joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6150
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5c0cec
mov ebx, ecx
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov eax, ebx
and eax, reloc.WSOCK32.dll_accept
jns 0x4d617f
dec eax
or eax, 0xfffffffe
inc eax
je 0x4d618a
pop edi
pop ebp
mov eax, 0x5c0cec
pop ebx
ret
mov eax, ebx
push esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
add esi, 2
push esi
call fcn.00513471
mov edi, eax
push esi
push edi
push ebx
push ebp
call fcn.004d6010
sub esi, 2
mov eax, 1
add esp, 0x14
cmp esi, eax
jle 0x4d61c8
mov cl, byte [eax + edi - 1]
mov bl, byte [eax + edi]
xor bl, cl
mov byte [eax + edi], bl
inc eax
cmp eax, esi
jl 0x4d61b7
push 0
lea edx, [edi + 1]
push 0xffffffffffffffff
push edx
push 0x100
push 0x5c0cec
mov byte [eax + edi], 0
call fcn.004d5940
push edi
call fcn.0051349a
add esp, 0x18
mov eax, 0x5c0cec
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x4d697b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d69d3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x5a4c3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d69c6
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4d69d5
xor eax, eax
pop esi
leave
ret 4
Function at 0x4de810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x549f27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x59fe84]
push ebx
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push eax
push eax
push ecx
lea edx, [esp + 0x14]
mov ebx, 1
push str._s___s___s
push edx
mov dword [esp + 0x44], ebx
call fcn.0050f689
mov eax, dword [esp + 0x1c]
add esp, 0x14
lea ecx, [esp + 0x10]
push eax
call fcn.0040b4cb
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x30], 2
mov eax, dword [ecx + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.0040b5a9
test eax, eax
je 0x4de89e
mov esi, dword [esp + 0x38]
push ebx
push esi
lea ecx, [esp + 0x18]
call fcn.0040b671
mov dword [esp + 0xc], ebx
jmp 0x4de8b2
mov esi, dword [esp + 0x38]
push 0x5a4c3c
mov ecx, esi
call fcn.0051379e
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.0040b56b
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00513730
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4dea50
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x549fa1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], esi
mov dword [esi + 4], 0x55d684
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x18]
mov dword [esp + 0x28], ebx
mov dword [ebp], method.CCommandLineInfo.virtual_0
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], ebx
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x24
mov byte [esp + 0x2c], 1
mov byte [esi + 0x30], al
mov byte [esi + 0x31], cl
mov byte [esi + 0x38], bl
call fcn.00513471
mov edi, eax
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x20], 1
call fcn.005083fe
cmp dword [0x5c153c], ebx
jne 0x4deaf7
mov dword [0x5c153c], edi
mov dword [edi], ebx
mov edx, dword [0x5c153c]
mov dword [esp + 0x14], ebx
mov dword [edx + 8], ebx
mov edx, dword [0x5c1538]
lea ecx, [esp + 0x18]
inc edx
mov dword [0x5c1538], edx
call fcn.0050849a
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4deb1e
push eax
call fcn.0051349a
add esp, 4
mov edi, dword [0x5c153c]
push 0x24
call fcn.00513471
mov dword [eax + 4], edi
mov dword [eax + 0x20], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x34]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi], 0x55d674
mov dword [esi + 0x2c], ebx
mov edi, dword [esi + 0x20]
mov byte [esp + 0x28], 2
dec edi
js 0x4deb7d
cmp edi, ebx
jl 0x4deb7a
cmp edi, dword [esi + 0x20]
jge 0x4deb7a
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + edi*4]
cmp ecx, ebx
je 0x4deb7a
mov edx, dword [ecx]
push 1
call dword [edx + 4]
push 1
push edi
mov ecx, ebp
call fcn.004df6c0
dec edi
jns 0x4deb56
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 4]
mov dword [esi + 0x2c], ebx
call fcn.0044a339
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4e1260
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
xor edi, edi
cmp ebx, edi
jne 0x4e1272
pop edi
or eax, 0xffffffff
pop ebx
ret
push esi
push 0x20
call fcn.00513471
add esp, 4
cmp eax, edi
je 0x4e12b2
mov ecx, dword [0x59fe84]
mov esi, eax
mov dword [eax], ecx
mov edx, dword [0x59fe84]
mov dword [eax + 4], edx
mov ecx, dword [0x59fe84]
mov dword [eax + 0x1c], ecx
mov dword [eax + 8], 3
mov dword [eax + 0xc], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x18], edi
jmp 0x4e12b4
xor esi, esi
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
call fcn.005138b9
mov eax, dword [esp + 0x18]
lea ecx, [esi + 4]
push eax
call fcn.005138b9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x14], ecx
push eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
call fcn.005138b9
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push 0x4e1180
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
pop esi
neg eax
pop edi
dec eax
pop ebx
ret

Function at 0x4e1810
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
mov eax, dword [esp + 8]
push esi
push 0
push 0x5a4c3c
push 0x5a4c3c
push 0
mov esi, ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x30d65], eax
jne 0x4e1848
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 0x14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0x4400000
push 3
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 0x30d69], eax
jne 0x4e1895
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
mov eax, dword [esi + 0x30d65]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 0x14
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4e18cd
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x30d69]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [esi + 0x30d71], eax
call edi
mov edx, dword [esi + 0x30d65]
push edx
call edi
pop edi
xor eax, eax
pop esi
ret 0x14
mov eax, 1
pop esi
ret 0x14
Function at 0x4e1b70
Capabilities:
Send data
Send http request

Disassembly:
mov eax, 0xa000
call fcn.004f86e0
mov al, byte [0x5a4c3c]
push esi
mov esi, ecx
push edi
mov byte [esp + 8], al
mov ecx, 0x27ff
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
push 0xa000
push ecx
mov ecx, esi
stosb byte es:[edi], al
call fcn.004e22e0
mov edx, dword [esp + 0xa00c]
mov eax, dword [esi + 0x30d69]
push 0
push 0x4400000
push 0
push 0x5a4c3c
push str.HTTP_1.0
push edx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edx, eax
test edx, edx
mov dword [esi + 0x30d6d], edx
jne 0x4e1bfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
pop edi
xor eax, eax
pop esi
add esp, 0xa000
ret 4
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Content_Type:_application_x_www_form_urlencoded_r_n
push ecx
lea ecx, [esp + 0xc]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4e1c45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
pop edi
xor eax, eax
pop esi
add esp, 0xa000
ret 4
pop edi
mov eax, 1
pop esi
add esp, 0xa000
ret 4
Function at 0x4e1e80
Capabilities:
Read data from internet
Receive data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x30d6d]
test eax, eax
jne 0x4e1e9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 8
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, edx
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, ebx
push 0x5c1554
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x30d6d]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
pop edi
pop ebp
test eax, eax
pop ebx
jne 0x4e1eeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 8
mov eax, dword [0x5c1554]
pop esi
ret 8
Function at 0x4e2670
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
push edi
xor edi, edi
cmp eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jae 0x4e2701
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea ebx, [eax + 0x100]
mov edx, dword [ebx + 0x400]
dec edx
je 0x4e26db
dec edx
jne 0x4e26e1
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
lea edi, [edi + eax + 0x1800]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x4e26e1
add edi, 0x2000
mov edx, dword [ecx + 0xc]
add eax, 0x504
add ebx, 0x504
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x4e2697
pop esi
pop ebp
mov eax, edi
pop ebx
pop edi
add esp, 8
ret
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4e2710
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0xc], 0x400
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x4e274d
lea edi, [esi + ebx]
push 1
push 0x59099c
push edi
call fcn.004fb40a
add esp, 0xc
test eax, eax
je 0x4e274d
dec esi
dec edi
test esi, esi
ja 0x4e2733
lea eax, [esp + 0x14]
add esi, ebx
push eax
push 1
push 0
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e27c1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0x5c1558
push eax
push eax
push str.Content_Type
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4e27aa
mov edi, str.application_octet_stream
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.application_octet_stream
push 0x5c1558
call fcn.004f8f75
add esp, 0xc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x5c1558
pop ebx
pop ecx
ret 4
mov edi, str.application_octet_stream
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.application_octet_stream
push 0x5c1558
call fcn.004f8f75
add esp, 0xc
mov eax, 0x5c1558
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4e2f40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x54a2c0
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
push 0
push 0x590ae8
push 0x590af0
lea ecx, [esi + 4]
call fcn.0041fb62
mov al, byte [esi + 0xbe]
test al, al
je 0x4e3060
push 0xa
lea ecx, [esp + 0x14]
call fcn.00512e17
mov dword [esp + 0xc], 0x55ac60
lea eax, [esp + 4]
push str.passport
push eax
mov ecx, esi
mov dword [esp + 0x5c], 0
call fcn.0040c76c
mov eax, dword [eax]
push 1
push eax
push str.passport
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 1
call fcn.004e2b90
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00513730
lea ecx, [esp + 4]
push 0x5926a4
push ecx
mov ecx, esi
call fcn.0040c76c
mov eax, dword [eax]
push 1
push eax
push 0x5926a4
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 2
call fcn.004e2b90
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00513730
lea edx, [esp + 4]
lea ecx, [esp + 0xc]
push edx
call fcn.004e2df0
mov eax, dword [eax]
mov ecx, esi
push eax
push 0
push 0xffffffffffffffff
push 1
mov byte [esp + 0x64], 3
call fcn.004e40c0
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00513730
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0xc], 0x55ac60
call fcn.00512ef9
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
push ebx
push 0xa
lea ecx, [esp + 0x38]
call fcn.00512e17
mov dword [esp + 0x30], 0x55ac60
lea eax, [esp + 8]
mov ebx, 4
push str.uname
push eax
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0040c76c
mov eax, dword [eax]
push 1
push eax
push str.uname
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 5
call fcn.004e2b90
lea ecx, [esp + 8]
mov byte [esp + 0x58], bl
call fcn.00513730
lea ecx, [esp + 8]
push str.password
push ecx
mov ecx, esi
call fcn.0040c76c
mov eax, dword [eax]
push 1
push eax
push str.passwd
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 6
call fcn.004e2b90
lea ecx, [esp + 8]
mov byte [esp + 0x58], bl
call fcn.00513730
lea edx, [esp + 0xc]
lea ecx, [esp + 0x30]
push edx
call fcn.004e2df0
mov eax, dword [eax]
mov ecx, esi
push eax
push 0
push 0xffffffffffffffff
push 1
mov byte [esp + 0x68], 7
call fcn.004e40c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], bl
call fcn.00513730
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x30], 0x55ac60
call fcn.00512ef9
mov ecx, dword [esp + 0x50]
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x4e3540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54a338
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x59fe84]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
xor esi, esi
push str._u:_u:_u____
push ecx
mov dword [esp + 0x34], esi
call fcn.0050f689
add esp, 0x14
lea edx, [edi + 0x99]
lea ecx, [esp + 0xc]
push esi
push edx
call fcn.004f0c9b
push 0xc350
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.004f0cc2
test eax, eax
jne 0x4e35e7
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], al
call fcn.004f0cd7
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00513730
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [0x59fe84]
push ebx
push ebp
mov dword [esp + 0x38], eax
mov ebp, dword [edi + 0x8d]
mov byte [esp + 0x28], 2
cmp ebp, esi
jle 0x4e363b
mov ecx, dword [edi + 0x89]
lea edx, [ecx + esi*4]
lea ecx, [esp + 0x38]
push edx
call fcn.00513869
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
call fcn.0050f303
test eax, eax
je 0x4e362d
inc esi
cmp esi, ebp
jl 0x4e3601
jmp 0x4e363b
push 1
push esi
lea ecx, [edi + 0x85]
call fcn.00512102
lea ecx, [esp + 0x14]
call fcn.004f0cd7
cmp esi, ebp
lea ecx, [esp + 0x38]
setl bl
mov byte [esp + 0x28], 1
call fcn.00513730
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.004f0cd7
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00513730
mov ecx, dword [esp + 0x20]
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x4e45f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 1
push eax
call fcn.004e4d50
push 0
mov ebx, eax
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004e4d50
xor edx, edx
mov dl, byte [ebx + 0x1f]
mov esi, edx
test esi, esi
je 0x4e47a3
cmp esi, 0x1f
jge 0x4e47a3
cmp byte [esi + ebx], 0xe9
jne 0x4e47a3
mov ecx, dword [esi + ebx + 1]
lea edi, [ecx + ebx + 5]
mov cl, byte [ecx + ebx + 5]
cmp cl, 0xe9
je 0x4e4656
push 9
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov edx, dword [edi + 1]
lea ecx, [edx + edi + 5]
cmp ecx, eax
je 0x4e4674
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x4e46ba
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4e46ba
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4e46ba
lea edx, [esp + 0x18]
push edx
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
mov eax, ebx
test esi, esi
mov edx, edi
jle 0x4e46d8
push 0
push eax
push edx
call fcn.004e4d90
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
lea edx, [ecx + edi]
jl 0x4e46c4
cmp ecx, esi
je 0x4e474a
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e47ab
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4e47ab
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4e47ab
push eax
mov eax, dword [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4e47ab
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e4795
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4e4795
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4e4795
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4e4795
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x4e91c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x54a59c
call fcn.004f8378
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
mov esi, ecx
push edi
shr eax, 0x10
test ax, ax
mov dword [esi + 0x40], ebx
jne 0x4e91f3
cmp dword [esi + 0x3c], 0
jne 0x4e91f3
movzx eax, bx
mov dword [esi + 0x3c], eax
call fcn.0052dc74
mov edi, dword [eax + 0xc]
push 5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4e921e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4e9226
or eax, 0xffffffff
jmp 0x4e92a9
call fcn.0042fbee
xor ecx, ecx
cmp eax, ecx
jle 0x4e9234
mov dword [esi + 0x5c], eax
cmp dword [esi + 0x5c], ecx
jle 0x4e929b
mov eax, dword [0x59fe84]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp + 8]
push eax
push ebx
mov dword [ebp - 0x10], ecx
call fcn.0051a5fc
add esp, 0xc
test eax, eax
je 0x4e928f
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0051a44b
mov ax, word [esi + 0x5c]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.0051a66b
lea ecx, [ebp - 0x1c]
call fcn.0051a4e8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov ebx, eax
call fcn.0051a4da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00513730
push edi
push 0
push dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.005184b6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4e92ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x54a5b8
call fcn.004f8378
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x48]
mov ebx, dword [esi + 0x44]
call fcn.0052dc74
cmp dword [esi + 0x40], 0
je 0x4e92fb
call fcn.0052dc74
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4e9308
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4e9314
or eax, 0xffffffff
jmp 0x4e9396
call fcn.0042fbee
xor ebx, ebx
cmp eax, ebx
jle 0x4e9322
mov dword [esi + 0x5c], eax
cmp dword [esi + 0x5c], ebx
jle 0x4e9389
mov eax, dword [0x59fe84]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0x14], ebx
call fcn.0051a5fc
add esp, 0xc
test eax, eax
je 0x4e937d
push edi
lea ecx, [ebp - 0x20]
call fcn.0051a44b
mov ax, word [esi + 0x5c]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call fcn.0051a66b
lea ecx, [ebp - 0x20]
call fcn.0051a4e8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.0051a4da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513730
mov ecx, esi
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], ebx
call fcn.00518809
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret