joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433050
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x43309c
mov eax, esi
call fcn.00448844
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43309c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x43309c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4331db
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4330dc
cmp eax, 0x108
ja 0x4330dc
mov eax, esi
call fcn.00448844
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4331d2
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x4331db
jmp 0x4331d2
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4331bb
cmp eax, 0x20a
ja 0x4331bb
test byte [esi + 0x50], 0x80
jne 0x43310e
sub eax, 0x203
je 0x43310b
sub eax, 3
je 0x43310b
sub eax, 3
jne 0x43310e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x433122
dec eax
je 0x433137
dec eax
je 0x433154
dec eax
je 0x433137
jmp 0x43315b
mov ecx, ebx
mov eax, dword [0x45a754]
mov eax, dword [eax]
mov edx, esi
call fcn.00452008
jmp 0x4331d2
cmp byte [esi + 0x5d], 1
jne 0x43314d
mov eax, esi
mov si, 0xffed
call fcn.00403328
jmp 0x4331db
or word [esi + 0x54], 1
jmp 0x4331d2
and word [esi + 0x54], 0xfffe
jmp 0x4331d2
mov eax, dword [0x45bb10]
cmp byte [eax + 0x20], 0
je 0x4331d2
mov eax, dword [0x45bb10]
cmp dword [eax + 0x1c], 0
je 0x4331d2
mov eax, dword [ebx]
mov edx, dword [0x45bb10]
cmp eax, dword [edx + 0x1c]
jne 0x4331d2
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00448788
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403328
jmp 0x4331db
cmp eax, 0xb00b
jne 0x4331d2
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00431970
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436748
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x436764
cmp dword [esi + 4], 0
je 0x436791
test byte [ebx + 0x55], 1
jne 0x436783
mov eax, ebx
call fcn.004352e8
test eax, eax
jne 0x436783
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4368a1
mov edx, esi
mov eax, ebx
call fcn.0043626c
jmp 0x4368a1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43689a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004385b8
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00432f84
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00436748
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004385b8
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4368a1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cf74
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45a92c]
cmp byte [eax + 0xc], 0
je 0x43d0e1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43d0da
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45bb64], 0
jne 0x43cfc8
push 0x43d0e8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43d0f0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb64], eax
cmp dword [0x459b84], 0
jne 0x43d0c3
push 0x43d100
call sub.kernel32.dll_LoadLibraryA
mov dword [0x459b84], eax
cmp dword [0x459b84], 0
je 0x43d0c3
push 0x43d10c
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb68], eax
push 0x43d11c
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb6c], eax
push 0x43d130
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb70], eax
push 0x43d148
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb74], eax
push 0x43d160
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb78], eax
push 0x43d174
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb7c], eax
push 0x43d18c
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb80], eax
push 0x43d1a4
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb84], eax
push 0x43d1c0
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb88], eax
push 0x43d1cc
mov eax, dword [0x459b84]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bb8c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d0e1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x440f6c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403e64
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x440fbb
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004040d4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4486f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x448748]
test si, 4
je 0x44870c
or bl, 1
test si, 8
je 0x448716
or bl, 4
test si, 1
je 0x448720
or bl, 8
test si, 2
je 0x44872a
or bl, 0x10
test si, 0x10
je 0x448734
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448743
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44874c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x448784]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448765
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448774
or bl, 4
test esi, 0x20000000
je 0x44877f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44ee2c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44ee3e
add esp, 0xfffffff0
call fcn.00403438
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419624
mov eax, dword [0x45a4e4]
mov dword [eax + 4], ebx
mov dword [eax], 0x44f1d0
mov eax, dword [0x45a4f0]
mov dword [eax + 4], ebx
mov dword [eax], 0x44f1dc
mov eax, ebx
call fcn.0044f1e8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44b604
push eax
push 0
push 0
mov eax, dword [0x45a6ac]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b050]
call fcn.0041c494
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b050]
call fcn.0041c494
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b050]
call fcn.0041c494
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044f608
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f4e4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f4e4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44f4e4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44ef7b
call fcn.00403490
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44f2c8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44f473
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44f454
mov dl, 1
mov eax, dword [0x411934]
call fcn.004030fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e64
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44f443
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043d2d4
test al, al
je 0x44f436
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44f484
lea eax, [ebp - 0x254]
call fcn.0040894c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44f436
xor eax, eax
push ebp
push 0x44f42f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44f4bc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44f418
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040d4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44f418
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f436
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44f339
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415814
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f47a
lea eax, [ebp - 0x260]
call fcn.00403e64
ret

Function at 0x44fda8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45bbb0]
cmp byte [eax + 0xa5], 0
jne 0x44fe19
cmp dword [0x45bbc8], 0
jne 0x44fdda
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44fd64
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45bbc8], eax
cmp dword [0x45bbc4], 0
jne 0x44fdf5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45bbc4], eax
cmp dword [0x45bbcc], 0
jne 0x44fe19
push esp
push 0
push 0
push 0x44fd08
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45bbcc], eax
pop edx
ret
Function at 0x44ff10
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ff27
add esp, 0xfffffff0
call fcn.00403438
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419624
mov eax, dword [0x45a690]
cmp word [eax + 2], 0
jne 0x44ff4f
mov eax, dword [0x45a690]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451600
mov eax, dword [0x45a77c]
cmp word [eax + 2], 0
jne 0x44ff69
mov eax, dword [0x45a77c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004517f8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411460]
call fcn.004030fc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b800]
call fcn.00421484
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4500f0
mov eax, dword [0x45a570]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421854
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x451d98
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45a570]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bffc
test eax, eax
je 0x45005e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408340
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c024
test eax, eax
je 0x450072
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040d4
mov eax, dword [0x45a3f8]
cmp byte [eax], 0
jne 0x4500a6
mov eax, ebx
call fcn.00450218
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00451f74
mov eax, ebx
call fcn.00452938
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4500e6
call fcn.00403490
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450498
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45bbb0]
cmp dword [eax + 0x30], 0
je 0x450542
cmp dword [ebx + 0x94], 0
jne 0x45053c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x450428
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45053c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x450502
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45053c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413880
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x450511
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4510a4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4510d9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f54
jmp 0x4510e6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403eb8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x452150
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452191
mov eax, esi
call fcn.004388bc
test al, al
je 0x452191
mov eax, dword [ebx + 0x84]
call fcn.004385b8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452191
push 0
mov eax, dword [ebx + 0x84]
call fcn.004385b8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x403244
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x413391
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
add ebp, eax
mov ebp, esp
movsx ecx, sp
btr ecx, ecx
ror ch, cl
lea esp, [esp - 0x44]
push ebx
bt ecx, 0xba
sub edx, edx
inc ch
sub cl, 0xfb
rcr ecx, cl
mov dword [ebp - 0x44], edx
xor cx, 0x3533
shl ecx, 0
sal ecx, 0xfa
mov dword [ebp - 0x2c], edx
btc ecx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], edx
rcr cx, 0xac
rol ch, 0x37
mov dword [ebp - 0x14], edx
xor eax, eax
xchg ch, cl
cwd
setb ch
push ebp
cmovle cx, si
push 0x491c8a
not dh
cmovo cx, sp
push dword fs:[eax]
mov dword fs:[eax], esp
jmp fcn.0044750f
Function at 0x470004
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0058652d
mov edx, dword [ebp - 0xc]
lahf
lea ecx, [ebp - 8]
setl al
mov al, 0x24
mov eax, dword [ebp - 4]
jmp 0x4a445b
call fcn.00413668
mov dword [ebp - 4], eax
movzx dx, bl
xor eax, eax
cmova dx, ax
movzx edx, dx
bswap edx
push ebp
push 0x4fccc7
push dword fs:[eax]
cdq
movzx edx, bx
bswap edx
mov dword fs:[eax], esp
mov edx, 0x80000002
movsx eax, dx
mov eax, dword [ebp - 4]
jmp 0x4f0164
push ebp
movsx ebp, dx
not bp
bts ebp, esp
mov ebp, esp
add esp, 0xffffffe4
clc
test esp, edi
push ebx
xor edx, edx
cmovb bx, di
mov dword [ebp - 8], edx
btr bx, 0x5e
mov ebx, esp
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
xchg dl, dl
push ebp
push 0x4ded0a
xchg dl, dl
push dword fs:[eax]
jmp 0x4f80d8
call fcn.0041376c
lea ecx, [ebp - 0xc]
mov byte [ebp - 0x1c], 0xe1
mov byte [ebp - 0x1b], 0x5c
mov ah, 1
mov byte [ebp - 0x1a], 0x6e
cmovno edx, ecx
mov dh, al
mov byte [ebp - 0x19], 0xf
cwd
bswap edx
movzx ax, bh
mov byte [ebp - 0x18], 0x1b
mov byte [ebp - 0x17], 0x16
rdtsc
mov byte [ebp - 0x16], 0x29
not ax
mov byte [ebp - 0x15], 0x3a
cwd
jmp 0x4e4d53
call fcn.00413908
mov edx, dword [ebp - 8]
cbw
cwde
mov eax, ebx
xchg cx, cx
mov ecx, 0x64bc1a6a
mov ecx, 0x415524
jmp 0x554b93
call fcn.004038e4
ret
mov byte [ebp - 0x14], 0x13
lahf
mov dh, dl
cwd
mov byte [ebp - 0x13], 0x1c
rdtsc
mov byte [ebp - 0x12], 0x1e
xchg dl, ah
lahf
mov dx, di
mov byte [ebp - 0x11], 9
not edx
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0xe
mov dh, 0xf5
cmovne eax, esi
mov byte [ebp - 0xe], 0x1b
lea eax, [ebp - 0x1c]
xchg edx, edx
cdq
mov edx, 0xe
jmp 0x4249e7
call fcn.00413708
sub ecx, ecx
movzx eax, bx
mov edx, 0x4154f0
mov eax, dword [ebp - 4]
jmp 0x48bfb7
mov dword fs:[eax], esp
lahf
not dl
mov dl, 1
cbw
movsx eax, cx
mov eax, dword [0x413598]
jmp 0x435f32
mov dword fs:[eax], edx
lahf
cbw
push 0x49f4bd
nop
mov eax, dword [ebp - 4]
jmp 0x4d3e68
call fcn.004046b4
xor eax, eax
cwd
movsx ecx, dx
pop edx
setg ch
movsx ecx, bp
pop ecx
pop ecx
jmp 0x533637
Function at 0x47770c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.00413a8c
mov dword [ebp - 0x10], eax
mov ax, 0x3630
push 0
movzx ax, cl
sete al
push 8
mov eax, dword [ebp - 0xc]
jmp 0x444f1b
mov dword [ebp - 0x1c], eax
jmp 0x521b47
push edx
jmp 0x55c513
sub eax, eax
jmp 0x4301e9
push eax
mov al, 0xbc
mov eax, dword [ebp + 8]
jmp 0x4aa57d
call fcn.00413a8c
mov dword [ebp - 0x14], eax
movsx eax, bx
rcr eax, cl
mov eax, dword [ebp - 0xc]
test si, 0x61bb
jmp 0x4b6b19
push edx
jmp 0x46d54b
jbe 0x534cc0
mov eax, dword [ebp - 8]
test ch, 0xd2
clc
cmp si, bx
mov eax, dword [eax]
test ch, dl
test cl, 0x7f
xor edx, edx
jmp 0x434e3d
ret 8
fdiv dword [0x413da4]
jmp 0x4d87f8
push eax
bswap eax
lea eax, [ebp - 0xc]
call fcn.00413a5c
mov eax, dword [ebp - 0xc]
cmc
test eax, 0x3e586896
cmp dword [eax], 0
jmp 0x534cba
call fcn.00413a8c
call fcn.00413a5c
add dword [ebp - 0x14], 2
jmp 0x59ff16
mov eax, dword [eax + 4]
jmp 0x4bb8ca
push ebp
rol eax, cl
test edi, 0x6e4e6087
shl edx, cl
mov ebp, esp
xor edx, 0x5d0b4650
sar ax, cl
add esp, 0xffffffe0
mov edx, esi
push ebx
push esi
cwde
movsx dx, al
cmovge dx, sp
push edi
jmp 0x505c55
push eax
setp ah
lahf
mov eax, dword [ebp - 0x10]
jmp 0x470b15
mov dword [ebp - 0x20], eax
cmp ebp, esp
clc
jmp 0x43a1c9
mov eax, dword [eax + 4]
jmp 0x429e2a
mov eax, dword [eax + 4]
clc
lea eax, [eax - 8]
cmc
cmp di, bx
jmp 0x4a137c
call fcn.00413a8c
mov dword [ebp - 0xc], eax
jmp 0x46d556
call fcn.00402dc4
mov ebx, eax
jmp 0x56426e
mov eax, dword [ebp - 0xc]
cmp edx, ebx
mov eax, dword [eax]
cmc
sub edx, edx
jmp 0x542a02
mov edx, 5
mov eax, dword [ebp + 8]
call fcn.004151ca
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x52deaf
pop ebx
jmp 0x55e755
fild qword [ebp - 0x20]
jmp 0x46c66d
jb 0x59ff1d
inc ebx
test eax, 0x354756e5
mov eax, dword [ebp - 0x14]
mov di, word [eax]
movzx esi, di
inc ax
shr esi, 0xc
sar ax, 0xdc
cmp ebp, esi
not al
and di, 0xfff
cmovns ax, sp
sub ax, 0x5188
movzx eax, di
cmp esp, 0x625c28d7
cmc
cmp cl, ch
mov dword [ebp - 0x18], eax
test esi, ecx
cmp edi, 0x1ea33732
cmc
cmp esi, 3
jmp 0x525269
jne 0x470b1f
mov eax, dword [ebp + 0xc]
cmc
xor edx, edx
jmp 0x59d56b
cmp dword [eax + 4], 0
jmp 0x450091
ja 0x4fb6d2
pop edi
pop esi
jmp 0x51284e
push edx
jmp 0x443620
push eax
xchg al, al
mov ah, 1
setbe al
mov eax, dword [ebp + 8]
jmp 0x4763f6
mov esp, ebp
cmovno ebp, esp
not ebp
movsx ebp, di
pop ebp
jmp 0x459658
dec ebx
jmp 0x57067d
test ebx, ebx
jmp 0x522501
push edx
jmp 0x49daa0
push edx
push eax
movzx edx, di
cwde
mov eax, dword [ebp - 0x18]
xchg dh, dl
movsx edx, bp
cdq
jmp 0x59962e
dec ebx
jne 0x52250d
mov eax, dword [ebp - 0xc]
clc
mov eax, dword [eax + 4]
test ebp, esp
cmc
xor edx, edx
jmp 0x44f8e5