joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
test esi, esi
jne 0x436f76
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4eeef8]
test ecx, ecx
jne 0x436f98
push eax
push esi
call dword [sym.imp.USER32.dll_GetPropA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
push edi
push 0x537
push str.D:MyProjectsProPilotLibLibMain.c
lea eax, [ecx + 0xd84]
push 0
push eax
call fcn.004208b0
mov edi, dword [0x4eeefc]
add esp, 0x10
test edi, edi
je 0x436fed
mov eax, 0x3ce4585
mov ecx, esi
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3f1
sub ecx, eax
mov edi, dword [edi + ecx*4 + 8]
test edi, edi
je 0x436fed
cmp dword [edi], esi
je 0x437013
mov edi, dword [edi + 0x34]
test edi, edi
jne 0x436fe2
mov eax, dword [0x4eeef8]
add eax, 0xd84
push eax
call fcn.00422570
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x437020
sub esi, edx
mov eax, esi
and eax, 3
je 0x43704d
push eax
mov eax, esi
and eax, 0xfc
add eax, ecx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00481690
mov ebx, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp - 0xc]
sar esi, 2
test esi, esi
je 0x43705d
xor ebx, dword [ecx + esi*4 - 4]
dec esi
test esi, esi
jne 0x437054
mov eax, 0xba2e8ba3
mul ebx
shr edx, 3
imul eax, edx, 0xb
sub ebx, eax
mov esi, dword [edi + ebx*4 + 8]
test esi, esi
je 0x436fed
mov eax, ecx
mov ecx, dword [esi]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4370a0
test dl, dl
je 0x43709c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4370a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x437080
xor eax, eax
jmp 0x4370a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4370b8
mov esi, dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
test esi, esi
jne 0x437078
jmp 0x436fed
mov ecx, dword [0x4eeef8]
mov esi, dword [esi + 4]
add ecx, 0xd84
push ecx
call fcn.00422570
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x437160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
test edi, edi
je 0x437208
mov al, byte [edi]
test al, al
je 0x437208
cmp al, 0x23
je 0x437208
mov esi, edi
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x437195
sub esi, edx
mov eax, esi
and eax, 3
je 0x4371bf
push eax
mov eax, esi
and eax, 0xfc
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00481690
mov ecx, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x4371cf
xor ecx, dword [edi + esi*4 - 4]
dec esi
test esi, esi
jg 0x4371c6
mov eax, 0x446f8657
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ecx, eax
mov esi, dword [ecx*4 + 0x555924]
test esi, esi
je 0x437208
push dword [esi + 4]
push edi
call fcn.0048e9a6
add esp, 8
test eax, eax
je 0x43721b
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x4371f1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [esi + 8]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
movups xmmword [ebx], xmm0
xor ecx, ebp
movq xmm0, qword [esi + 0x18]
pop esi
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x437bd0
Capabilities:
Generate random numbers via rtlgenrandom
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.ADVAPI32.DLL
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x437bff
push str.ADVAPI32.DLL
call ebx
test eax, eax
je 0x437c0c
push str.SystemFunction036
push eax
call esi
mov dword [0x4dd5f4], eax
push str.Msimg32.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437c28
push str.Msimg32.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x437c44
push str.AlphaBlend
push eax
call esi
push str.GradientFill
push dword [ebp - 4]
mov dword [0x4eef0c], eax
call esi
mov dword [0x4eef08], eax
push 0x4a15e8
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437c60
push 0x4a15e8
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x437c7c
push 0x4a15f4
push eax
call esi
push str.UpdateLayeredWindow
push dword [ebp - 4]
mov dword [0x4eef10], eax
call esi
mov dword [0x4eef14], eax
push str.UxTheme.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437c98
push str.UxTheme.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x437cb4
push str.SetThemeAppProperties
push eax
call esi
push str.SetWindowTheme
push dword [ebp - 4]
mov dword [0x4eef18], eax
call esi
mov dword [0x4eef1c], eax
push str.Wtsapi32.dll
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x437cd0
push str.Wtsapi32.dll
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x437cec
push str.WTSQuerySessionInformationA
push eax
call esi
push str.WTSFreeMemory
push dword [ebp - 4]
mov dword [0x4eef20], eax
call esi
mov dword [0x4eef24], eax
push str.Kernel32.dll
call edi
mov edi, eax
test edi, edi
jne 0x437d06
push str.Kernel32.dll
call ebx
mov edi, eax
test edi, edi
je 0x437d20
push str.WTSGetActiveConsoleSessionId
push edi
call esi
push str.ProcessIdToSessionId
push edi
mov dword [0x4eef28], eax
call esi
mov dword [0x4eef2c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439a90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0xc
test edx, edx
je 0x439c3e
mov eax, dword [0x4eeef8]
push esi
test eax, eax
je 0x439aed
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x439aed
mov edx, dword [eax + 0x1f0c]
test edx, edx
je 0x439ac9
mov dword [0x4eeefc], edx
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
test ecx, 0x40000000
je 0x439aed
mov eax, dword [eax + 0x1f2c]
test eax, eax
je 0x439aed
push 0x4a16e4
push edx
call eax
mov esi, eax
mov dword [ebp - 8], esi
jmp 0x439afd
push 0x4a16e4
push edx
call fcn.00436f40
mov esi, eax
mov dword [ebp - 8], eax
add esp, 8
test esi, esi
je 0x439c3d
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x439c3d
mov dword [ebp - 0xc], 0
jle 0x439c1b
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0xf4]
test edi, edi
js 0x439b4a
cmp dword [ecx + eax + 0x3c], edi
jne 0x439c00
lea edi, [ecx + eax]
test edi, edi
je 0x439bbe
xor esi, esi
mov ecx, dword [edi + 8]
mov eax, dword [esi + ecx]
test eax, eax
je 0x439bc3
test edx, edx
js 0x439b6f
push 0
push edx
push 0x111
push eax
call ebx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x40]
mov eax, dword [esi + eax]
test eax, eax
je 0x439b9d
cmp eax, dword [ebp + 8]
je 0x439b9d
push 0
push dword [esi + ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x40]
push dword [eax + esi]
mov eax, dword [edi + 8]
push dword [eax + esi]
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x439ba8
push 0
push 0
push 0x10
push dword [esi + ecx]
call ebx
mov eax, dword [edi + 0xc]
push dword [eax + esi]
call fcn.0048737c
mov edx, dword [ebp + 0x10]
add esp, 4
add esi, 4
jmp 0x439b53
mov ecx, dword [edi + 8]
jmp 0x439bc6
mov esi, dword [ebp - 8]
push ecx
call fcn.0048737c
push dword [edi + 0xc]
call fcn.0048737c
push dword [edi + 0x40]
call fcn.0048737c
add esp, 0xc
push 0
push 0
push 0x1302
push dword [edi]
call ebx
test eax, eax
je 0x439bf7
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
add ecx, 0x48
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp eax, dword [esi + 0xf0]
jl 0x439b36
pop edi
pop ebx
push dword [esi + 0xf4]
call fcn.0048737c
add esp, 4
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf0], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43ee50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x13c], 0
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x43ef5b
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 0x19
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
mov dword [ebp - 0x134], eax
cmp eax, 0xf
jle 0x43ef07
push 0xa
lea eax, [ebp - 0x130]
push str.pcanywhere
push eax
call fcn.004873a2
add esp, 0xc
test eax, eax
jne 0x43ef01
lea eax, [ebp - 0x130]
push 0x4a1bd8
push eax
call fcn.0048ee40
add esp, 8
test eax, eax
je 0x43ef4c
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x134]
cmp eax, 6
jne 0x43ef4c
lea eax, [ebp - 0x130]
push str.WinVNC
push eax
call fcn.0048eaa2
add esp, 8
test eax, eax
jne 0x43ef4c
push 0x19
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x130]
push str.WinVNC_desktop_sink
push eax
call fcn.0048eaa2
add esp, 8
test eax, eax
je 0x43ef84
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x43eea2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x4eef2c]
test ecx, ecx
je 0x43efbe
lea edx, [ebp - 0x138]
push edx
push eax
call ecx
test eax, eax
je 0x43efbe
mov eax, dword [0x4eef28]
test eax, eax
jne 0x43ef9a
jmp 0x43ef9c
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
call eax
cmp dword [ebp - 0x138], eax
je 0x43f03d
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4eef20]
test eax, eax
je 0x43f026
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x13c]
push ecx
push 4
push 0xffffffffffffffff
push 0
call eax
test eax, eax
je 0x43f026
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x43f03d
mov ecx, dword [0x4eef28]
test ecx, ecx
je 0x43efff
call ecx
mov ecx, eax
mov eax, dword [ebp - 0x13c]
cmp dword [eax], ecx
jne 0x43f02c
mov ecx, dword [0x4eef24]
test ecx, ecx
je 0x43f010
push eax
call ecx
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x43f03d
mov ecx, dword [0x4eef24]
test ecx, ecx
je 0x43f03d
push eax
call ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x442ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], edi
test ebx, ebx
je 0x442cc6
mov al, byte [ebx]
test al, al
je 0x442cc6
cmp al, 0x23
je 0x442cc6
push esi
mov esi, ebx
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x442b10
sub esi, ecx
mov eax, esi
and eax, 3
je 0x442b3a
push eax
mov eax, esi
and eax, 0xfc
add eax, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00481690
mov edi, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x442b4a
xor edi, dword [ebx + esi*4 - 4]
dec esi
test esi, esi
jg 0x442b41
mov eax, 0x446f8657
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub edi, eax
mov esi, dword [edi*4 + 0x555924]
test esi, esi
je 0x442b87
nop dword [eax]
push dword [esi + 4]
push ebx
call fcn.0048e9a6
add esp, 8
test eax, eax
je 0x442bda
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x442b70
push 0x24
call fcn.00487397
mov esi, eax
add esp, 4
test esi, esi
je 0x442c5f
mov dword [esi + 4], 0
xor eax, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
jmp 0x442c61
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
test al, 2
je 0x442c17
lea ecx, [esi + 8]
mov edx, ebx
mov edi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x442c03
add ecx, 4
add edx, 4
sub edi, 4
jae 0x442bf0
jmp 0x442c14
movups xmm0, xmmword [ebx]
or dword [esi], 1
movups xmmword [esi + 8], xmm0
or dword [0x555920], 1
mov eax, dword [ebp + 0x10]
test al, 1
je 0x442c30
mov ecx, dword [ebx + 0x10]
cmp dword [esi + 0x18], ecx
je 0x442c30
or dword [esi], 1
mov dword [esi + 0x18], ecx
or dword [0x555920], 1
test al, 4
je 0x442c49
mov eax, dword [ebx + 0x14]
cmp dword [esi + 0x1c], eax
je 0x442c49
or dword [esi], 1
mov dword [esi + 0x1c], eax
or dword [0x555920], 1
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
push 0x1877
push str.D:MyProjectsProPilotLibLibMain.c
push fcn.004845db
or eax, 1
mov dword [esi], eax
lea eax, [esi + 4]
or dword [0x555920], 1
push 0
push ebx
push eax
call fcn.0041e700
mov edx, dword [ebp + 0x10]
add esp, 0x18
mov ecx, dword [ebp + 0xc]
test dl, 2
je 0x442c9d
movups xmm0, xmmword [ecx]
movups xmmword [esi + 8], xmm0
test dl, 1
je 0x442ca8
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x18], eax
test dl, 4
je 0x442cb3
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [edi*4 + 0x555924]
mov dword [esi + 0x20], eax
mov dword [edi*4 + 0x555924], esi
jmp 0x442c49
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x4447f0
Capabilities:
Capture screenshot
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x28], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x2c], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x80
mov dword [ebp - 0x30], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 2
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [ebp - 0x28], 0
je 0x444862
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x44486b
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp - 0x38], eax
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x12c
push 0x1f4
mov edi, eax
push esi
mov dword [ebp - 0x20], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x34], eax
call edi
push 0xcc0020
push 0
push 0
push dword [ebp - 0x24]
mov esi, eax
push 0x12c
push 0x1f4
push 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [ebp - 0x20]
push esi
call edi
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4448dc
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x24]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x28], 0
je 0x44494d
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push dword [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
push dword [ebp - 0x30]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
sbb eax, dword [ebp - 0x10]
push 0
push 0x3e8
push eax
push ecx
call fcn.004805f0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00480540
mov esi, eax
jmp 0x44497c
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push dword [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
push dword [ebp - 0x30]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call eax
sub esi, dword [ebp - 0x38]
mov eax, esi
test ebx, ebx
je 0x44498c
mov dword [ebx + 0xdc8], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x444be0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5558e8], 0
je 0x444c47
mov eax, dword [0x5558c0]
test eax, eax
je 0x444d31
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push dword [0x5558c0]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x5558c0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x5558c0], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
cmp dword [0x5558c8], 0
je 0x444d20
push dword [0x5558cc]
push dword [0x5558d0]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [0x5558d0]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x5558c8]
test eax, eax
je 0x444c8c
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x5558c8], 0
push esi
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [0x5558c0]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetParent]
lea eax, [ebp - 0x14]
push 2
push eax
push dword [0x5558c0]
call esi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 5
push dword [0x5558c0]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
push eax
push dword [0x5558c0]
call esi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [ebp - 0x10]
push dword [0x5558c0]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0xc], eax
call esi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
call esi
push 0
push 0
push dword [0x5558c0]
call esi
push dword [0x5558c4]
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
push 0x2c
push 0
push 0x5558c0
call fcn.00481c10
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x444f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov al, byte [esi]
cmp al, 0x20
jne 0x444f61
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
je 0x444f56
mov dword [ebp + 8], esi
cmp al, 0x2d
je 0x444f69
cmp al, 0x2b
jne 0x444f7a
xor ecx, ecx
cmp al, 0x2d
mov al, byte [esi + 1]
sete cl
inc esi
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], esi
mov ecx, dword [ebp - 0x14]
push edi
mov edi, dword [ebp - 0x10]
cmp al, 0x20
jle 0x445035
mov dword [ebp - 4], edi
nop dword [eax]
movzx edx, word [esi]
mov eax, edx
and eax, 0x3030
cmp eax, 0x3030
jne 0x444fe7
mov eax, edx
movzx eax, ax
push 0
push 0x64
push dword [ebp - 4]
movzx eax, byte [eax + 0x538f30]
cdq
push ecx
mov esi, eax
mov edi, edx
call fcn.004805f0
add esi, eax
mov ecx, esi
mov esi, dword [ebp + 8]
adc edi, edx
add esi, 2
mov dword [ebp - 4], edi
mov dword [ebp + 8], esi
movzx edx, word [esi]
mov eax, edx
mov dword [ebp - 0x10], eax
and eax, 0x3030
cmp eax, 0x3030
mov eax, edx
je 0x444fa3
cmp dl, 0x20
jle 0x44502c
cmp dl, 0x2e
je 0x445025
cmp dl, 0x2c
je 0x445025
mov dword [ebp + 8], ecx
mov eax, ecx
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add dword [ebp + 8], eax
movsx eax, dl
adc edi, ecx
cdq
mov ecx, dword [ebp + 8]
shld edi, ecx, 1
add ecx, ecx
add ecx, eax
adc edi, edx
sub ecx, 0x30
sbb edi, 0
mov dword [ebp - 4], edi
jmp 0x445028
mov dword [ebp - 8], esi
inc esi
mov dword [ebp + 8], esi
cmp byte [esi], 0x20
jg 0x444f90
mov edx, edi
call fcn.00480730
mov eax, dword [ebp - 8]
pop edi
test eax, eax
je 0x44504f
sub esi, eax
divsd xmm0, qword [esi*8 + 0x538e98]
cmp dword [ebp - 0xc], 0
pop esi
je 0x44505d
xorps xmm0, xmmword [0x4a1eb0]
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x448a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], ecx
test edi, edi
je 0x448ae8
mov ebx, dword [edi]
test ebx, ebx
je 0x448ae8
cmp byte [ebx], cl
je 0x448ae8
mov esi, ebx
lea edx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x448a60
sub esi, edx
mov eax, esi
and eax, 3
je 0x448a8a
push eax
mov eax, esi
and eax, 0xfc
add eax, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00481690
mov ecx, dword [ebp - 8]
add esp, 0xc
sar esi, 2
test esi, esi
jle 0x448a9f
lea eax, [ebx + esi*4]
xor ecx, dword [eax - 4]
lea eax, [eax - 4]
dec esi
test esi, esi
jg 0x448a94
mov eax, 0x446f8657
mov dword [edi + 0x5808], 0xffffffff
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x65
sub ecx, eax
mov esi, dword [ecx*4 + 0x555724]
test esi, esi
je 0x448ae8
nop dword [eax + eax]
push dword [esi + 4]
push dword [edi]
call fcn.0048e9a6
add esp, 8
test eax, eax
je 0x448afb
mov esi, dword [esi + 0x18]
test esi, esi
jne 0x448ad0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x6918]
cmp eax, dword [esi + 0x1c]
jne 0x448ae8
mov eax, dword [esi + 0x10]
mov dword [edi + 0x5770], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x5808], eax
movzx eax, byte [esi + 8]
cmp eax, dword [edi + 0x78]
jne 0x448ae8
push 0x190
lea eax, [edi + 0x7c]
push 0
push eax
call fcn.00481c10
xor edx, edx
add esp, 0xc
cmp dword [edi + 0x78], edx
jle 0x448b7b
lea ebx, [edi + 0x220]
mov eax, dword [esi + 0xc]
movzx eax, byte [eax + edx*8 + 1]
mov dword [ebx - 4], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*8 + 4]
mov dword [ebx], eax
mov eax, dword [esi + 0xc]
mov al, byte [eax + edx*8]
test al, al
je 0x448b69
movsx eax, al
lea ecx, [edx + 1]
mov dword [edi + eax*4 + 0x78], ecx
inc edx
add ebx, 0xd0
cmp edx, dword [edi + 0x78]
jl 0x448b41
cmp dword [edi + 0x7c], 0
jne 0x448b82
mov dword [edi + 0x7c], 1
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
Function at 0x455ed0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xffffffffffffffff
push dword [esi + 8]
call fcn.0044a040
add esp, 0xc
test eax, eax
je 0x455f02
push 0
push eax
push 0
call fcn.00455c20
add esp, 0xc
push 0
push 0x63
push 8
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop ebp
ret