joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461840
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x5330e0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x4619da
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x461953
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm1, xmm3
movaps xmm2, xmm3
pmullw xmm3, xmm4
paddw xmm2, xmm4
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psrlw xmm3, 7
psubw xmm2, xmm0
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x4618e0
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x4619c0
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm1, xmm2
movaps xmm3, xmm2
mov ecx, dword [ebp - 4]
paddw xmm3, xmm4
pmullw xmm2, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x4618d3
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x461e00
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [edx]
movaps xmm6, xmmword [0x5330e0]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
sar eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
sar eax, 2
push esi
push edi
mov edi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
cmp ecx, dword [edx + 8]
mov dword [ebp - 0x14], eax
cmova ecx, dword [edx + 8]
mov eax, dword [ebx + 8]
shl eax, 4
cmp edi, dword [edx + 0xc]
cwde
cmova edi, dword [edx + 0xc]
movd xmm0, eax
punpcklwd xmm0, xmm0
pshufd xmm7, xmm0, 0
test edi, edi
je 0x461f9a
mov eax, dword [ebp - 0x10]
mov esi, ecx
shl eax, 2
and ecx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr esi, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], esi
dec edi
mov edx, ecx
cmp dword [ebp - 0xc], 0
je 0x461f13
xorps xmm5, xmm5
nop
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm1, xmm4
pcmpgtw xmm1, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm1
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm2, xmm3
psrlw xmm0, 8
paddw xmm2, xmm4
pmullw xmm3, xmm4
psllw xmm2, 1
add eax, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm3, 7
pxor xmm3, xmm1
psubw xmm3, xmm1
paddw xmm2, xmm3
psubw xmm2, xmm4
psllw xmm2, 4
pmulhw xmm2, xmm7
paddw xmm2, xmm4
packuswb xmm2, xmm5
movq qword [ecx], xmm2
sub esi, 1
jne 0x461ea0
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x18], 0
je 0x461f80
movd xmm2, dword [edx]
xorps xmm5, xmm5
movd xmm4, dword [eax]
punpcklbw xmm2, xmm5
punpcklbw xmm4, xmm5
movaps xmm3, xmm2
paddw xmm3, xmm4
pmullw xmm2, xmm4
mov ecx, dword [ebp - 4]
movaps xmm1, xmm4
psllw xmm3, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm3, xmm1
psrlw xmm0, 8
psrlw xmm2, 7
psubw xmm3, xmm0
pxor xmm2, xmm1
psubw xmm2, xmm1
paddw xmm3, xmm2
psubw xmm3, xmm4
psllw xmm3, 4
pmulhw xmm3, xmm7
paddw xmm3, xmm4
packuswb xmm3, xmm5
movd dword [eax], xmm3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test edi, edi
jne 0x461e93
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x462510
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x5330e0]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x461b54
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x461ae1
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movq xmm3, qword [ecx]
mov ecx, eax
punpcklbw xmm3, xmm5
add eax, 8
movaps xmm2, xmm3
movaps xmm1, xmm3
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
pcmpgtw xmm2, xmm6
movaps xmm0, xmm2
psrlw xmm0, 8
pand xmm1, xmm2
psrlw xmm3, 7
psubw xmm1, xmm0
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x461a82
cmp dword [ebp - 4], 0
je 0x461b3a
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm1, xmm4
punpcklbw xmm3, xmm5
movaps xmm2, xmm4
pcmpgtw xmm1, xmm6
pmullw xmm4, xmm3
paddw xmm2, xmm3
psllw xmm2, 1
movaps xmm0, xmm1
psrlw xmm0, 8
pand xmm2, xmm1
psubw xmm2, xmm0
psrlw xmm4, 7
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x461a73
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x462539
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x46253c
sub eax, 1
jne 0x462539
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x462539
push esi
call fcn.004615a0
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x462539
cmp esi, 0x100
jae 0x462556
push esi
call fcn.00461840
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x4619f0
Function at 0x462560
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
movaps xmm6, xmmword [0x5330e0]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
push esi
mov ecx, dword [eax + 4]
mov esi, dword [eax]
sar ecx, 2
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx + 4]
sar ecx, 2
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
cmp edx, eax
mov dword [ebp - 0xc], esi
cmova edx, eax
cmp edi, ecx
cmova edi, ecx
test edi, edi
je 0x462114
mov eax, dword [ebp - 0x10]
mov ecx, edx
shl eax, 2
and edx, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
shr ecx, 1
shl eax, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
dec edi
mov eax, esi
mov esi, ecx
test ecx, ecx
je 0x4620a1
xorps xmm5, xmm5
movq xmm4, qword [eax]
mov ecx, edx
punpcklbw xmm4, xmm5
add edx, 8
movaps xmm2, xmm4
pcmpgtw xmm2, xmm6
movq xmm3, qword [ecx]
movaps xmm0, xmm2
punpcklbw xmm3, xmm5
mov ecx, eax
movaps xmm1, xmm3
psrlw xmm0, 8
pmullw xmm3, xmm4
paddw xmm1, xmm4
psllw xmm1, 1
add eax, 8
pand xmm1, xmm2
psubw xmm1, xmm0
psrlw xmm3, 7
pxor xmm3, xmm2
psubw xmm3, xmm2
paddw xmm1, xmm3
packuswb xmm1, xmm5
movq qword [ecx], xmm1
sub esi, 1
jne 0x462042
cmp dword [ebp - 4], 0
je 0x4620fa
movd xmm4, dword [edx]
xorps xmm5, xmm5
movd xmm3, dword [eax]
punpcklbw xmm4, xmm5
movaps xmm2, xmm4
punpcklbw xmm3, xmm5
pmullw xmm4, xmm3
paddw xmm2, xmm3
movaps xmm1, xmm3
psllw xmm2, 1
pcmpgtw xmm1, xmm6
movaps xmm0, xmm1
pand xmm2, xmm1
psrlw xmm0, 8
psrlw xmm4, 7
psubw xmm2, xmm0
pxor xmm4, xmm1
psubw xmm4, xmm1
paddw xmm2, xmm4
packuswb xmm2, xmm5
movd dword [eax], xmm2
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0x462033
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x462589
mov eax, dword [edx + 0x10]
sub eax, 1
je 0x46258c
sub eax, 1
jne 0x462589
mov eax, dword [ecx + 0x10]
sub eax, 1
jne 0x462589
push esi
call fcn.00461b60
add esp, 4
pop esi
pop ebp
ret
cmp dword [ecx + 0x10], 1
jne 0x462589
cmp esi, 0x100
jae 0x4625a6
push esi
call fcn.00461e00
add esp, 4
pop esi
pop ebp
ret
pop esi
pop ebp
jmp 0x461fb0
Function at 0x47e900
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
push 0xd
mov edi, ecx
xor esi, esi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x47e972
push dword [0x55faa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x47e972
push ebx
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x47e96b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test edi, edi
je 0x47e952
mov ecx, esi
sub edi, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x47e942
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47e955
sub esi, ecx
push ebx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, esi
pop esi
ret

Function at 0x47e980
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push ecx
push 0
mov dword [ebp - 4], 0
call fcn.004f1eb0
mov ebx, eax
add esp, 8
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e9a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x47ea24
push esi
push edi
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
sub ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x47e9e0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x55faa0]
call dword [sym.imp.USER32.dll_OpenClipboard]
pop esi
test eax, eax
je 0x47ea24
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 1
push ebx
call fcn.00424b28
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x14]
pop ebp
jmp fcn.0047fa80

Function at 0x497730
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x54fa90
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x54faa8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 0x54faa8
test esi, esi
je 0x4977a3
nop
mov ecx, dword [esi]
cmp dword [ebp - 0xc], ecx
jne 0x497786
cmp dword [ebp - 8], 0
jne 0x497774
push 0
call fcn.00497970
mov eax, dword [esi + 4]
push 8
push esi
mov dword [edi], eax
call fcn.00424b5d
add esp, 8
jmp 0x49779a
call fcn.00497fc0
mov edx, eax
call fcn.00497ca0
imul edx, eax
lea edi, [esi + 4]
add ebx, edx
mov esi, dword [edi]
test esi, esi
jne 0x497760
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], 0
je 0x4977df
push 8
call fcn.00424b2d
mov edi, dword [ebp - 0xc]
mov esi, eax
add esp, 4
mov dword [esi], edi
mov ecx, dword [0x54faa8]
mov dword [esi + 4], ecx
mov ecx, edi
call fcn.00497fc0
mov edx, eax
call fcn.00497ca0
imul edx, eax
mov dword [0x54faa8], esi
add ebx, edx
mov dword [ebp - 4], ebx
cmp ebx, 1
jb 0x49788f
lea eax, [ebp - 0x40]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 0xc], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x54faa8]
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x497879
xor eax, eax
mov ecx, dword [ebx]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.00497fc0
mov edx, eax
call fcn.00497ca0
imul eax, edx
mov esi, 1
xor edx, edx
imul eax, dword [ebp - 0x2c]
div dword [ebp - 4]
cmp eax, esi
cmovae esi, eax
push esi
call fcn.00497970
mov edi, dword [ebx]
mov ecx, edi
add dword [ebp - 8], esi
call fcn.00497ca0
mov edx, eax
mov eax, dword [ebp - 0xc]
cmp eax, edx
jae 0x497864
call fcn.00497ca0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], edx
mov ebx, dword [ebx + 4]
cmovae esi, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
cmovae edi, dword [ebp - 0x1c]
test ebx, ebx
jne 0x497811
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x49788f
sub esi, eax
add esi, ecx
mov ecx, edi
push esi
call fcn.00497970
push 0x54fa90
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x7c
push esi
mov esi, ecx
mov eax, ebx
xor ecx, ecx
mul edx
push edi
mov dword [esi], vtable.DCDstrbtdPrcssng.0
seto cl
mov dword [esi + 4], ebx
neg ecx
mov dword [esi + 8], ebx
or ecx, eax
mov dword [esi + 0xc], 2
push ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
call fcn.00424b6b
imul ecx, ebx, 0x7c
mov dword [esi + 0x24], eax
push ecx
push 0
push eax
call fcn.0042fd40
add esp, 0x10
lea eax, [esi + 0x28]
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [esi + 0x24]
push 0
push 0
push 1
mov dword [eax], 1
mov eax, dword [esi + 0x24]
push 0
mov dword [eax + 8], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi + 0x24]
mov edi, 1
mov dword [ebp - 4], edi
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [eax + 0x18], esi
cmp ebx, edi
jbe 0x4981ab
mov ebx, 0x7c
mov dword [ebp - 8], ebx
mov eax, dword [esi + 0x24]
push 0
push 1
push 1
mov dword [ebx + eax], 0
mov eax, dword [esi + 0x24]
push 0
mov dword [ebx + eax + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call edi
mov ecx, dword [esi + 0x24]
push 0
push 0
push 1
push 0
mov dword [ebx + ecx + 0xc], eax
call edi
mov ecx, dword [esi + 0x24]
mov edi, ebx
mov dword [ebx + ecx + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x14], 0
mov eax, dword [esi + 0x24]
mov dword [ebx + eax + 0x18], esi
mov ebx, 4
nop dword [eax + eax]
mov eax, dword [esi + 0x24]
add eax, 0x1c
push 0xfa0
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add edi, 0x18
sub ebx, 1
jne 0x498100
mov edi, dword [ebp - 4]
mov ecx, esi
push 2
push edi
call fcn.00497ad0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x24]
push ebx
mov ebx, dword [ebp - 8]
add eax, ebx
push eax
push 0x4978b0
push 0
push 0
call fcn.00435fbd
mov ecx, dword [esi + 0x24]
add esp, 0x18
push 0
push eax
mov dword [ebx + ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x7c
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
cmp edi, eax
jb 0x4980a6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [eax - 1]
mov edi, 0x7c
mov dword [ebp + 8], ecx
nop
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
jne 0x4981a0
nop dword [eax]
push 1
call ebx
mov eax, dword [esi + 0x24]
cmp dword [edi + eax], 0
je 0x498190
mov ecx, dword [ebp + 8]
add edi, 0x7c
sub ecx, 1
mov dword [ebp + 8], ecx
jne 0x498180
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1da0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a4cb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5472f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, edx
call fcn.004b35a0
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4b1ed9
mov ecx, dword [eax + 0x48]
lea ebx, [eax + 0x44]
sub ecx, dword [ebx]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x18], esi
cmp esi, 3
jae 0x4b1ec2
push dword [ebp + 8]
push 0
call fcn.004f1eb0
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
add esi, 0x445
mov eax, dword [ebp - 0x10]
push edi
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp - 0x10]
push 1
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], edi
cmp dword [ebx + 8], ecx
je 0x4b1e82
mov edx, edi
mov dword [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4b1e66
sub edx, esi
sar edx, 1
push edx
push edi
call fcn.00404230
add dword [ebx + 4], 0x18
jmp 0x4b1e8e
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.00406320
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4b1e9a
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4b1eae
push edi
call fcn.00424b28
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80000006
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, DirectSoundCreate8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0xfffffffe
call fcn.004b5c60
cmp eax, 0xffff0300
jb 0x4b5dd3
push 0x52c6c0
push 0x81
push dword [0x55faa4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4b5dca
push edi
push dword [0x55faa4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [0x55faa4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov dword [ebp - 4], eax
call fcn.00424b6b
add esp, 4
mov dword [ebp - 0xc], eax
push 0x10000
call fcn.00424b6b
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push dword [ebp - 4]
push esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.0042fea0
add esp, 0xc
mov ecx, esi
call fcn.004ee7e0
test eax, eax
je 0x4b5d78
mov edx, esi
mov ecx, edi
call fcn.004ee790
jmp 0x4b5d91
push 0
push 0
push dword [ebp - 4]
lea edx, [ebp - 0xc]
push esi
lea ecx, [ebp - 8]
call fcn.004c0070
mov edi, dword [ebp - 8]
add esp, 0x10
mov ecx, dword [0x55d990]
lea edx, [ebp - 0x10]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1a8]
test eax, eax
js 0x4b5db8
call fcn.004b5de0
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [0x55d904], eax
push esi
call fcn.00424b28
add esp, 4
push edi
call fcn.00424b28
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xf
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba740
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x5472f8]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x55d9ec], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4ba847
call edi
cmp dword [0x55dac8], eax
ja 0x4ba847
cmp dword [0x55dac4], 0
je 0x4ba7e4
lea eax, [esp + 0x14]
push eax
push dword [0x55faa0]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004b6710
push eax
call fcn.004c4840
mov edx, dword [eax]
call fcn.004c4850
mov ecx, dword [eax]
call fcn.004baad0
add esp, 0xc
call fcn.004b7a80
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
div ecx
mov esi, eax
call edi
mov dword [0x55dac4], 0
jmp 0x4ba82b
call fcn.004b6710
cmp eax, 1
jne 0x4ba833
call fcn.004b7710
test eax, eax
je 0x4ba833
push 0
push 0
call fcn.004b6710
push eax
call fcn.004c4840
mov edx, dword [eax]
call fcn.004c4850
mov ecx, dword [eax]
call fcn.004baad0
add esp, 0xc
call fcn.004b7a80
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
div ecx
mov esi, eax
call edi
inc eax
add eax, esi
mov dword [0x55dab8], eax
mov dword [0x55d9ec], 0
mov dword [0x55dac8], 0
cmp dword [0x55dadc], 0
je 0x4ba8bd
cmp dword [0x55fdc8], 0
je 0x4ba8b3
call fcn.004eb0f0
test eax, eax
jne 0x4ba8b3
call fcn.004eb100
test eax, eax
jne 0x4ba8b3
call fcn.004bc720
test eax, eax
jne 0x4ba8b3
call fcn.004b6710
neg eax
sbb esi, esi
inc esi
call fcn.004c4840
mov edx, dword [eax]
call fcn.004c4850
push 0
push 0
push esi
mov ecx, dword [eax]
call fcn.004baad0
add esp, 0xc
test eax, eax
je 0x4ba8b3
push 0
call fcn.004b6710
mov edx, eax
mov ecx, 1
call fcn.004f31e0
add esp, 4
mov dword [0x55dadc], 0
cmp dword [0x55dab8], 0
je 0x4ba8df
call edi
cmp dword [0x55dab8], eax
ja 0x4ba8df
call fcn.004baef0
mov dword [0x55dab8], 0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.00424b17
mov esp, ebp
pop ebp
ret

Function at 0x4bc2c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x5472f8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call fcn.004bc720
test eax, eax
je 0x4bc31e
push esi
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [0x55df4c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
lea eax, [ebp - 0x804]
push 0xffffffffffffffff
push eax
push edi
call fcn.004f1b20
add esp, 0xc
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424b17
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop edi
call fcn.00424b17
mov esp, ebp
pop ebp
ret