joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ca70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4e10e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.004d9690
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0045c3d0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004d95be
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004d5e82
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004d5e82
push 1
push 0
push 0
mov ecx, esi
call fcn.004d5e2a
push 1
push 0
push 1
mov ecx, esi
call fcn.004d5e2a
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004d9702
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x45cbf0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4e1108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004d9690
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0045c3d0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.004d95be
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x45ccb4
cmp dword [esp + 0x40], 1
jne 0x45ccb2
cmp ecx, eax
jge 0x45ccb4
mov eax, ecx
cmp eax, 0xc8
jge 0x45ccc0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0045ca70
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004d9702
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x45d4b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4e11b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004d42a2
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004d9938
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004dae54
test eax, eax
je 0x45d5cc
mov ecx, dword [esp + 0x3c]
call fcn.004d9965
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45d590
push edi
mov ecx, esi
call fcn.004d6fd2
mov ecx, esi
call fcn.0045d770
cmp dword [esp + 0x38], 1
jne 0x45d5c5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004d710d
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x45f7c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45f7f3
push esi
call fcn.0046da30
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45f7ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45f879
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45f862
mov eax, dword [esi + 8]
test eax, eax
je 0x45f817
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45f85e
cmp eax, 2
je 0x45f862
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45f80a
cmp eax, 3
je 0x45f83d
cmp eax, 1
jne 0x45f80a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45f80a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45f80a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045f8a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45f888
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045f8a0
add esp, 4
pop esi
ret

Function at 0x460110
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x460131
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x460131
mov eax, dword [eax + 0x44]
test eax, eax
je 0x460131
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x47aac0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x47ab63
test eax, eax
jbe 0x47ab63
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x47ab63
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x47ab0e
xor esi, esi
jmp 0x47ab14
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x47ab3f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0047e4d0
add esi, eax
push esi
mov ebx, esi
call fcn.0047e4d0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x47ab20
pop ebp
test edi, edi
pop edi
jne 0x47ab63
test ebx, ebx
je 0x47ab63
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004bf350
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x47ac85
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47ad9d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47ad9d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004d46f4
mov esi, eax
test esi, esi
je 0x47ad9d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47ad9d
mov ecx, esi
call fcn.0047ac10
cmp edi, eax
jge 0x47ad9d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x47ad23
mov dword [esp + 0x34], 1
jmp 0x47ad7e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47ad9d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0047a1c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x489e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x489f41
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x489f25
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x489e77
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x489e55
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x48a989
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x48a9e0
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x48a9e0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x48a9e0
xor eax, eax
inc eax
jmp 0x48a9e2
xor eax, eax
leave
ret 0x10
Function at 0x48aa0b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x48aa79
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x513134
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48aa70
cmp dword [ebp - 0xc], 4
jne 0x48aa70
cmp dword [ebp - 0x10], edi
je 0x48aa70
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x602f18], edi
xor eax, eax
jmp 0x48aab8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x602f18], edi
jge 0x48aab3
lea eax, [ebp - 0x34]
push eax
mov dword [0x602f18], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x48aab3
cmp word [ebp - 0x14], 5
jb 0x48aab3
call fcn.0048a9e6
test eax, eax
je 0x48aab3
emms
mov dword [0x602f18], 1
mov eax, dword [0x602f18]
pop edi
leave
ret

Function at 0x49d2c0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x49d2d0
mov esi, 1
push esi
call fcn.004bf537
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x49d322
call fcn.004c003d
mov edi, eax
call fcn.0049fe10
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x49d306
mov edx, dword [0x60dbe8]
mov dword [0x60dbe4], edx
test al, 0x18
je 0x49d317
push esi
push 0x24
push 5
call fcn.004a0660
add esp, 0xc
test edi, edi
je 0x49d33d
push 1
call fcn.004c1a48
test byte [esp + 0x14], 0x20
je 0x49d33d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x49e440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x49e534
cmp byte [edx], 0
je 0x49e527
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.0049e3c0
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.0049e3c0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0049e330
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x49e4f1
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0049e370
fmul qword [0x51bd00]
push ecx
fstp qword [esp]
call fcn.004bde98
fadd qword [0x51bcf8]
add esp, 8
call fcn.004bdf68
mov byte [ebx], al
inc ebx
dec edi
jne 0x49e4c4
lea ecx, [esp + 0x20]
push ecx
call fcn.0049e370
fmul qword [0x51bd00]
push ecx
fstp qword [esp]
call fcn.004bde98
add esp, 8
call fcn.004bdf68
cmp esi, ebx
je 0x49e51d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x49e516
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x49e930
mov byte [edi + esi], 2
jmp 0x49e967
test al, 4
je 0x49e93a
mov byte [edi + esi], 0xd
jmp 0x49e967
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x49e953
mov byte [edi + esi], 2
jmp 0x49e967
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x49e963
mov byte [edi + esi], 0x19
jmp 0x49e967
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x49e917
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x49e9db
cmp dl, 0xd
je 0x49e9db
xor edx, edx
jmp 0x49e9e0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x49e9cb
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x49ea00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.0049d2c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x49ea21
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.004a0050
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x49ea46
push esi
call fcn.0049d350
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.004ca27c
push ebx
push edi
mov ebp, eax
call fcn.004a00c0
push 0x49ea80
push ebp
push esi
call fcn.004a13f0
push esi
call fcn.0049d350
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x49fd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x6f0840
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6f0768]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x49fdfb
push 0x4c
push 1
call fcn.004c0465
mov esi, eax
add esp, 8
test esi, esi
jne 0x49fdc3
push 0x6f0840
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x6f0768]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x6e5bec]
inc eax
lea edx, [esi + 0xc]
mov dword [0x6e5bec], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.004a38c0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x6f0840
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x4a0280
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004c003d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.004ca27c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4a037a
call fcn.004c003d
cmp dword [eax], 0
je 0x4a02c7
call fcn.004c003d
mov ebp, dword [eax]
jmp 0x4a02ca
or ebp, 0xffffffff
call fcn.0049fe10
test esi, esi
mov dword [eax], ebp
jne 0x4a02df
call fcn.004c003d
cmp dword [eax], 4
je 0x4a032f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x4a0312
cmp esi, 0xffffffff
je 0x4a0354
test al, 6
je 0x4a0312
call fcn.0049fe10
mov ecx, dword [eax]
push ecx
push ebx
call fcn.004a38f0
add esp, 4
push eax
push 0x24
push 9
call fcn.004a0660
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x4a0372
test al, 6
je 0x4a0320
test ah, 2
je 0x4a0372
test esi, esi
jbe 0x4a037e
test ah, 2
je 0x4a037e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.004c003d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.004ca27c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4a037a
jmp 0x4a02b4
call fcn.0049fe10
mov eax, dword [eax]
push eax
push ebx
call fcn.004a38f0
add esp, 4
push eax
push 0x24
push 2
call fcn.004a0660
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x4a038b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x4a0394
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4c2a54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c2a74
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004bffca
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4c2a97
test byte [esp + 8], 2
je 0x4c2a97
call fcn.004c003d
mov dword [eax], 0xd
call fcn.004c0046
mov dword [eax], 5
jmp 0x4c2a70
xor eax, eax
ret
Function at 0x4d5098
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d50d0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d3122
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d30fa
jmp 0x4d50dc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d678a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d67cc
call fcn.004dc244
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d67cc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d67c3
xor eax, eax
jmp 0x4d67d4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d67da
pop edi
pop esi
pop ebx
ret 4

Function at 0x4dc774
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4dc7a2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4dc7c0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004dc6da
jmp 0x4dc7c0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4dc7c0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004dc6da
test edi, edi
mov eax, edi
jne 0x4dc7aa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x408f6c
nop
mov ecx, 0x73f229b1
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
mov ecx, 0x7dc372b6
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219