joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x5350d0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x462fda
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x462f53
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm1, xmm3
movaps xmm2, xmm3
pmullw xmm3, xmm4
paddw xmm2, xmm4
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psrlw xmm3, 7
psubw xmm2, xmm0
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x462ee0
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x462fc0
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm1, xmm2
movaps xmm3, xmm2
mov ecx, dword [ebp - 4]
paddw xmm3, xmm4
pmullw xmm2, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x462ed3
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x463400
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x5350d0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x46359a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x463513
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm1, xmm4
pcmpgtw xmm1, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm1
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm2, xmm3
psrlw xmm0, 8
paddw xmm2, xmm4
pmullw xmm3, xmm4
psllw xmm2, 1
add eax, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm3, 7
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x4634a0
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x463580
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm3, xmm2
paddw xmm3, xmm4
pmullw xmm2, xmm4
mov ecx, dword [ebp - 4]
movaps xmm1, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x463493
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x463b10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x5350d0]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x463154
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x4630e1
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm2, xmm3
movaps xmm1, xmm3
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
pcmpgtw xmm2, xmm6
movaps xmm0, xmm2
psrlw xmm0, 8
pand xmm1, xmm2
psrlw xmm3, 7
psubw xmm1, xmm0
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x463082
cmp dword [ebp - 4], 0
je 0x46313a
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm1, xmm4
punpcklbw xmm3, xmm5
movaps xmm2, xmm4
pcmpgtw xmm1, xmm6
pmullw xmm4, xmm3
paddw xmm2, xmm3
psllw xmm2, 1
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm4, 7
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x463073
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x463b39
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x463b3c
sub eax, 1
jne 0x463b39
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x463b39
push esi
call fcn.00462ba0
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x463b39
cmp esi, 0x100
jae 0x463b56
push esi
call fcn.00462e40
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x462ff0
Function at 0x463b60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x5350d0]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x463714
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x4636a1
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm2, xmm4
pcmpgtw xmm2, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm2
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm1, xmm3
psrlw xmm0, 8
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
add eax, 8
pand xmm1, xmm2
psubw xmm1, xmm0
psrlw xmm3, 7
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x463642
cmp dword [ebp - 4], 0
je 0x4636fa
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm2, xmm4
punpcklbw xmm3, xmm5
pmullw xmm4, xmm3
paddw xmm2, xmm3
movaps xmm1, xmm3
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm2, xmm1
psrlw xmm0, 8
psrlw xmm4, 7
psubw xmm2, xmm0
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x463633
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x463b89
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x463b8c
sub eax, 1
jne 0x463b89
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x463b89
push esi
call fcn.00463160
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x463b89
cmp esi, 0x100
jae 0x463ba6
push esi
call fcn.00463400
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x4635b0
Function at 0x47ff10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
push 0xd
mov edi, ecx
xor esi, esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x47ff82
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x47ff82
push ebx
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x47ff7b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test edi, edi
je 0x47ff62
mov ecx, esi
sub edi, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x47ff52
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47ff65
sub esi, ecx
push ebx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x47ff90
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push ecx
push 0
mov dword [ebp - 4], 0
call fcn.004f34d0
mov ebx, eax
add esp, 8
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ffb0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x480034
push esi
push edi
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
sub ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x47fff0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
pop esi
test eax, eax
je 0x480034
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 1
push ebx
call fcn.004259c8
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x14]
pop ebp
jmp fcn.00481090

Function at 0x498d50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x552a90
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x552aa8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 0x552aa8
test esi, esi
je 0x498dc3
nop
mov ecx, dword [esi]
cmp dword [ebp - 0xc], ecx
jne 0x498da6
cmp dword [ebp - 8], 0
jne 0x498d94
push 0
call fcn.00498f90
mov eax, dword [esi + 4]
push 8
push esi
mov dword [edi], eax
call fcn.004259fd
add esp, 8
jmp 0x498dba
call fcn.004995e0
mov edx, eax
call fcn.004992c0
imul edx, eax
lea edi, [esi + 4]
add ebx, edx
mov esi, dword [edi]
test esi, esi
jne 0x498d80
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], 0
je 0x498dff
push 8
call fcn.004259cd
mov edi, dword [ebp - 0xc]
mov esi, eax
add esp, 4
mov dword [esi], edi
mov ecx, dword [0x552aa8]
mov dword [esi + 4], ecx
mov ecx, edi
call fcn.004995e0
mov edx, eax
call fcn.004992c0
imul edx, eax
mov dword [0x552aa8], esi
add ebx, edx
mov dword [ebp - 4], ebx
cmp ebx, 1
jb 0x498eaf
lea eax, [ebp - 0x40]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 0xc], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x552aa8]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x498e99
xor eax, eax
mov ecx, dword [ebx]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.004995e0
mov edx, eax
call fcn.004992c0
imul eax, edx
mov esi, 1
xor edx, edx
imul eax, dword [ebp - 0x2c]
div dword [ebp - 4]
cmp eax, esi
cmovae esi, eax
push esi
call fcn.00498f90
mov edi, dword [ebx]
mov ecx, edi
add dword [ebp - 8], esi
call fcn.004992c0
mov edx, eax
mov eax, dword [ebp - 0xc]
cmp eax, edx
jae 0x498e84
call fcn.004992c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], edx
mov ebx, dword [ebx + 4]
cmovae esi, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
cmovae edi, dword [ebp - 0x1c]
test ebx, ebx
jne 0x498e31
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x498eaf
sub esi, eax
add esi, ecx
mov ecx, edi
push esi
call fcn.00498f90
push 0x552a90
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4995f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x7c
push esi
mov esi, ecx
mov eax, ebx
xor ecx, ecx
mul edx
push edi
mov dword [esi], vtable.DCDstrbtdPrcssng.0
seto cl
mov dword [esi + 4], ebx
neg ecx
mov dword [esi + 8], ebx
or ecx, eax
mov dword [esi + 0xc], 2
push ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
call fcn.00425a0b
imul ecx, ebx, 0x7c
mov dword [esi + 0x24], eax
push ecx
push 0
push eax
call fcn.00430f60
add esp, 0x10
lea eax, [esi + 0x28]
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [esi + 0x24]
push 0
push 0
push 1
mov dword [eax], 1
mov eax, dword [esi + 0x24]
push 0
mov dword [eax + 8], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x24]
mov edi, 1
mov dword [ebp - 4], edi
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0x18], esi
cmp ebx, edi
jbe 0x4997cb
mov ebx, 0x7c
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x24]
push 0
push 1
push 1
mov dword [ebx + eax], 0
mov eax, dword [esi + 0x24]
push 0
mov dword [ebx + eax + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call edi
mov ecx, dword [esi + 0x24]
push 0
push 0
push 1
push 0
mov dword [ebx + ecx + 0xc], eax
call edi
mov ecx, dword [esi + 0x24]
mov edi, ebx
mov dword [ebx + ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x18], esi
mov ebx, 4
nop dword [eax + eax]
mov eax, dword [esi + 0x24]
add eax, 0x1c
push 0xfa0
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add edi, 0x18
sub ebx, 1
jne 0x499720
mov edi, dword [ebp - 4]
mov ecx, esi
push 2
push edi
call fcn.004990f0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x24]
push ebx
mov ebx, dword [ebp - 8]
add eax, ebx
push eax
push 0x498ed0
push 0
push 0
call fcn.00437329
mov ecx, dword [esi + 0x24]
add esp, 0x18
push 0
push eax
mov dword [ebx + ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
cmp edi, eax
jb 0x4996c6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [eax - 1]
mov edi, 0x7c
mov dword [ebp + 8], ecx
nop
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
jne 0x4997c0
nop dword [eax]
push 1
call ebx
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
je 0x4997b0
mov ecx, dword [ebp + 8]
add edi, 0x7c
sub ecx, 1
mov dword [ebp + 8], ecx
jne 0x4997a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b33c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c88b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x54a2f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, edx
call fcn.004b4bc0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4b34f9
mov ecx, dword [eax + 0x48]
lea ebx, [eax + 0x44]
sub ecx, dword [ebx]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x18], esi
cmp esi, 3
jae 0x4b34e2
push dword [ebp + 8]
push 0
call fcn.004f34d0
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
add esi, 0x445
mov eax, dword [ebp - 0x10]
push edi
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp - 0x10]
push 1
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], edi
cmp dword [ebx + 8], ecx
je 0x4b34a2
mov edx, edi
mov dword [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4b3486
sub edx, esi
sar edx, 1
push edx
push edi
call fcn.00404760
add dword [ebx + 4], 0x18
jmp 0x4b34ae
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.00406b10
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4b34ba
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4b34ce
push edi
call fcn.004259c8
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80000006
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b72f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0xfffffffe
call fcn.004b7280
cmp eax, 0xffff0300
jb 0x4b73f3
push 0x52e6c0
push 0x81
push dword [0x562aa4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4b73ea
push edi
push dword [0x562aa4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [0x562aa4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [ebp - 4], eax
call fcn.00425a0b
add esp, 4
mov dword [ebp - 0xc], eax
push 0x10000
call fcn.00425a0b
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push dword [ebp - 4]
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.004310c0
add esp, 0xc
mov ecx, esi
call fcn.004efe00
test eax, eax
je 0x4b7398
mov edx, esi
mov ecx, edi
call fcn.004efdb0
jmp 0x4b73b1
push 0
push 0
push dword [ebp - 4]
lea edx, [ebp - 0xc]
push esi
lea ecx, [ebp - 8]
call fcn.004c16a0
mov edi, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [0x560990]
lea edx, [ebp - 0x10]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1a8]
test eax, eax
js 0x4b73d8
call fcn.004b7400
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [0x560904], eax
push esi
call fcn.004259c8
add esp, 4
push edi
call fcn.004259c8
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xf
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbd70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x54a2f8]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x5609ec], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4bbe77
call edi
cmp dword [0x560ac8], eax
ja 0x4bbe77
cmp dword [0x560ac4], 0
je 0x4bbe14
lea eax, [esp + 0x14]
push eax
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004b7d30
push eax
call fcn.004c5e70
mov edx, dword [eax]
call fcn.004c5e80
mov ecx, dword [eax]
call fcn.004bc100
add esp, 0xc
call fcn.004b90a0
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
div ecx
mov esi, eax
call edi
mov dword [0x560ac4], 0
jmp 0x4bbe5b
call fcn.004b7d30
cmp eax, 1
jne 0x4bbe63
call fcn.004b8d30
test eax, eax
je 0x4bbe63
push 0
push 0
call fcn.004b7d30
push eax
call fcn.004c5e70
mov edx, dword [eax]
call fcn.004c5e80
mov ecx, dword [eax]
call fcn.004bc100
add esp, 0xc
call fcn.004b90a0
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
div ecx
mov esi, eax
call edi
inc eax
add eax, esi
mov dword [0x560ab8], eax
mov dword [0x5609ec], 0
mov dword [0x560ac8], 0
cmp dword [0x560adc], 0
je 0x4bbeed
cmp dword [0x562dc8], 0
je 0x4bbee3
call fcn.004ec710
test eax, eax
jne 0x4bbee3
call fcn.004ec720
test eax, eax
jne 0x4bbee3
call fcn.004bdd50
test eax, eax
jne 0x4bbee3
call fcn.004b7d30
neg eax
sbb esi, esi
inc esi
call fcn.004c5e70
mov edx, dword [eax]
call fcn.004c5e80
push 0
push 0
push esi
mov ecx, dword [eax]
call fcn.004bc100
add esp, 0xc
test eax, eax
je 0x4bbee3
push 0
call fcn.004b7d30
mov edx, eax
mov ecx, 1
call fcn.004f4800
add esp, 4
mov dword [0x560adc], 0
cmp dword [0x560ab8], 0
je 0x4bbf0f
call edi
cmp dword [0x560ab8], eax
ja 0x4bbf0f
call fcn.004bc520
mov dword [0x560ab8], 0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.004259b7
mov esp, ebp
pop ebp
ret

Function at 0x4bd8f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x54a2f8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call fcn.004bdd50
test eax, eax
je 0x4bd94e
push esi
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [0x560f4c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
lea eax, [ebp - 0x804]
push 0xffffffffffffffff
push eax
push edi
call fcn.004f3140
add esp, 0xc
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004259b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop edi
call fcn.004259b7
mov esp, ebp
pop ebp
ret