joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49b9c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
xor esi, esi
mov ebx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0x4d9d54
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x6c], esi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov edx, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x74]
mov ecx, ebp
push eax
call dword [edx + 0x30]
cmp dword [ebx + 0x68], esi
je 0x461dbf
mov ecx, dword [ebp + 8]
push edi
push 6
push ecx
call dword [sym.imp.GDI32.dll_GetCurrentObject]
push eax
call fcn.00492cd3
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x10]
cmp ecx, 0x3c
jne 0x461d00
mov dword [esp + 0x14], esi
mov ecx, dword [eax + 0x10]
cmp ecx, esi
jne 0x461cc7
xor eax, eax
jmp 0x461cca
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
push eax
call fcn.004929d7
mov eax, dword [ebx + 0x6c]
cmp dword [eax + 0x10], esi
je 0x461ce9
mov esi, dword [eax + 8]
mov ecx, 0xf
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0x2c], ecx
jmp 0x461d3b
lea edx, [esp + 0x2c]
push edx
push 0x3c
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.004929d7
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0045b8d0
mov edx, dword [ebp]
add esp, 8
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call dword [edx + 0x28]
mov eax, dword [ebx + 0x70]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [ebx + 0x4c]
mov edx, dword [esp + 0x24]
mov ecx, dword [ebx + 0x70]
sub eax, edx
cdq
mov edi, dword [ebp]
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
sar eax, 1
push 0x14
push eax
mov ecx, ebp
call dword [edi + 0x5c]
mov ecx, dword [ebx + 0x4c]
mov edx, dword [esp + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [esp + 0x78]
add edx, 0x14
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x28], edx
mov eax, dword [ebp]
push ecx
mov ecx, ebp
call dword [eax + 0x28]
lea ecx, [esp + 0x1c]
call fcn.00492d3f
pop edi
mov eax, dword [esp + 0xc]
mov edx, dword [ebp]
push eax
mov ecx, ebp
call dword [edx + 0x30]
mov dword [esp + 0x18], 0x4d9d48
lea ecx, [esp + 0x18]
mov dword [esp + 0x6c], 1
call fcn.00492d3f
mov ecx, dword [esp + 0x64]
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 8
Function at 0x4645b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49bd98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
push 0xa
lea ecx, [esp + 0x10]
call fcn.0048b661
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ecx, ebx
mov dword [esp + 0x30], 0
je 0x464739
mov eax, dword [edi + 0xb4]
test eax, eax
je 0x464739
test ecx, ecx
jne 0x464649
imul eax, ebx
xor esi, esi
test eax, eax
jle 0x464739
push 8
call fcn.0048bdca
add esp, 4
mov dword [eax], 0
lea ecx, [edi + 0xd8]
mov dword [eax + 4], 0
push eax
call fcn.0048b721
mov eax, dword [edi + 0xb4]
inc esi
imul eax, ebx
cmp esi, eax
jl 0x464613
jmp 0x464739
mov esi, dword [edi + 0xdc]
test ebx, ebx
jne 0x46467a
test esi, esi
je 0x46466f
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
test eax, eax
je 0x46466b
push eax
call fcn.0048bdf3
add esp, 4
test esi, esi
jne 0x464657
lea ecx, [edi + 0xd8]
jmp 0x464734
test esi, esi
je 0x464693
mov eax, esi
mov esi, dword [esi]
lea ecx, [esp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0048b721
test esi, esi
jne 0x46467e
lea ecx, [edi + 0xd8]
call fcn.0048b80b
mov ecx, dword [edi + 0xb4]
xor esi, esi
imul ecx, ebx
test ecx, ecx
jle 0x464710
push 8
call fcn.0048bdca
mov edx, dword [edi + 0xb4]
add esp, 4
imul edx, dword [ebp + 8]
cmp esi, edx
mov ebx, eax
jge 0x4646e8
push esi
lea ecx, [esp + 0x10]
call fcn.0048b74a
test eax, eax
je 0x464763
mov eax, dword [eax + 8]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
jmp 0x4646f5
mov dword [ebx], 0
mov dword [ebx + 4], 0
push ebx
lea ecx, [edi + 0xd8]
call fcn.0048b721
mov eax, dword [edi + 0xb4]
inc esi
imul eax, dword [ebp + 0xc]
cmp esi, eax
jl 0x4646ad
mov esi, dword [esp + 0x10]
test esi, esi
je 0x464730
mov eax, esi
mov esi, dword [esi]
mov eax, dword [eax + 8]
test eax, eax
je 0x46472c
push eax
call fcn.0048bdf3
add esp, 4
test esi, esi
jne 0x464718
lea ecx, [esp + 0xc]
call fcn.0048b80b
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048b6a0
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048b6a0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49be87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x4f6100]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0xac]
lea edx, [esp + 0xc]
push ecx
push 0x4f5ad4
push edx
mov dword [esp + 0x30], 1
call fcn.00489889
mov eax, dword [0x4f6100]
add esp, 0xc
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push 0x4f5ad0
push edx
mov byte [esp + 0x30], 2
call fcn.0048c346
push 0x4f5acc
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x2c], 3
push eax
call fcn.0048c2d2
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov edi, dword [eax]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x2c], 4
call fcn.00464e50
sub esp, 8
lea eax, [esp + 0x10]
fstp qword [esp]
push edi
push eax
call fcn.00489889
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.0048c089
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call fcn.0048c089
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0048bdfe
mov dword [esp + 0x18], 1
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
call fcn.0048c089
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.0048c089
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x464fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49beb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
xor esi, esi
mov ebx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0x4d9dc4
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x6c], esi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov edx, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x70]
mov ecx, ebp
push eax
call dword [edx + 0x30]
cmp dword [ebx + 0x68], esi
je 0x46514f
mov ecx, dword [ebp + 8]
push edi
push 6
push ecx
call dword [sym.imp.GDI32.dll_GetCurrentObject]
push eax
call fcn.00492cd3
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax + 0x10]
cmp ecx, 0x3c
jne 0x465090
mov dword [esp + 0x14], esi
mov ecx, dword [eax + 0x10]
cmp ecx, esi
jne 0x465057
xor eax, eax
jmp 0x46505a
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
push eax
call fcn.004929d7
mov eax, dword [ebx + 0x6c]
cmp dword [eax + 0x10], esi
je 0x465079
mov esi, dword [eax + 8]
mov ecx, 0xf
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
xor esi, esi
mov dword [esp + 0x2c], ecx
jmp 0x4650cb
lea edx, [esp + 0x2c]
push edx
push 0x3c
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
call fcn.004929d7
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0045b8d0
mov edx, dword [ebp]
add esp, 8
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call dword [edx + 0x28]
mov eax, dword [ebx + 0x74]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [ebx + 0x44]
mov edx, dword [esp + 0x24]
mov ecx, dword [ebx + 0x74]
sub eax, edx
cdq
mov edi, dword [ebp]
sub eax, edx
mov edx, dword [ecx - 8]
push edx
push ecx
sar eax, 1
push 0x14
push eax
mov ecx, ebp
call dword [edi + 0x5c]
mov ecx, dword [ebx + 0x44]
mov edx, dword [esp + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [esp + 0x78]
add edx, 0x14
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x28], edx
mov eax, dword [ebp]
push ecx
mov ecx, ebp
call dword [eax + 0x28]
lea ecx, [esp + 0x1c]
call fcn.00492d3f
pop edi
mov eax, dword [esp + 0xc]
mov edx, dword [ebp]
push eax
mov ecx, ebp
call dword [edx + 0x30]
mov dword [esp + 0x18], 0x4d9db8
lea ecx, [esp + 0x18]
mov dword [esp + 0x6c], 1
call fcn.00492d3f
mov ecx, dword [esp + 0x64]
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 8
Function at 0x4670b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49c123
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [0x4f6100]
mov dword [esp + 0x14], 0
mov dword [esi + 0x14], eax
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
mov byte [esp + 0x1c], 1
mov dword [esi], 0x4d9df4
call fcn.0048bdfe
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.00467160
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048c089
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0x14

Function at 0x46ec60
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x46ed03
test eax, eax
jbe 0x46ed03
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x46ed03
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46ecae
xor esi, esi
jmp 0x46ecb4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46ecdf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00410160
add esi, eax
push esi
mov ebx, esi
call fcn.00410160
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x46ecc0
pop ebp
test edi, edi
pop edi
jne 0x46ed03
test ebx, ebx
je 0x46ed03
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0047b0b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x46ee45
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46ef5d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46ef5d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048da9c
mov esi, eax
test esi, esi
je 0x46ef5d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46ef5d
mov ecx, esi
call fcn.0046edb0
cmp edi, eax
jge 0x46ef5d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46eee3
mov dword [esp + 0x34], 1
jmp 0x46ef3e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46ef5d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046d5f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x473190
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4731f6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4731f6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4731d7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x473580
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4735b8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x474250
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x474299
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x474710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49d470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004742c0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00474340
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00474340
lea ecx, [esi + 0xc]
call fcn.0048c014
lea ecx, [esi + 0x10]
call fcn.0048c014
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004758d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004758d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004758d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0048c089
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048c089
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x48e43f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48e477
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048c4e4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048c4bc
jmp 0x48e483
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48fb2d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48fb6f
call fcn.00495e68
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48fb6f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48fb66
xor eax, eax
jmp 0x48fb77
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048fb7d
pop edi
pop esi
pop ebx
ret 4

Function at 0x496398
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4963c6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4963e4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004962fe
jmp 0x4963e4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4963e4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004962fe
test edi, edi
mov eax, edi
jne 0x4963ce
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40ed6d
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, 0x40eae0
dec edx
call fcn.0040ed8c
add edx, edx
or edx, edx
xor dword [edi], ecx
inc edi
sub esi, 0x4373a6ba
cmp edi, eax
jne fcn.0040ed6d
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x2b6c7a23
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1296fe5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x43b62a
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
push ecx
pop ecx
mov eax, 0xfda12337
add eax, 1
call fcn.0043b660
inc ecx
add eax, ecx
sub eax, ecx
xor dword [esi], edx
dec eax
inc esi
mov eax, 0x33ad57c5
cmp esi, ebx
jne fcn.0043b62a
inc ecx
sub ecx, 1
ret

Function at 0x40206c
Capabilities:
Allocate or change rwx memory

Disassembly:
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.00401fe6
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
jmp 0x4020ea
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
jmp 0x402010
or al, 0x40
mov edi, 0x40389b
push eax
sub edi, fcn.00403045
push edi
push fcn.00403045
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402129
mov eax, fcn.00403045
mov ebx, esi
mov edx, edi
call fcn.00401fe6
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call fcn.00402630
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.00402bb7
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00403045
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x422081
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
lea edi, [ebp - 0x5c]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x34
call fcn.0044eee1
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x4220d5
mov ecx, dword [ebp - 0x18]
call fcn.0040a7aa
mov dword [ebp - 0x1c], eax
jmp 0x4220dc
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [edx + 0x2c], ecx
mov esi, esp
push 0xfffffffffffffffc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79b4]
cmp esi, esp
call fcn.0044eea1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
mov esi, esp
push 0x10001b4f
push 0xfffffffffffffffc
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79b8]
cmp esi, esp
call fcn.0044eea1
mov esi, esp
mov ecx, dword [ebp - 0x10]
push ecx
push 0x10099040
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79bc]
cmp esi, esp
call fcn.0044eea1
mov esi, esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
push edx
push 0x10099030
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [0x100a79bc]
cmp esi, esp
call fcn.0044eea1
mov esi, esp
push 0x10001b4f
push 0x10099020
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call dword [0x100a79bc]
cmp esi, esp
call fcn.0044eea1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, 0x100a34b8
call fcn.0040a246
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x5c
cmp ebp, esp
call fcn.0044eea1
mov esp, ebp
pop ebp
ret