0x7cd060]
test eax, eax
je 0x745621
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
jmp 0x745594
push 0x1c
lea eax, [esp + 0x28]
push eax
push ebx
call dword [0x7cd060]
test eax, eax
je 0x745621
cmp dword [esp + 0x34], 0x10000
jne 0x745590
cmp esi, dword [esp + 0x30]
ja 0x745590
mov eax, dword [esp + 0x30]
cmp eax, dword [esp]
jb 0x745590
mov edi, ebx
test edi, edi
jne 0x745550
mov dword [esp + 0x1c], esi
jmp 0x74555f
mov ebp, esi
dec ebp
mov eax, ebp
add eax, edi
not ebp
and eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
push eax
push 0x3000
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [0x7cd054]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x745621
add ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x14]
jb 0x745515
mov ebx, dword [esp + 0xc]
jmp 0x74561b
push 0x1c
lea eax, [esp + 0x28]
push eax
push ebx
call dword [0x7cd060]
test eax, eax
je 0x745621
cmp dword [esp + 0x34], 0x10000
jne 0x745617
cmp esi, dword [esp + 0x30]
ja 0x745617
mov eax, dword [esp + 0x30]
cmp eax, dword [esp]
jb 0x745617
mov edi, ebx
test edi, edi
jne 0x7455db
mov dword [esp + 0x20], esi
jmp 0x7455ea
mov ebp, esi
dec ebp
mov eax, ebp
add eax, edi
not ebp
and eax, ebp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
push eax
push 0x3000
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [0x7cd054]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x745621
sub ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x18]
ja 0x7455a4
mov eax, dword [esp + 8]
add esp, 0x64
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x746b14
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
movzx ebx, byte [esi + 0xc]
movsx eax, bl
inc eax
cmp eax, 7
jle 0x746b48
mov ecx, 0x746c40
mov dl, 1
mov eax, dword [0x41aca0]
call fcn.004283ac
call fcn.00407e74
mov eax, 0x56
call fcn.0040549c
mov edi, eax
mov eax, edi
xor ecx, ecx
mov edx, 0x56
call fcn.00745a88
mov dword [edi + 1], esi
lea eax, [ebx + 1]
mov byte [edi], al
call sub.kernel32.dll_GetCurrentThreadId
mov dword [edi + 9], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0xd], eax
mov dword [edi + 5], 0x544c544c
movzx eax, byte [ebp + 8]
mov byte [edi + 0x15], al
test byte [ebp + 8], 2
je 0x746bb1
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x746b9b
mov dword [edi + 0x11], eax
jmp 0x746bb1
mov ecx, 0x746c90
mov dl, 1
mov eax, dword [0x41aca0]
call fcn.004283ac
call fcn.00407e74
add edi, 0x16
movsx eax, bl
lea eax, [esi + eax*4 + 0x1a]
push eax
movsx eax, bl
lea eax, [eax + eax*2]
lea eax, [esi + eax*2 + 0x3b]
mov ecx, 5
mov edx, dword [ebp - 4]
call fcn.0074565c
movsx eax, bl
lea eax, [esi + eax*4 + 0x1e]
push eax
movsx eax, bl
lea eax, [eax + eax*2]
lea eax, [esi + eax*2 + 0x41]
mov edx, dword [esi + 0x16]
mov edx, dword [edx]
mov ecx, 5
call fcn.0074565c
mov eax, edi
add eax, 6
push eax
movsx eax, bl
lea eax, [eax + eax*2]
lea edx, [esi + eax*2 + 0x41]
mov ecx, 5
mov eax, edi
call fcn.0074565c
inc byte [esi + 0xc]
movzx edx, byte [0x7b073b]
mov ecx, 0x40
mov eax, edi
call fcn.00745344
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x74719c
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
push eax
push 0
push 2
call dword [0x7b074c]
mov edi, eax
test edi, edi
je 0x7471d0
test bl, bl
je 0x7471c0
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
jmp 0x7471c8
push edi
call sub.kernel32.dll_ResumeThread
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle
jmp 0x7471d3
or esi, 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x748dd0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov esi, edx
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040893c
add esp, 0x800
pop esi
pop ebx
ret
Function at 0x4009058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x40091a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x400907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x400906a
add dl, dl
jne 0x4009089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40090dc
xor eax, eax
add dl, dl
jne 0x4009096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x400917d
add dl, dl
jne 0x40090a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40090b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40090bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40090c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x40090d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4009075
mov eax, 1
add dl, dl
jne 0x40090ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40090f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x40090e1
sub eax, ebx
mov ebx, 1
jne 0x4009128
mov ecx, 1
add dl, dl
jne 0x400910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4009119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4009105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4009075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x400913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x400914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4009136
cmp eax, 0x7d00
jae 0x400916d
cmp eax, 0x500
jb 0x4009168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4009075
cmp eax, 0x7f
ja 0x4009170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4009075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x400919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4009075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40efe9
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebp - 0x57], eax
in al, 0x70
or byte cs:[edi], al
jno 0x40f033
dec ebp
add byte [eax + 0x33a4fb93], ah
push eax
fst dword [esi - 0x68]
mov byte [eax + 0x2e3e204c], bl
rol bl, 1
mov dh, 0x54
dec ebp
xor dh, dh
test byte [ebx], dh
mov esi, 0x76fa1036
pop fs
mov bh, 0x4f
daa
push edx
jbe 0x40f017
mov eax, dword [0x52274fb7]
pop ebp
insb byte es:[edi], dx
pop ebp
sti
sbb dword [ebx - 5], 0xddafb2b7
stosb byte es:[edi], al
adc dword [ecx], ebx
inc esp
salc
invalid
salc
je 0x40efde
mov edx, 0x106e5c56
sal eax, 0x3a
invalid
mov al, 0x3c

Function at 0x417810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417836
mov eax, dword [0x6337d0]
test eax, eax
je 0x41782c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6337d0], eax
test eax, eax
pop ebx
je 0x4178d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6337d0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6337cc], eax
call esi
mov ecx, dword [0x6337cc]
mov dword [0x6337d4], eax
test ecx, ecx
je 0x4178c7
test eax, eax
je 0x4178c7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6337d0], 0
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x4392a4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cdq
push cs
cmp dl, dh
add ch, al
call 0x7644303d
pushfd
sti
cmp edx, 0x20309886
and eax, 0xc3d55067
inc edx
mov al, byte [0xe2d88c4d]
and al, 0x69
adc eax, 0xe9eaa25f
nop
sub ebx, edi
not dword [ecx - 0x7218826a]
mov bl, 0xb4
test dword [edi], 0xa17756a3
je 0x439269
aad 0xae

Function at 0x47e814
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
shr byte [0x5900d1fb], cl
lock add byte [ebp + 0x3d], bl
add byte [esi + 4], bl
stc
js 0x47e798
leave
loopne 0x47e798
invalid
dec ecx
pushfd
add al, 0x25
push eax
pushfd
adc eax, 0x42935a1
sbb al, 0x69
add eax, dword [edx]
fild word [eax + 0x2537c0d5]
sal dh, 0x4e
jno 0x47e7e4
dec esp
or eax, 0x8dddd1fc
arpl sp, ax
add dword [eax], 0x1e
aam 0x14
cmp dl, byte [ebx]
fst dword [eax + 0x2d]
mov ebx, 0x3b61fdd2
fist dword [ecx - 0x73]
jae 0x47e7bf
adc al, 0x3a
adc ebx, ecx
push eax
sub eax, 0x61fdd2bb
cmp ebx, ebx
push ecx
lea esi, [ebx - 0x10]
add esp, dword [eax - 0x64]
add al, 0xd1
jl 0x47e7e1
jo 0x47e779
into
shl byte [eax], 1
pop edx
pop dword [edx]
aad 0xd0
dec ebp
dec ecx
sal dword [esi + ecx + 0xf], 0xd8
sub dword [edi - 0x54], 0x292d3d31
aad 0xf4
loopne 0x47e823
push cs
psubusb mm0, qword [ecx + 0x3d31ac6f]
sub eax, 0xe0f4d529
xor dword [0x4ced106d], ecx
or eax, 0x4ced106d
cmp eax, 0x9905e165
invalid
jle 0x47e798
pop esi
inc ebp
sar dword [edx + ebx], 1
or ah, dl
daa
pop esi
dec esp
xor dword [ebp + 0x1805228d], esp
lea esp, [edx]
add eax, 0xb71bd18
and ch, bl
lea esp, [edx]
add eax, 0xb71bd18
and ch, bl
sbb byte [ebp - 0x14ddf48f], bh
jmp 0x47e81e
add byte [edi], ch
das
and byte [ecx - 0x23], 0x82
fld qword [ecx - 0x5ad13e97]
mov ebp, 0x8a0cad8
rol byte [ebx], 1
xor edi, dword [esi]
jle 0x47e806
jecxz 0x47e868
shl dword [edx], 1
pop es
pop eax
and byte [ecx], al
loope 0x47e81c
or ch, byte [esi]
shl dword [ecx], cl
push ds
xor ebp, 0xffffff9f
adc ecx, eax
js 0x47e817
inc dword [edx + 0x11]
sbb eax, 0x921e874e
outsb dx, byte [esi]
add ebp, esi
fdiv st(6), st(0)
outsb dx, byte [esi]
mov cl, 0x4c
dec esi
invalid
bound ecx, qword [edx + ecx - 0x42]
outsd dx, dword [esi]
sahf
adc dword [esi + 0x3c5abef3], ecx
or al, 0x2e
iretd