joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bdd0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49cad1
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x46be0d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.00494b39
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.00493e81
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.00464d90
lea ecx, [esp + 8]
call fcn.00494da8
lea ecx, [esp + 0x30]
call fcn.00493fe5
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.00493e81
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.00465230
lea ecx, [esp + 0x74]
call fcn.00493fe5
lea ecx, [esp + 8]
call fcn.00494da9
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.004629a0
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.00464ca0
mov ecx, esi
call fcn.00465870
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.00464ca0
mov ecx, esi
call fcn.00465870
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.00464ca0
mov ecx, esi
call fcn.00465870
mov ecx, dword [edi + 0x5c]
call fcn.00462180
push eax
mov ecx, esi
call fcn.00462190
mov ecx, dword [edi + 0x5c]
call fcn.00462740
push eax
mov ecx, esi
call fcn.004626e0
mov ecx, dword [edi + 0x5c]
call fcn.00462860
push eax
mov ecx, esi
call fcn.00462810
mov ecx, dword [edi + 0x5c]
push 0
call fcn.00461a60
push eax
mov ecx, esi
call fcn.00461a70
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.00493f5d
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.00493f5d
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.00494bc2
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x46d5d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49ccf7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.0048aebb
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0048aebb
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0046e0f0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x46e140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49cdd0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00496c74
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x46e173
xor al, al
jmp 0x46e29f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x46e195
xor al, al
jmp 0x46e29f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x46e1a8
xor al, al
jmp 0x46e29f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x46e1bc
xor al, al
jmp 0x46e29f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.0048af6b
test eax, eax
jne 0x46e1f0
xor al, al
jmp 0x46e29f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x4aca0c
mov dword [esp + 0x20], ebp
call fcn.00496c74
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.00493b36
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.00493b8d
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x46e284
mov ax, word [ebx]
test ax, ax
je 0x46e276
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.0046e2c0
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x46e25a
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.00493b8d
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x46e800
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004951e6
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x46e846
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.0047bf08
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x4c7d9c
push ecx
call fcn.0047d5e1
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x471770
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x471813
test eax, eax
jbe 0x471813
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x471813
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4717be
xor esi, esi
jmp 0x4717c4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4717ef
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040e010
add esi, eax
push esi
mov ebx, esi
call fcn.0040e010
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4717d0
pop ebp
test edi, edi
pop edi
jne 0x471813
test ebx, ebx
je 0x471813
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0047c970
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x471955
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x471a6d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x471a6d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048e711
mov esi, eax
test esi, esi
je 0x471a6d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x471a6d
mov ecx, esi
call fcn.004718c0
cmp edi, eax
jge 0x471a6d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4719f3
mov dword [esp + 0x34], 1
jmp 0x471a4e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x471a6d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00470eb0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4764c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
cmp di, 0x76d
jb 0x476615
cmp di, 0x801
ja 0x476615
mov ebx, dword [esp + 0x28]
cmp bx, 1
jb 0x476615
cmp bx, 0xc
ja 0x476615
mov al, byte [esp + 0x30]
test al, al
je 0x476514
push edi
call fcn.00476a50
add esp, 4
cmp ax, bx
je 0x476514
mov byte [esp + 0x30], 0
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x13]
lea ecx, [esp + 0x14]
mov word [esi], di
mov edi, dword [esp + 0x38]
push eax
lea edx, [esp + 0x1c]
mov word [edi], bx
mov ebx, dword [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
mov word [ebp], bx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ebx
push ecx
push edx
call fcn.00476620
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push ebx
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
call fcn.00476440
add esp, 0x34
mov ebx, eax
xor eax, eax
inc eax
cmp eax, 0x64
mov dword [esp + 0x34], eax
jg 0x476615
test ebx, ebx
jne 0x4765a9
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x30]
cmp al, cl
je 0x47660b
test al, al
je 0x47659c
push 0xffffffffffffffe1
jmp 0x47659e
push 0x1f
push ebp
push edi
push esi
call fcn.004763f0
add esp, 0x10
neg ebx
push ebx
push ebp
push edi
push esi
call fcn.004763f0
lea edx, [esp + 0x23]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov ax, word [ebp]
lea edx, [esp + 0x34]
push ecx
mov cx, word [edi]
push edx
mov dx, word [esi]
push eax
push ecx
push edx
call fcn.00476620
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.00476440
mov ebx, eax
mov eax, dword [esp + 0x78]
add esp, 0x44
jmp 0x476576
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x477cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49d6f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push 0x4fda58
lea ecx, [esp + 4]
call fcn.0048cc8e
push 0x4ce9b8
lea ecx, [esp + 8]
mov dword [esp + 0x40], 0
call fcn.0048cc8e
push 0x4ce9b4
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call fcn.0048cc8e
push 0x4ce9b0
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.0048cc8e
push 0x4ce9ac
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call fcn.0048cc8e
push 0x4ce9a8
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 4
call fcn.0048cc8e
push 0x4ce9a4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 5
call fcn.0048cc8e
push 0x4ce9a0
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 6
call fcn.0048cc8e
push 0x4ce99c
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 7
call fcn.0048cc8e
push 0x4ce998
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 8
call fcn.0048cc8e
push 0x4ce994
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 9
call fcn.0048cc8e
push 0x4ce990
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 0xa
call fcn.0048cc8e
push 0x4ce98c
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 0xb
call fcn.0048cc8e
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3c], 0xc
cmp eax, 1
jge 0x477df0
cmp eax, 0xc
jle 0x477df0
mov ecx, dword [esp + 0x48]
push 0x4fda58
call fcn.0048cd5d
jmp 0x477dfe
mov ecx, dword [esp + 0x48]
lea eax, [esp + eax*4]
push eax
call fcn.0048cd0d
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.0048cc20
lea ecx, [esp + 0x2c]
mov byte [esp + 0x3c], 0xa
call fcn.0048cc20
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 9
call fcn.0048cc20
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 8
call fcn.0048cc20
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 7
call fcn.0048cc20
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 6
call fcn.0048cc20
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 5
call fcn.0048cc20
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.0048cc20
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 3
call fcn.0048cc20
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call fcn.0048cc20
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call fcn.0048cc20
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call fcn.0048cc20
lea ecx, [esp]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0048cc20
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x478570
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x49d903
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], method.CWnd.virtual_0
lea ecx, [esi + 0x5dc]
mov dword [esp + 0x18], 3
call fcn.0048cc20
lea edi, [esi + 0xbc]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x4dc]
mov byte [esp + 0x18], 8
call fcn.00495707
lea ecx, [edi + 0x4a0]
mov byte [esp + 0x18], 7
call fcn.00495707
lea ecx, [edi + 0x488]
mov byte [esp + 0x18], 6
call fcn.0048cc20
lea ecx, [edi + 0x484]
mov byte [esp + 0x18], 5
call fcn.0048cc20
lea ecx, [edi + 0x5c]
mov byte [esp + 0x18], 4
call fcn.00475420
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.0048d9c4
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 1
call fcn.0049553b
lea edi, [esi + 0x48]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 0xd
call fcn.0048cc20
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 0xc
call fcn.0048cc20
lea ecx, [edi + 0x24]
mov byte [esp + 0x18], 0xb
call fcn.0048cc20
lea ecx, [edi + 0x20]
mov byte [esp + 0x18], 0xa
call fcn.0048cc20
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 9
call fcn.0048cc20
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 0
call fcn.0048cc20
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0048edbf
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x48da02
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x48da24
cmp dword [edi + 0x3c], 0
jne 0x48da24
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00496c74
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0048da51
pop edi
pop esi
pop ebx
ret 8

Function at 0x48f0fc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48f134
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048d07b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048d053
jmp 0x48f140
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4908f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x490935
call fcn.00496c74
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x490935
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49092c
xor eax, eax
jmp 0x49093d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00490943
pop edi
pop esi
pop ebx
ret 4

Function at 0x4971a4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4971d2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4971f0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049710a
jmp 0x4971f0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4971f0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049710a
test edi, edi
mov eax, edi
jne 0x4971da
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x66612f
Capabilities:
Execute syscall

Disassembly:
push ebx
pushfd
mov byte [esp], dl
lea esp, [esp + 0x40]
je 0x675d69
bt cx, si
call fcn.00675d5d
aaa
add byte [edi], dh
and al, 0xab
test al, 0xd5
movsd dword es:[edi], dword [esi]
jmp 0x666167
jge 0x666146
xchg ebp, eax
and ebp, dword [ecx + 0x37511771]
add byte [edi - 8], ah
lahf
push ebx
mov ecx, 0x453fff38
inc ebp
mov dword [edi - 0x1c], ebp
stosd dword es:[edi], eax
pop eax
fbstp tbyte [edx]
clc
adc byte [esi - 0x4b], ch
mov edx, 0xc9df7603
sar dword es:[eax + 0x4211e49d], 1
sbb al, dl
jns 0x6661fc
and edi, esp
shl byte [edi], 0xb
scasb al, byte es:[edi]
adc eax, 0x34902d1a
mov edx, 0x61e3b843
add eax, 0x7c64dd56
xchg edx, eax
sbb byte [edi - 0x4195b5de], dh
shl dword [ecx], 0x7b
wait
loop 0x6661b4
push ds
jno 0x6661bd
wait
into
or ecx, edx
inc edx
test eax, 0x72ec978f
mov eax, dword [0xd3a31481]
stosb byte es:[edi], al
xor byte [ebx - 0xd8903bf], bh
in al, dx
jb 0x666155
adc dword [ebx], 0xbb30aad3
inc ecx
cld
jbe 0x6661b1
push edi
push ds
dec eax
in eax, dx
aam 0x2d
adc al, 0xcf
invalid
pop ebx
dec eax
dec esi
jne 0x666198
mov byte [ebp - 0x55407319], bl
lodsb al, byte [esi]
dec edx
mov bh, 0xbb
mov al, 0xb6
mov ch, 0x87
mov dh, 0x79
dec edx
sysenter
pop es
pop ebp
mov esi, 0xbcbd8b50
sar byte [ebx - 0x469445a7], 1
invalid

Function at 0x6712cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0x53
pushfd
mov byte [esp + 8], 0x27
lea esp, [esp + 0xc]
je 0x675d69
push edx
pushfd
btr edx, 0xd
mov esi, dword [eax + 0x3c]
or dl, 0x2b
shld dx, bx, 1
mov dx, word [esp]
add esi, eax
rol dh, cl
btc dx, sp
mov edx, dword [esi + 0x78]
push 0x63a44014
test edx, edx
pushal
call fcn.00671597

Function at 0x671597
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x30]
je 0x675d69
sal cl, 1
add ch, dh
movsx cx, cl
mov ch, 0xfc
add edx, eax
rcl ch, 6
bswap cx
shr ch, 3
cmp ah, ah
mov ecx, dword [esi + 0x7c]
clc
push esp
add ecx, edx
mov byte [esp], 0xef
mov byte [esp], 0xe9
mov dword [ebp - 0x10], ecx
bsr cx, dx
mov byte [esp], al
sub cl, 0x68
test ah, cl
mov ecx, dword [ebp + 0xc]
push dword [esp]
cmp ecx, 0xffff
pushal
jmp 0x6693c3

Function at 0x672ab5
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jae 0x675d6d
sar bx, cl
rcl edi, cl
mov ebx, eax
sar di, 3
btr cx, bx
mov edi, eax
lea ecx, [ebx - 0x57d9ed7b]
shl ecx, cl
rcr cx, 0xf
mov ecx, 0x104
jmp 0x66c9da
jmp 0x54bf6d
pop ebp
out 0xf6, eax
cmp al, 0xf8
clc
bt ecx, esi
clc
xor al, al
clc
pushfd
pushfd
repne scasb al, byte es:[edi]
call fcn.00549513
mov ebp, ebx
xor dword [eax + 0x7e], edi
push ecx
mov eax, 0xc016509c
loop 0x66c9d6
mov cl, 0xb
shr ch, 5
sub dword [edi + 0x67c4ccd1], ecx
into
shl dword [ebx + 6], cl
insd dword es:[edi], dx
test ebx, ebp
adc edi, dword [ecx + 0x58]
hlt
lea esp, [esp + 8]
jb 0x675d6d
push edi
test bh, ch
mov byte [esp], ch
cmp eax, dword [ebp - 0x10]
mov byte [esp], 0x76
jmp 0x54e478
Function at 0x438c99
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
push 0x5a08c030
pop edi
inc ebx
and edi, edi
call fcn.00438cd1
mov ebx, edi
dec edi
xor dword [edx], eax
add ebx, 0x6a32f8f2
sub ebx, 0x689ace2b
inc edi
inc edx
sub ebx, edi
sub ebx, edi
cmp edx, esi
jne fcn.00438c99
and edi, edi
ret
Function at 0x414480
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aed4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a291e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414502
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049f944
mov eax, dword [eax]
push 0x4d4220
push eax
call fcn.00491084
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a2ba9
test bl, bl
je 0x414502
push 0x4d4220
lea ecx, [esp + 0xc]
call fcn.004a2f39
push 0x4d7d9c
lea ecx, [esp + 0xc]
call fcn.004a2f39
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41453e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a2ba9
jmp 0x414609
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4145c2
lea edx, [esp + 0x7c]
push 0x4d7d98
push edx
call fcn.00491084
add esp, 8
test eax, eax
je 0x4145c2
lea eax, [esp + 0x7c]
push 0x4d7d94
push eax
call fcn.00491084
add esp, 8
test eax, eax
je 0x4145c2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414552
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a2ba9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4