joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c5d4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x482dd4]
cmp byte [eax + 0xc], 0
je 0x44c741
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44c73a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x483b9c], 0
jne 0x44c628
push 0x44c748
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44c750
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483b9c], eax
cmp dword [0x481cac], 0
jne 0x44c723
push 0x44c760
call sub.kernel32.dll_LoadLibraryA
mov dword [0x481cac], eax
cmp dword [0x481cac], 0
je 0x44c723
push 0x44c76c
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483ba0], eax
push 0x44c77c
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483ba4], eax
push 0x44c790
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483ba8], eax
push 0x44c7a8
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bac], eax
push 0x44c7c0
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bb0], eax
push 0x44c7d4
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bb4], eax
push 0x44c7ec
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bb8], eax
push 0x44c804
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bbc], eax
push 0x44c820
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bc0], eax
push 0x44c82c
mov eax, dword [0x481cac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483bc4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c741
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x450b6c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403f38
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x450bbb
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004041a8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x458300
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x458350]
test si, 4
je 0x458314
or bl, 1
test si, 8
je 0x45831e
or bl, 4
test si, 1
je 0x458328
or bl, 8
test si, 2
je 0x458332
or bl, 0x10
test si, 0x10
je 0x45833c
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45834b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x458354
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45838c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45836d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45837c
or bl, 4
test esi, 0x20000000
je 0x458387
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45ea34
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45ea46
add esp, 0xfffffff0
call fcn.00403488
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b100
mov eax, dword [0x48283c]
mov dword [eax + 4], ebx
mov dword [eax], 0x45edd8
mov eax, dword [0x482850]
mov dword [eax + 4], ebx
mov dword [eax], 0x45ede4
mov eax, ebx
call fcn.0045edf0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x45b20c
push eax
push 0
push 0
mov eax, dword [0x482aa0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41cba4]
call fcn.0041e318
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41cba4]
call fcn.0041e318
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41cba4]
call fcn.0041e318
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045f210
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f0ec
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f0ec
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45f0ec
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45eb83
call fcn.004034e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45eed0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f07b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45f05c
mov dl, 1
mov eax, dword [0x412578]
call fcn.00403134
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f38
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45f04b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044c934
test al, al
je 0x45f03e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45f08c
lea eax, [ebp - 0x254]
call fcn.00409100
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45f03e
xor eax, eax
push ebp
push 0x45f037
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45f0c4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45f020
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041a8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45f020
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f03e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45ef41
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416cb8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f082
lea eax, [ebp - 0x260]
call fcn.00403f38
ret

Function at 0x45f9b0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x483be8]
cmp byte [eax + 0xa5], 0
jne 0x45fa21
cmp dword [0x483c00], 0
jne 0x45f9e2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45f96c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x483c00], eax
cmp dword [0x483bfc], 0
jne 0x45f9fd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x483bfc], eax
cmp dword [0x483c04], 0
jne 0x45fa21
push esp
push 0
push 0
push 0x45f910
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x483c04], eax
pop edx
ret
Function at 0x45fb18
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45fb2f
add esp, 0xfffffff0
call fcn.00403488
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b100
mov eax, dword [0x482a78]
cmp word [eax + 2], 0
jne 0x45fb57
mov eax, dword [0x482a78]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004612a4
mov eax, dword [0x482bb4]
cmp word [eax + 2], 0
jne 0x45fb71
mov eax, dword [0x482bb4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046149c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411f14]
call fcn.00403134
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d684]
call fcn.00424c80
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45fcf8
mov eax, dword [0x4828fc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00425050
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x461a3c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4828fc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c918
test eax, eax
je 0x45fc66
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ae0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c940
test eax, eax
je 0x45fc7a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041a8
mov eax, dword [0x4826c8]
cmp byte [eax], 0
jne 0x45fcae
mov eax, ebx
call fcn.0045fe20
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00461c18
mov eax, ebx
call fcn.004625dc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45fcee
call fcn.004034e0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4600a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x483be8]
cmp dword [eax + 0x30], 0
je 0x46014a
cmp dword [ebx + 0x94], 0
jne 0x460144
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460030
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460144
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46010a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460144
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004145cc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x460119
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460cac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x460ce1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404028
jmp 0x460cee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f8c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x461df4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461e35
mov eax, esi
call fcn.00447efc
test al, al
je 0x461e35
mov eax, dword [ebx + 0x84]
call fcn.00447bf8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461e35
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447bf8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46cd58
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x46cd60
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x46cf52
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x46cf68
mov eax, esi
call fcn.0046aae8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00403f8c
lea ecx, [ebp - 0x10]
mov edx, 0x46cf7c
mov eax, esi
call fcn.0046aae8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00403f8c
lea ecx, [ebp - 0x14]
mov edx, 0x46cf94
mov eax, esi
call fcn.0046aae8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00403f8c
lea ecx, [ebp - 0x18]
mov edx, 0x46cfb0
mov eax, esi
call fcn.0046aae8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00403f8c
lea ecx, [ebp - 0x1c]
mov edx, 0x46cfcc
mov eax, esi
call fcn.0046aae8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00403f8c
lea ecx, [ebp - 0x24]
mov edx, 0x46cfe4
mov eax, esi
call fcn.0046aae8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407fb0
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004084f8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x46cffc
mov eax, esi
call fcn.0046aae8
mov eax, dword [ebp - 0x28]
call fcn.00469c00
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x46d00c
mov eax, esi
call fcn.0046aae8
mov eax, dword [ebp - 0x2c]
call fcn.00469c00
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x46d024
mov eax, esi
call fcn.0046aae8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004084f8
inc eax
je 0x46cef5
lea ecx, [ebp - 0x34]
mov edx, 0x46d024
mov eax, esi
call fcn.0046aae8
mov eax, dword [ebp - 0x34]
call fcn.004084bc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409a50
fstp qword [ebp - 0x3c]
wait
call fcn.00409db4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x46cf10
lea ecx, [ebp - 0x40]
mov edx, 0x46d024
mov eax, esi
call fcn.0046aae8
mov eax, dword [ebp - 0x40]
call fcn.00469c00
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x46d034
mov eax, esi
call fcn.0046aae8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00403f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cf59
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00403f5c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00403f5c
ret
Function at 0x4791f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47924a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004791e0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0046886c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0046846c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479251
lea eax, [ebp - 4]
call fcn.00403f38
ret

Function at 0x47f584
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x47f666
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x483f64], 0
jne 0x47f5ca
push 1
push 0
push 0x47f674
push 0x47f688
push 0x47f694
mov eax, dword [0x482b70]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x47f64b
lea eax, [ebp - 4]
mov ecx, dword [0x483f64]
mov edx, 0x47f6a4
call fcn.00404244
mov eax, dword [ebp - 4]
call fcn.00408868
test al, al
je 0x47f628
push 1
push 0x47f6bc
push 0x47f6bc
lea eax, [ebp - 8]
mov ecx, dword [0x483f64]
mov edx, 0x47f6a4
call fcn.00404244
mov eax, dword [ebp - 8]
call fcn.004043f8
push eax
push 0x47f694
mov eax, dword [0x482b70]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x47f64b
push 1
push 0
push 0x47f674
push 0x47f688
push 0x47f694
mov eax, dword [0x482b70]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f66d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f5c
ret
Function at 0x405cbb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c60c], 0
push esi
jne 0x405cf2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ccc
mov dword [ecx*4 + 0x42c608], eax
inc ecx
cmp ecx, 0x100
jl 0x405cc7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d23
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c608]
xor eax, esi
inc ecx
dec edx
jne 0x405d05
pop edi
not eax
pop esi
ret 0xc

Function at 0x4382cd
Capabilities:
Check for software breakpoints

Disassembly:
call 0x4382d2
pop eax
mov ebx, 0x400000
mov esi, dword [ebx + 0xc0]
lea eax, [ebx + esi]
dec eax
mov cl, byte [eax]
cmp cl, 0xcc
je 0x4382e1
sub eax, 3
mov edx, dword [eax]
mov esi, dword [ebx + 0x16c]
add esi, ebx
lea edi, [ebx + 0x1000]
push edi
mov ecx, edx
sub ecx, esi
push ecx
push esi
call fcn.0043816f
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, ebx
add esi, dword [edx + 0x10c]
mov edi, dword [edx + 0x104]
mov ecx, 0x1750e
call fcn.00438290
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x438378
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x438373
pushal
test eax, 0x80000000
je 0x43835d
and eax, 0x7fffffff
jmp 0x438361
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x438348
add esi, 0x14
jmp 0x43832e
pop edx
add ebx, dword [edx + 0x28]
jmp ebx
Function at 0x4a82f2
Capabilities:
Authenticate hmac

Disassembly:
inc ebp
push 0x7050505
and esp, dword [ebx]
and esi, dword [0x7f545454]

Function at 0x4a836e
Capabilities:
Authenticate hmac

Disassembly:
and eax, 0x28283825
sub byte [0x422b2b2b], bh
sub eax, dword [edx + 0x2f]
imul esp, dword [eax - 0x558f8f90], 0xba7b7b7b
jnp 0x4a832a
jnp 0x4a83ed
jnp 0x4a832e
jb 0x4a83e8
jb 0x4a8325
pushal
pushal
pushal
xchg ecx, eax
dec edx
dec edx
dec edx
jno 0x4a83b7
push edx
sub ebp, dword [ebx]
sub eax, dword [ecx + 0x1f]
pop ds
pop ds
das
adc al, 0x14
adc al, 0x1e
push ss
push ss
push ss
and dword [0x2e382525], esp
inc esi
cmp edi, dword [ebx]
cmp ebx, dword [edx + 0x52]
push edx
push edx
jl 0x4a840e
imul ebp, dword [ecx - 0x60], 0xb3767676
js 0x4a8426
js 0x4a8366
jo 0x4a8422
jo 0x4a835e
pop esi
pop esi
pop esi
invalid

Function at 0x4a862e
Capabilities:
Authenticate hmac

Disassembly:
jno 0x4a85dc
imul ebp, dword [ebx + 0x6b], 0xffffffa2
imul ebp, dword [ebx + 0x6b], 0xffffffa2
imul ebp, dword [ebx + 0x6b], 0xffffffa2
imul ebp, dword [ebx + 0x6b], 0xffffffa2
imul ebp, dword [ebx + 0x6b], 0xffffffa2
push 0x6a
push 0xffffffffffffffa1
push 0x6a
push 0xffffffffffffffa1
mov byte [eax + 0x5252cf88], cl
push edx
jl 0x4a8656
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], ebp
sub byte [eax], ch
cmp al, 0x52
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
sub byte [eax], ch
sub byte [edx + edx*2], bh
push edx
push edx
jl 0x4a86b2
inc ebp
inc ebp
push 0x67444444
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc ebp
inc ebp
inc ebp
push 0x7b515151
push eax
push eax
push eax
jns 0x4a86d4
dec ebx
dec ebx
jb 0x4a86ea
pop ebp
pop ebp
lea ebx, [esp + ebx*2 + 0x5c]
mov word [esi + 0x5e], ds
pop esi
invalid
inc ebp
push 0x7c525252
push ecx
dec esi
Function at 0x78d8c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
call fcn.0078d839
rdtsc
neg dx
jae 0x78d8c6
rcr dh, 7
mov dl, byte [esp]
mov eax, ebx
inc dh
jmp 0x78d8d6
sub esp, 0
mov dword [esp], ebp
lea esp, [esp + 1]
add esp, 1
lea esp, [esp + 2]
xchg dword [esp + 0x24], ecx
jmp 0x78d863
jmp 0x78d89a
jmp 0x78d94a
inc dh
lea eax, [edx + ebp]
jmp 0x78d92e
lea eax, [edx + ebp]
jmp 0x78d92e
rdtsc
xchg dh, al
jmp 0x78d96a
xchg dh, al
mov dx, 0x711
pushal
lea edx, [eax + ebx]
jmp 0x78d9e3
shr eax, 1
and dh, bh
js 0x78d90c
rdtsc
jmp 0x78d916
rcr dh, 7
mov dl, byte [esp]
mov eax, ebx
jmp 0x78d8cb
mov dx, 0x711
pushal
lea edx, [eax + ebx]
jmp 0x78d9e3
clc
lea eax, [edx + ebp]
sub esp, 0
jmp 0x78d9c4
sub cl, 0xd3
mov edx, 0x20a5bf58
mov eax, dword [esp]
setne dh
jmp 0x78d9cc
clc
lea eax, [edx + ebp]
sub esp, 0
lea eax, [esi - 0x35]
jmp 0x78d99b
lea eax, [esi - 0x35]
call fcn.0078da3e
xchg dx, ax
pushal
clc
jnp 0x78da4d
bsf dx, ax
and eax, esi
push word [esp + 0x1d]
jmp 0x78da53
lea esp, [esp + 0x20]
ror cl, 0
clc
js 0x78d9b4
jns 0x78d992
pop dword [esp + 0x10]
lea eax, [eax - 0x31]
xor dl, ch
not dx
or dx, 0xde96
inc dh
jmp 0x78da92
bsf dx, ax
jmp 0x78da75
cmc
mov eax, dword [esp + 0x17]
jmp 0x78da81
inc dx
push dword [esp + 0x20]
ret 0x24
and eax, esi
push word [esp + 0x1d]
cmc
mov eax, dword [esp + 0x17]
pop dword [esp + 0x14]
mov eax, 0x442d4e8c
jmp 0x78db8e
bswap edx
xchg dword [esp + 0x20], eax
xchg ah, dh
neg eax
cmp dx, 0xb162
shl eax, 0x13
jmp 0x78da6c
lea eax, [edx + edx]
lea eax, [edx + edi]
mov byte [esp + 5], dh
mov word [esp + 4], dx
mov dx, word [esp + 0x10]
xchg word [esp + 9], dx
jmp 0x78db0d
adc ax, 0x5784
sub dh, ah
mov dh, bh
jmp 0x78db79
rdtsc
jmp 0x78db1b
rdtsc
bt edx, edx
mov edx, dword [esp]
mov dh, 0xba
rdtsc
jmp 0x78db4b
lea esp, [esp + 0x1c]
ror cl, 0
bt eax, edi
jnp 0x78dae3
jp 0x78daeb
bt edx, edx
mov edx, dword [esp]
mov dh, 0xba
jmp 0x78db49
xchg word [esp + 4], ax
mov dh, 0xea
lea esp, [esp + 2]
jmp 0x78dbd9
jnp 0x78db68
lea eax, [esi*4]
xchg ah, dh
jmp 0x78dad6
rdtsc
dec cl
lea eax, [ebx + ebp]
sub esp, 0x12
jmp 0x78dbca
lea eax, [esi*4]
xchg ah, dh
adc ax, 0x5784
sub dh, ah
mov dh, bh
sub esp, 0x1c
jmp 0x78dab3
mov dword [esp + 0x19], eax
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
inc cl
neg dh
jmp 0x78db3c
lea esp, [esp + 2]
jmp 0x78dbd9
mov eax, dword [edi]
bts edx, edx
jmp 0x78dc14
ror dx, cl
mov dx, 0x80e5
mov edx, dword [esp]
jmp 0x78dc1f
jns 0x78db25
xchg word [esp + 4], ax
mov dh, 0xea
jmp 0x78dba0
and ecx, 0x3c
setp ah
mov edx, ebp
lea eax, reloc.WINMM.dll_PlaySoundW
mov dl, byte [esp]
jmp 0x78dba6
mov edx, dword [esp]
jmp 0x78dc1f
jns 0x78dbb1
ror dx, cl
mov dx, 0x80e5
jmp 0x78dbfe
mov dword [ecx + ebp], eax
and cl, bh
jp 0x78dce8
bsr cx, cx
add al, dh
jmp 0x78dc8c
bsr cx, cx

Function at 0x78d968
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x16
push word [esp + 0x13]
mov byte [esp + 0x16], dh
pop word [esp + 0x17]
lea esp, [esp + 2]
lea ecx, [ecx - 0x47]
call fcn.0078d8c4
jmp 0x78d8ef
Function at 0x78d982
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
stc
push esp
mov dword [esp + 1], ebp
xchg dword [esp + 0xc], ecx
call fcn.0078d968