joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438c40
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4b5a54]
sub esp, 0x104
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x438ca3
mov eax, dword [0x4a3150]
mov ecx, dword [0x4a3154]
mov edx, dword [0x4a3158]
mov dword [esp + 8], eax
mov al, byte [0x4a315c]
push edi
mov dword [esp + 0x10], ecx
mov byte [esp + 0x18], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x19]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x4b5a54], eax
pop edi
je 0x438d52
mov ecx, dword [fcn.004b5a58]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ecx, ebx
jne 0x438cc9
push 0x4aefb0
push eax
call esi
mov dword [fcn.004b5a58], eax
cmp eax, ebx
mov eax, dword [0x4b5a54]
je 0x438d41
cmp dword [fcn.004b5a5c], ebx
jne 0x438ce7
push 0x4aefa0
push eax
call esi
mov dword [fcn.004b5a5c], eax
cmp eax, ebx
mov eax, dword [0x4b5a54]
je 0x438d41
cmp dword [fcn.004b5a60], ebx
jne 0x438d05
push 0x4aef94
push eax
call esi
mov dword [fcn.004b5a60], eax
cmp eax, ebx
mov eax, dword [0x4b5a54]
je 0x438d41
cmp dword [fcn.004b5a64], ebx
jne 0x438d23
push 0x4aef80
push eax
call esi
mov dword [fcn.004b5a64], eax
cmp eax, ebx
mov eax, dword [0x4b5a54]
je 0x438d41
cmp dword [fcn.004b5a68], ebx
jne 0x438d5d
push 0x4aef68
push eax
call esi
cmp eax, ebx
mov dword [fcn.004b5a68], eax
jne 0x438d5d
mov eax, dword [0x4b5a54]
cmp eax, ebx
je 0x438d52
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4b5a54], ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret

Function at 0x438f10
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
test ecx, ecx
je 0x438fa3
call fcn.0046ef86
mov ecx, dword [eax + 4]
call fcn.0045c72d
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, eax
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x10], 0x103
jne 0x438f96
push 0
call esi
push 0x32
call esi
call edi
sub eax, ebx
cmp eax, ebp
jb 0x438f44
mov ecx, dword [esp + 0x18]
push 0
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, eax
call fcn.0046ef86
mov ecx, dword [eax + 4]
call fcn.0045c742
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.0046ef86
mov ecx, dword [eax + 4]
call fcn.0045c742
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4390b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x334
push esi
call fcn.0046ef86
mov eax, dword [eax + 8]
lea ecx, [esp + 0x34]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x34]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4391b6
push edi
push esi
call fcn.0045c9ed
add esp, 4
mov edi, eax
lea ecx, [esp + 0x38]
push edi
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x43919f
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push 0x4ab9dc
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x43919f
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
push ecx
push edx
lea eax, [esp + 0x144]
push 0x4ab9b4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp + 0x13c]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
cmp byte [eax], 0
je 0x439189
cmp byte [eax], 0x2c
jne 0x439177
mov byte [eax], 0x2e
mov cl, byte [eax]
cmp cl, 0x20
je 0x439181
mov byte [edx], cl
inc edx
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x43916f
mov byte [edx], 0
mov edx, dword [esp + 0x340]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call fcn.0045ca16
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x334
ret
xor eax, eax
pop esi
add esp, 0x334
ret

Function at 0x4391c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
push ebx
push esi
call fcn.0046ef86
mov eax, dword [eax + 8]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [esp + 0x11c]
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
mov dword [ebx], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x439264
push edi
push esi
call fcn.0045c9ed
add esp, 4
mov edi, eax
lea ecx, [esp + 0x18]
push edi
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, eax
test esi, esi
je 0x43924f
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push eax
push 0x4ab9dc
push edi
call sub.VERSION.dll_VerQueryValueA
mov esi, eax
test esi, esi
je 0x43924f
mov ecx, dword [esp + 0xc]
cmp word [ecx], 0x409
jne 0x43924f
mov dword [ebx], 1
push edi
call fcn.0045ca16
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
Function at 0x439380
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x128
mov eax, dword [0x4b12d8]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x12c]
mov dword [esp + 0x14], ecx
push ebx
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0x20], ecx
push esi
lea eax, [esp + 0x18]
push edi
mov dword [esp + 0x2c], ecx
push eax
push ecx
push ecx
push ecx
push 1
mov dword [esp + 0x2c], 0x7d00
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x38], edx
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x439511
mov ecx, dword [esp + 0x18]
push ecx
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
mov ebx, eax
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push ecx
call sub.MPR.dll_WNetEnumResourceA
mov ebp, eax
test ebp, ebp
jne 0x4394ce
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
jbe 0x4394d6
lea esi, [ebx + 0x14]
mov eax, dword [esi - 4]
test eax, eax
je 0x43946d
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push edx
call fcn.0045ce35
lea ecx, [esp + 0x10]
call fcn.0045d15a
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
call fcn.00455c74
cmp eax, 0xffffffff
je 0x4394bc
mov ecx, dword [esi - 4]
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], eax
jmp 0x4394ae
mov ecx, dword [esi]
push ecx
lea ecx, [esp + 0x14]
call fcn.0045ce35
lea ecx, [esp + 0x10]
call fcn.0045d15a
mov edx, dword [esp + 0x140]
lea ecx, [esp + 0x10]
push edx
call fcn.00455c74
cmp eax, 0xffffffff
je 0x4394bc
mov eax, dword [esi]
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x34]
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x20]
push eax
call sub.MPR.dll_WNetDisconnectDialog1A
test eax, eax
jne 0x4394ea
mov eax, dword [esp + 0x14]
inc edi
add esi, 0x20
cmp edi, eax
jb 0x439422
jmp 0x4394d6
cmp ebp, 0x103
jne 0x439500
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp ebp, 0x103
je 0x439507
jmp 0x4393e3
lea ecx, [esp + 0x10]
call fcn.0045ccac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x1c]
push ecx
call sub.MPR.dll_WNetCloseEnum
lea ecx, [esp + 0x10]
call fcn.0045ccac
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x128
ret
Function at 0x44f087
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4b4cf0
cmp edx, dword [eax]
je 0x44f0a9
add eax, 8
inc ecx
cmp eax, 0x4b4d80
jl 0x44f09a
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4b4cf0]
jne 0x44f1d7
mov eax, dword [0x4b7b30]
cmp eax, 1
je 0x44f1b1
test eax, eax
jne 0x44f0da
cmp dword [0x4b2544], 1
je 0x44f1b1
cmp edx, 0xfc
je 0x44f1d7
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44f111
lea eax, [ebp - 0x1a4]
push 0x48b3d4
push eax
call fcn.0044ce30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00449bc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x44f154
lea eax, [ebp - 0x1a4]
push eax
call fcn.00449bc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x48b3d0
push edi
call fcn.0044f570
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x48b3b4
push eax
call fcn.0044ce30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0044ce40
lea eax, [ebp - 0xa0]
push 0x48b3b0
push eax
call fcn.0044ce40
push dword [esi + 0x4b4cf4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0044ce40
push 0x12010
lea eax, [ebp - 0xa0]
push 0x48b388
push eax
call fcn.004504a2
add esp, 0x2c
pop edi
jmp 0x44f1d7
lea eax, [ebp + 8]
lea esi, [esi + 0x4b4cf4]
push 0
push eax
push dword [esi]
call fcn.00449bc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x455070
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00447a20
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x45513b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x45513b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4550ee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4550f9
or bh, 8
and edi, 0x8000000
je 0x455114
mov eax, dword [0x4b92dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x45513b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x45553b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x45555f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x45557a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x458513
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x458535
cmp dword [edi + 0x3c], 0
jne 0x458535
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0046ef86
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00458562
pop edi
pop esi
pop ebx
ret 8

Function at 0x4585b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0046ef86
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4585e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004585f4
pop edi
pop esi
pop ebx
ret 8

Function at 0x459ba5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x459bdd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045d0df
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045d0b7
jmp 0x459be9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x459bed
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x4b7468
mov ecx, edi
call fcn.0045ce35
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x459c40
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x459c53
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.0045d0df
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.0045d0b7
jmp 0x459c53
mov ecx, esi
call fcn.0045c08b
test eax, eax
je 0x459c53
push edi
mov ecx, eax
call fcn.00459ba5
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x45b846
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45b888
call fcn.0046ef86
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45b888
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45b87f
xor eax, eax
jmp 0x45b890
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045b896
pop edi
pop esi
pop ebx
ret 4
Function at 0x46f75b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.0046ef86
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x46f798
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46f798
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x46f79c
xor eax, eax
jmp 0x46f81a
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.0045c9ed
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x46f7d4
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x46f7be
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.0046f90b
push ebx
mov edi, eax
call fcn.0045ca16
test edi, edi
pop ecx
je 0x46f816
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.0046f6d4
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0046f81f
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x470edc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x470f0a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x470f28
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00470e42
jmp 0x470f28
mov eax, dword [esi + 0x14]
test eax, eax
je 0x470f28
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00470e42
test edi, edi
mov eax, edi
jne 0x470f12
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x40de38
mov ecx, 0x27341422
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3b4e60fe
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x100f0037
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x401833
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0xc67368], 0
jne 0x401866
mov edx, 0
mov eax, 0
jmp 0x4018a0
push 0x33
call 0x40186d
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret

Function at 0x4018a4
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0xc67368], 0
jne 0x4018d7
mov edx, 0
mov eax, 0
jmp 0x40190f
push 0x33
call 0x4018de
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x401915
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0xc67368], 0
jne 0x40193c
mov eax, 0
jmp 0x401971
push 0x33
call 0x401943
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x401aa0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0xc67368], 0
jne 0x401abb
jmp 0x401b5c
cmp dword [ebp + 8], 0
jne 0x401ac5
cmp dword [ebp + 0xc], 0
je 0x401aef
cmp dword [ebp + 0x10], 0
jne 0x401ad5
cmp dword [ebp + 0x14], 0
je 0x401aef
cmp dword [ebp + 0x18], 0
jne 0x401ae5
cmp dword [ebp + 0x1c], 0
je 0x401aef
xor eax, eax
jmp 0x401af4
mov eax, 1
test eax, eax
je 0x401b01
jmp 0x401b5c
push 0x33
call 0x401b08
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x18

Function at 0x401b62
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0xc67368], 0
jne 0x401b89
mov eax, 0
jmp 0x401bbc
push 0x33
call 0x401b90
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x401bde
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0xc67368], 0
jne 0x401c05
mov eax, 0
jmp 0x401c4d
mov dword [ebp - 4], 0
push 0x33
call 0x401c13
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x10