joyce8/EMBER2024-capa huggingface dataset:
Function at 0x288e41e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov bp, word [ebp]
pushal
push dword [esp + 8]
push dword [esp + 8]
lea esp, [esp + 0x2c]
jmp 0x288f987

Function at 0x288e6a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
jmp 0x288ea67
mov dword [ebp], edx
mov byte [esp + 4], 0x3d
mov dword [ebp + 4], eax
pushfd
pushal
lea esp, [esp + 0x30]
jmp 0x288f987

Function at 0x288e83b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
stc
mov word [esp], 0x60f1
sub ebp, 4
jmp 0x288f171
pushfd
pushal
push 0x61c50b84
mov dword [ebp], eax
push dword [esp + 0x10]
lea esp, [esp + 0x40]
jmp 0x288f987

Function at 0x288e8cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x2890220
pushfd
pop dword [esp + 0x2c]
push eax
push dword [esp + 0x30]
pop dword [ebp]
mov dword [esp], edi
pushfd
mov word [esp + 8], 0x33e3
lea esp, [esp + 0x38]
jmp 0x288f987

Function at 0x288eed2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
jmp 0x288f157
push dword [esp + 0x50]
pop dword [ebp]
mov byte [esp], 0x58
mov word [esp], 0xcdbc
lea esp, [esp + 0x54]
jmp 0x288f987

Function at 0x288ef0e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg al
cmc
ror al, 5
cmp ah, 0x7c
sub bl, al
push 0x7e561643
sub ebp, 2
jmp 0x288f533
pushfd
pushfd
mov word [ebp], ax
pushal
lea esp, [esp + 0x44]
jmp 0x288f987

Function at 0x288ef6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
sub bl, al
clc
pushfd
lea esi, [esi - 1]
test ah, ah
pushfd
test ch, 0xf2
mov ax, word [eax + edi]
pushfd
stc
jmp 0x2890fa4

Function at 0x288f1ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub ecx, 1
jmp 0x2890ab6
call fcn.0288e471

Function at 0x288f4c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push dword [esp + 0x10]
pop dword [ebp]
pushal
lea esp, [esp + 0x34]
jmp 0x288f987

Function at 0x288f4f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov word [ebp], ax
push dword [esp]
push 0x3d51ed47
pushfd
pushfd
lea esp, [esp + 0x48]
jmp 0x288f987

Function at 0x288f68a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [ebp + 0xc], 1
pushal
mov dword [ebp + 0xc], eax
jmp 0x2890ad3

Function at 0x288f6ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ax, word [ebp + 2]
btc cx, ax
btc cx, 2
btc cx, 2
shld cx, ax, 5
mov cx, word [ebp + 4]
cmp ecx, edi
sub ebp, 2
push dword [esp]
div cx
push eax
jmp 0x288e8c8

Function at 0x288f722
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x288fdca
call fcn.0288e6a3
pushfd
mov dword [esp], ecx
sub ebp, 4
pushal
pushfd
mul edx
pushfd
mov dword [ebp + 4], edx
mov word [esp], 0x92d3
push 0x6acad38e
jmp 0x28905b5
mov word [esp], bp
push dword [esp + 0x30]
pop dword [ebp]
push dword [esp + 0xc]
mov byte [esp + 4], 0xe4
lea esp, [esp + 0x38]
jmp 0x288f987
mov dword [ebp + 8], eax
pushfd
pushfd
pop dword [esp + 0x30]
jmp 0x288ee2d

Function at 0x288f79a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x40]
pop dword [ebp]
mov word [esp], di
pushfd
push ebp
lea esp, [esp + 0x4c]
jmp 0x288f987
Function at 0x288fa72
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub ebp, 2
cmc
shr eax, cl
push dword [esp + 4]
mov dword [ebp + 4], eax
pushfd
pushfd
pushfd
pop dword [esp + 0x2c]
jmp 0x28901d1

Function at 0x288fa90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test dh, ch
sub ebp, 4
clc
clc
pushfd
mul dx
call fcn.028904c6

Function at 0x288faa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
stc
rol eax, 0x12
cmp bp, bx
pushfd
sub eax, 0x4298fc30
test ch, 0x74
jmp 0x288fd10
lea esi, [esi - 4]
mov byte [esp + 4], 0xfc
jmp 0x288f005

Function at 0x288fcbf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp], eax
push 0xa3aca8ee
mov byte [esp], 9
push esp
pushal
lea esp, [esp + 0x30]
jmp 0x288f987

Function at 0x288ff97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xf0ad29df
push dword [esp + 0x10]
pop dword [ebp]
mov dword [esp + 8], 0x36935444
pushfd
lea esp, [esp + 0x18]
jmp 0x288f987
push esp
push edx
pushfd
pop dword [esp + 8]
jmp 0x28910cf
push 0xd8df1c75
jmp 0x288ec2c

Function at 0x2890290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edi, [edx + 0x32eeea0b]
lea ebp, [esp + 0x34]
bts bx, 2
sar di, cl
cmp ecx, eax
btc edi, eax
sub esp, 0x8c
rol bl, 1
dec di
call fcn.0288e84a

Function at 0x28902b7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x2890312
push dword [esp + 0x30]
pop dword [ebp]
push 0x660688f9
push ebx
push ebp
lea esp, [esp + 0x40]
jmp 0x288f987

Function at 0x28903cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x28]
pop dword [ebp]
push 0x6eb17059
lea esp, [esp + 0x30]
jmp 0x288f987

Function at 0x289045c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x3c]
pop dword [ebp]
push 0xf11b7aaf
lea esp, [esp + 0x44]
jmp 0x288f987

Function at 0x289071e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pushal
push dword [esp + 0x24]
pop dword [ebp]
pushfd
mov byte [esp], cl
mov word [esp + 0xc], 0xef7c
push dword [esp]
lea esp, [esp + 0x30]
jmp 0x288f987
push ecx
lea esp, [esp + 0x28]
jae 0x288f426
pushal
push dword [esp + 0x20]
pop dword [ebp]
push edi
mov word [esp], 0xe2c0
lea esp, [esp + 0x28]
jmp 0x288f987

Function at 0x28909d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
mov byte [esp + 4], 0x32
mov byte [esp + 4], 0x77
mov dword [ebp], eax
push dword [esp]
pushfd
pushfd
mov byte [esp], ah
lea esi, [esi - 2]
pushfd
mov byte [esp], dl
lea esp, [esp + 0x38]
jmp 0x288f987

Function at 0x2890f6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ebx, 0xff0
pushal
cmp ebx, 0xfe0
pushfd
mov byte [esp], dl
call fcn.0288ebc1

Function at 0x2890f82
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ror al, 5
push ebx
push esi
sub bl, al
test bl, ch
cbw
push dword [esp + 4]
test esp, ebx
cmp bh, dh
cwde
stc
sub ebp, 4
pushfd
jmp 0x2890241
mov dword [ebp], eax
mov dword [esp + 0x10], esi
mov byte [esp], dh
mov byte [esp + 4], cl
lea esp, [esp + 0x50]
jmp 0x288f987
pushal
pushal
jmp 0x288ec80
lea esp, [esp + 0xc]
js 0x289042f
ror al, 5
cmp cl, ch
jmp 0x288fa57
Function at 0x2891076
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 4]
pop dword [ebp]
push ebp
pushfd
pushfd
lea esp, [esp + 0x14]
jmp 0x288f987
pushfd
pop dword [esp]
push edx
jmp 0x288fab5
Function at 0x406390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
call fcn.00404780
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4064a0
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x54
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x57
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x1c], 0
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x1c], 0x78
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x69
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x1c], 0x74
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x1c], 0x6f
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x1c], 0x77
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x1c], 0x74
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x1c], 0x65
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x6e
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x1c], 0x57
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x1c], 0x65
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x1c], 0x53
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x1c], 0x64
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406496
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x407f83
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041d149
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407fba
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00407fdb
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x418194
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4181d9
call fcn.0041d149
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4181d9
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4181f5
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041fcd6
mov ebx, eax
test edi, edi
je 0x4181f3
test esi, esi
je 0x4181f3
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x487f37
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.004fcaa1
call fcn.0041d19d
cmp dword [eax + 0x14], 0
jne 0x487f52
mov ecx, esi
pop esi
jmp fcn.00487338
pop esi
ret

Function at 0x488058
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041c875
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x488094
call fcn.00488277
mov dword [esi + 0xc], 1
jmp 0x488099
call fcn.00488277
cmp dword [esi], 0
je 0x4880e2
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4880bc
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00418269
jmp 0x4880cd
push 0xff
mov ecx, esi
call fcn.0040a258
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040b067
jmp 0x488106
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x488106
push dword [esi]
push dword [ebp - 4]
call fcn.0041d34c
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4881cc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00488277
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x488214
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00418269
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040b067
jmp 0x48821f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0041d34c
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4fa6e2
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.0045d901
call fcn.0041d19d
cmp dword [eax + 0x14], 0
jne 0x4fa6fd
mov ecx, esi
pop esi
jmp fcn.004f9fcb
pop esi
ret
Function at 0x10025af
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1002a48
call fcn.01002774
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1004378
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10023c4
cmp eax, esi
jne 0x10023b7
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10023c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100239e
xor esi, esi
inc esi
mov eax, dword [0x1004374]
cmp eax, esi
jne 0x10023da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002415
mov eax, dword [0x1004374]
test eax, eax
jne 0x100240f
mov dword [0x1004374], esi
push 0x1001114
push 0x1001108
call fcn.0100231b
pop ecx
pop ecx
test eax, eax
je 0x1002415
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10024df
mov dword [0x1004038], esi
mov eax, dword [0x1004374]
cmp eax, esi
jne 0x1002439
push 0x1001104
push 0x10010fc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1004374], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002446
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100437c], ebx
je 0x1002467
push 0x100437c
call fcn.010026e9
pop ecx
test eax, eax
je 0x1002467
push ebx
push 2
push ebx
call dword [0x100437c]
push dword [0x1004020]
push dword [0x1004024]
push dword [0x100401c]
call fcn.01001c8e
add esp, 0xc
mov dword [0x1004034], eax
cmp dword [0x1004028], ebx
jne 0x10024c5
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004038], ebx
jne 0x10024d3
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004034]
call fcn.010027b9
ret
call fcn.010028c1
jmp 0x100237c
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x296a2516
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x191200a2
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x10453997
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x732c448e
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x477b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004f717c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x477b39
test al, 0x10
jne 0x477b3d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47e984
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
and edx, 0xffffffff
mov ecx, 1
mov dword [eax + 8], edx
lea edx, [eax + 8]
mov ebx, dword [edx]
mov esi, ebx
shr esi, 0x1e
xor esi, ebx
imul ebx, esi, 0x6c078965
add ebx, ecx
mov dword [edx + 4], ebx
and dword [edx + 4], 0xffffffff
inc ecx
add edx, 4
cmp ecx, 0x270
jl 0x47e994
mov dword [eax], 1
lea edx, [eax + 8]
mov dword [eax + 4], edx
pop esi
pop ebx
ret

Function at 0x47eb88
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
lea ecx, [eax + 8]
mov edx, ecx
mov dword [eax], 0x270
mov dword [eax + 4], ecx
mov ecx, 0xe4
jmp 0x47ebd2
mov ebx, dword [edx + 4]
mov esi, dword [edx]
mov edi, ebx
and esi, 0x80000000
and edi, 0x7fffffff
or esi, edi
shr esi, 1
test bl, 1
je 0x47ebc3
mov ebx, 0x9908b0df
jmp 0x47ebc5
xor ebx, ebx
xor esi, ebx
xor esi, dword [edx + 0x634]
mov dword [edx], esi
add edx, 4
dec ecx
jne 0x47eba0
mov ecx, 0x18d
jmp 0x47ec0e
mov ebx, dword [edx + 4]
mov esi, dword [edx]
mov edi, ebx
and esi, 0x80000000
and edi, 0x7fffffff
or esi, edi
shr esi, 1
test bl, 1
je 0x47ebff
mov ebx, 0x9908b0df
jmp 0x47ec01
xor ebx, ebx
xor esi, ebx
xor esi, dword [edx - 0x38c]
mov dword [edx], esi
add edx, 4
dec ecx
jne 0x47ebdc
mov ecx, dword [eax + 8]
mov ebx, dword [edx]
mov esi, ecx
and ebx, 0x80000000
and esi, 0x7fffffff
or ebx, esi
shr ebx, 1
test cl, 1
je 0x47ec34
mov eax, 0x9908b0df
jmp 0x47ec36
xor eax, eax
xor ebx, eax
xor ebx, dword [edx - 0x38c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x47ec44
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, eax
dec dword [ebx]
jne 0x47ec52
mov eax, ebx
call fcn.0047eb88
mov edx, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [edx]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x47ec88
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
dec dword [ebx]
jne 0x47ec99
mov eax, ebx
call fcn.0047eb88
mov edx, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [edx]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
mov dword [esp], eax
dec dword [ebx]
jne 0x47ecd8
mov eax, ebx
call fcn.0047eb88
mov eax, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [eax]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
mov dword [esp + 4], eax
and dword [esp], 0xffffffff
and dword [esp + 4], 0xfffff
mov eax, dword [esp]
mov edx, dword [esp + 4]
or edx, 0x3ff00000
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0043ad94
fld qword [esp]
fsub dword [0x47ed40]
pop ecx
pop edx
pop ebx
ret
Function at 0x4875a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004f717c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x4aeedc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x71d8dc]
cmp dword [eax + 0x24], 0
je 0x4aef7f
cmp dword [ebx + 0x84], 0
jne 0x4aef79
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4aee6c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x4aef79
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x4aef42
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4aef79
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.004e026c
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4aef51
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4af98c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x4af9c1
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004f6e20
jmp 0x4af9cb
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.004f6d8c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4b0908
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x4b0940
mov eax, esi
call fcn.004c119c
test al, al
je 0x4b0940
mov eax, dword [ebx + 0x74]
call fcn.004c0ea0
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4b0940
push 0
mov eax, dword [ebx + 0x74]
call fcn.004c0ea0
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret
Function at 0x4b8a10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x71d978], 0
sete dl
or al, dl
jne 0x4b8b50
mov eax, dword [0x71d97c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x71d978]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4b8b1f
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x71d978]
call fcn.004e026c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4b8b17
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x4b8b17
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x4b8b17
mov eax, dword [ebp - 0x14]
call fcn.004c0ea0
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x4b8b17
push ebp
call fcn.004b89cc
pop ecx
test al, al
jne 0x4b8b17
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x4b8ad3
mov eax, dword [ebp - 0x14]
call fcn.004bf82c
dec eax
jle 0x4b8b17
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.004f6464
cmp byte [ebp - 1], 0
je 0x4b8b17
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x4b8b17
mov edx, dword [ebp - 0x14]
mov eax, dword [0x71d97c]
call fcn.004b8218
inc edi
dec esi
jne 0x4b8a66
mov eax, dword [0x71d97c]
cmp dword [eax + 8], 0
jle 0x4b8b37
mov eax, dword [0x71d97c]
call fcn.004b82a8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b8b50
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004b8834
pop ecx
test al, al
jne 0x4b8b50
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret