joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e910
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x580580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
lea ebp, [edi + 0x6c]
push ebp
call fcn.00564ae3
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push 0
mov ecx, ebp
mov dword [esp + 0x3c], 0
call fcn.0056519e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44e9d2
mov eax, dword [0x412074]
mov dword [esp + 0xc], eax
push 0
mov ecx, ebp
mov byte [esp + 0x24], 1
call fcn.0056519e
push eax
lea ecx, [esp + 0x10]
push 0x402d64
push ecx
call fcn.0055e243
mov edx, dword [esp + 0x18]
add esp, 0xc
push 0x10
push 0
push edx
call fcn.0056c4bc
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.00564d6e
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], esi
call fcn.00564d6e
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push esi
mov dword [edi + 0x70], ebp
mov dword [edi + 0x74], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor ecx, ecx
mov edx, esi
push 9
push esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov byte [edx + 8], cl
mov byte [esi], 4
mov eax, dword [esp + 0x1c]
mov dword [esi + 5], ebp
mov dword [esi + 1], eax
mov ecx, dword [edi + 0xb1c]
push ecx
mov ecx, dword [edi + 0xb20]
call fcn.00449660
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.00564d6e
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x453400
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push edi
push eax
xor edi, edi
push 0x8004667e
push ebx
mov dword [esp + 0x28], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test esi, esi
jle 0x453445
mov ebp, dword [esp + 0x18]
push 0
lea ecx, [edi + ebp]
push esi
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x453445
sub esi, eax
add edi, eax
test esi, esi
jg 0x45342b
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x453450
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x2104
call fcn.0054dbd0
mov eax, dword [esp + 0x2108]
push ebx
push ebp
push esi
mov ebp, dword [eax]
mov ebx, dword [eax + 4]
push edi
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x5a5c74]
test al, al
je 0x453572
mov edi, dword [sym.imp.WS2_32.dll_recv]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 1
xor eax, eax
lea ecx, [esp + 0x14]
cmp dword [ecx], ebx
je 0x4534b7
inc eax
add ecx, 4
cmp eax, 1
jb 0x4534aa
cmp eax, 1
jne 0x4534c8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 2
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x453572
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x453524
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebp
call edi
mov esi, eax
test esi, esi
jle 0x453572
lea eax, [esp + 0x114]
push esi
push eax
push ebx
call fcn.00453400
add esp, 0xc
test eax, eax
je 0x453572
cmp eax, esi
jne 0x453572
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x453565
push 0
lea edx, [esp + 0x118]
push 0x2000
push edx
push ebx
call edi
mov esi, eax
test esi, esi
jle 0x453572
lea eax, [esp + 0x114]
push esi
push eax
push ebp
call fcn.00453400
add esp, 0xc
test eax, eax
je 0x453572
cmp eax, esi
jne 0x453572
mov al, byte [0x5a5c74]
test al, al
jne 0x453498
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2104
ret 4

Function at 0x453590
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4535ae
xor eax, eax
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor eax, eax
push edx
mov dword [esp + 0xa], eax
mov word [esp + 8], 2
mov dword [esp + 0xe], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x12], eax
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x453601
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x10
ret
push 3
push esi
call dword [sym.imp.WS2_32.dll_listen]
mov eax, dword [0x5a4c6c]
inc eax
mov dword [0x5a4c6c], eax
mov dword [eax*4 + 0x5a3c6c], esi
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x453630
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
xor eax, eax
push esi
mov dword [esp + 0xa], eax
mov word [esp + 8], 0
mov dword [esp + 0xe], eax
mov dword [esp + 4], 0x10
mov dword [esp + 0x12], eax
push eax
push eax
mov word [esp + 0x1e], ax
call fcn.00453590
mov esi, eax
add esp, 8
test esi, esi
jbe 0x45367c
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x45368a
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0xa]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x1c]
mov word [ecx], ax
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x45375a
Capabilities:
Create thread
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov eax, 0x2030
call fcn.0054dbd0
push esi
mov esi, ecx
push edi
mov ecx, 0x803
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x2c], 0x4185e4
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x203c]
mov dword [esp + 0x24], 1
push eax
push 0
call fcn.00453590
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x10], edi
jbe 0x453925
mov ecx, dword [esp + 0x2040]
push ecx
push 0
call fcn.00453590
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
jbe 0x45391e
xor edx, edx
push ebx
mov dword [esp + 0x18], edx
lea eax, [esp + 0xc]
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edx
push eax
push ecx
mov dword [esp + 0x2c], edx
mov ebp, 0x10
push edi
mov edi, dword [sym.imp.WS2_32.dll_getsockname]
mov dword [esp + 0x34], edx
mov dword [esp + 0x1c], ebp
call edi
mov edx, dword [esp + 0x1e]
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
push edx
call ebx
and eax, 0xffff
lea ecx, [esp + 0x10]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x1c]
push ecx
mov dword [esp + 0x28], eax
push edx
push ebp
mov dword [esp + 0x34], eax
call edi
mov eax, dword [esp + 0x1e]
push eax
call ebx
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.WS2_32.dll_accept]
push 0
and eax, 0xffff
push 0
push ecx
mov dword [esi + 8], eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45390d
lea edx, [esp + 0x2c]
push 4
push edx
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x45390d
mov al, byte [0x5a5c74]
mov dword [esp + 0x38], esi
test al, al
je 0x45390d
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push ebp
call edi
cmp eax, 0xffffffff
je 0x4538f9
mov ecx, dword [0x5a4c70]
inc ecx
mov dword [0x5a4c70], ecx
mov ecx, dword [esp + 0x3c]
cmp ecx, 0x800
jge 0x4538bb
inc ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + ecx*4 + 0x40], eax
mov edx, dword [0x5a5c78]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x38]
push 0
push ecx
push 0x4536b0
inc edx
push 0
push 0
mov dword [0x5a5c78], edx
call ebx
mov edx, dword [0x5a5c78]
test eax, eax
mov dword [edx*4 + 0x5a4c74], eax
je 0x4538f9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x453904
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x5a5c74]
test al, al
jne 0x45388d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
pop ebp
pop ebx
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
add esp, 0x2030
ret 8
Function at 0x453940
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x80
mov byte [0x5a5c74], 0
push esi
push edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x5a4c6c]
test eax, eax
je 0x4539a3
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x5a4c6c]
lea ecx, [esp + 8]
push eax
push 0x40315c
push ecx
call esi
mov edx, dword [0x5a4c6c]
add esp, 0xc
mov eax, dword [edx*4 + 0x5a3c6c]
cmp eax, 0xffffffff
je 0x453996
push eax
call edi
mov eax, dword [0x5a4c6c]
dec eax
mov dword [0x5a4c6c], eax
jne 0x45396c
mov eax, dword [0x5a5c78]
test eax, eax
je 0x4539e2
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x5a5c78]
mov eax, dword [eax*4 + 0x5a4c74]
cmp eax, 0xffffffff
je 0x4539d5
push 0
push eax
call esi
push 0x5a4c74
call edi
mov eax, dword [0x5a5c78]
dec eax
mov dword [0x5a5c78], eax
jne 0x4539b8
pop edi
mov dword [0x5a5c78], 0
mov dword [0x5a4c6c], 0
mov byte [0x5a5c74], 1
pop esi
add esp, 0x80
ret

Function at 0x4585c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5810f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00560e45
mov eax, dword [0x412074]
lea edi, [esi + 0x3c]
mov dword [esp + 0x14], 0
mov dword [edi], eax
mov edx, dword [0x412074]
lea ecx, [esi + 0x40]
mov dword [ecx], edx
mov eax, dword [0x412074]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov byte [esp + 0x18], 3
mov dword [esi], 0x419440
mov dword [esi + 0x48], edx
call fcn.00564ef7
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x4c], edx
mov ecx, edi
mov dword [esi + 0x50], eax
call fcn.00564cf9
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edx
mov dword [esi + 0x58], 1
mov dword [esi + 0x64], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x459920
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
cmp dword [eax + 0x5c], 2
je 0x459a74
mov ecx, dword [esp + 0x14]
cmp ecx, 0x60
jb 0x45994c
cmp ecx, 0x69
ja 0x45994c
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x459a74
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x459a74
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x50]
mov ebp, eax
push ebp
call fcn.00457fa0
mov esi, eax
mov eax, dword [edi + 0x80]
add esp, 4
neg esi
sbb esi, esi
xor ebx, ebx
and esi, ebp
test eax, eax
jle 0x4599c2
push ebx
mov ecx, edi
call fcn.00459e90
mov ebp, eax
mov eax, dword [ebp + 0x88]
test eax, eax
jne 0x4599c0
mov ecx, dword [edi + 0x70]
test byte [ecx + 0x5c], 1
je 0x4599b3
test esi, esi
jne 0x4599b3
push ebp
call fcn.00457fa0
add esp, 4
test eax, eax
je 0x4599b3
mov esi, ebp
mov eax, dword [edi + 0x80]
inc ebx
cmp ebx, eax
jl 0x459983
jmp 0x4599c2
mov esi, ebp
test esi, esi
je 0x459a74
push esi
call fcn.00457fa0
add esp, 4
test eax, eax
je 0x459a74
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x174]
test eax, eax
je 0x4599fa
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push ebx
push esi
call fcn.004596c0
mov ebp, eax
test ebp, ebp
je 0x459a74
mov esi, dword [ebp + 0xbc]
mov ebx, dword [ebp + 0x3c]
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x459a28
mov ecx, edi
call fcn.004598f0
push 1
mov ecx, edi
call fcn.004594a0
mov dword [edi + 0x40], 1
mov edx, dword [esi]
push 1
push 0
push 1
mov ecx, esi
call dword [edx + 0xbc]
mov eax, dword [esi]
push 1
push ebx
mov ecx, esi
call dword [eax + 0xc4]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x459a68
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xb0]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4623f0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x462420
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov ax, word [esp]
pop ecx
ret

Function at 0x462d40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00564cf9
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, edi
push 6
shr eax, 4
inc eax
and eax, 0xffff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x462d7d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x462d91
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x462da6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x462dc5
cmp esi, eax
jae 0x462dc9
xor ecx, ecx
dec edi
mov cx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x462db5
cmp esi, eax
jb 0x462dd3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
xor ebx, ebx
mov bx, word [esi]
test ebx, ebx
jne 0x462de6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x462df6
mov ebp, dword [eax + 4]
jmp 0x462df8
xor ebp, ebp
push 0
push 0
push 0
lea edi, [esi + 2]
push 0
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
mov esi, eax
push esi
call fcn.00565215
push 0
push 0
push esi
push eax
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
push esi
call fcn.005651ed
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x465670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x581b27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
or ecx, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], al
mov byte [esi + 0x11], al
mov byte [esi + 0x12], al
mov byte [esi + 0x13], al
mov byte [esi + 0x14], al
mov byte [esi + 0x15], 1
mov byte [esi + 0x16], al
mov edx, dword [0x412074]
mov dword [esp + 4], esi
mov dword [esi + 0x18], edx
mov edx, dword [0x412074]
mov dword [esp + 0x10], eax
mov dword [esi + 0x1c], edx
mov edx, dword [0x412074]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], 0x41a174
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 0xa
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 3
call fcn.00453bb0
mov ecx, esi
mov byte [esp + 0x10], 4
mov dword [esi], 0x41a114
call fcn.00465820
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x468be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00467d00
mov ecx, eax
jmp fcn.00468c70
Function at 0x46af70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0x40454c
push eax
push esi
mov byte [esp + 0x10], 0x89
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], 0x4e
mov byte [esp + 0x13], 0x47
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x46afa2
pop esi
pop ecx
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x46afb1
pop esi
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax]
lea ecx, [esp + 4]
xor eax, eax
mov esi, dword [ecx]
cmp edx, esi
pop esi
sete al
pop ecx
ret

Function at 0x46afd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x46afe9
pop esi
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x46aff7
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x46b004
pop esi
ret
xor ecx, ecx
cmp word [eax + 0xe], 0x20
pop esi
sete cl
mov eax, ecx
ret
Function at 0x46b2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x581ed8
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x46b337
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x46b356
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x46b376
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ebx, dword [ebp + 8]
mov dword [esp + 0x34], 0
imul ebx, dword [ebp + 4]
shl ebx, 2
cmp word [ebp + 0xe], 0x20
jne 0x46b47b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebx + 0x28]
cmp eax, ecx
jb 0x46b47b
lea ecx, [esp + 0x14]
call fcn.00568332
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.005683e9
push 0x34
call fcn.0054e95e
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
jne 0x46b403
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00568467
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, 0xa
mov esi, ebp
mov edi, edx
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
neg eax
mov dword [edx + 0x14], ebx
mov esi, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x3c]
sbb eax, eax
push 0
push ecx
and eax, esi
push 0
push edx
push eax
mov dword [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
je 0x46b45d
mov edi, dword [esp + 0x38]
test edi, edi
je 0x46b45d
mov ecx, ebx
lea esi, [ebp + 0x28]
mov edx, ecx
mov dword [esp + 0x34], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
call fcn.0054e875
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00568467
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x46dc60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5820d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea ecx, [esp + 0x14]
call fcn.00568332
xor ebx, ebx
push ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x18]
call fcn.005683e9
lea eax, [esp + 0x10]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0046db10
add esp, 0x14
test eax, eax
jne 0x46dce9
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00568467
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
mov ecx, dword [esp + 8]
push ebp
neg eax
sbb eax, eax
push edi
and eax, edx
push ebx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ecx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov edi, dword [esp + 0x14]
mov ebp, eax
cmp edi, ebx
je 0x46dd37
cmp ebp, ebx
je 0x46dd37
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x46dd4c
push eax
call fcn.0054e875
add esp, 4
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x46dd61
push eax
call fcn.0054e875
add esp, 4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x46dd6f
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00568467
mov ecx, dword [esp + 0x2c]
mov eax, ebp
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4704f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
and edi, 0xffff
jne 0x470505
pop edi
xor eax, eax
pop esi
ret 0x10
call fcn.00578814
mov esi, dword [eax + 0xc]
push 0xf1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x470523
pop edi
pop esi
ret 0x10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x470534
pop edi
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x470546
pop edi
pop esi
ret 0x10
xor eax, eax
push ebx
mov ax, word [esi + 6]
push ebp
shl eax, 2
push eax
call fcn.00560d03
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
xor edi, edi
add esp, 4
mov dword [ebp], eax
mov dword [ebx], 0
cmp word [esi + 6], di
jbe 0x4705a6
mov ecx, esi
call fcn.004705d0
cmp word [eax + edi*2], 0
je 0x47059b
mov ecx, esi
call fcn.004705d0
mov edx, dword [ebx]
xor ecx, ecx
mov cx, word [eax + edi*2]
mov eax, dword [ebp]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx]
inc eax
mov dword [ebx], eax
xor ecx, ecx
inc edi
mov cx, word [esi + 6]
cmp edi, ecx
jl 0x470573
mov edx, dword [esp + 0x20]
xor eax, eax
mov ax, word [esi + 2]
xor ecx, ecx
mov cx, word [esi + 4]
pop ebp
pop ebx
mov dword [edx], eax
pop edi
mov dword [edx + 4], ecx
mov eax, 1
pop esi
ret 0x10