joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f780
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc], str.octet
mov eax, dword [esi + 0xc]
mov ebx, dword [eax]
mov al, byte [ebx + 0x2bf]
test al, al
je 0x46f7a7
mov dword [esp + 0xc], str.netascii
mov eax, dword [esp + 0x18]
cmp eax, 6
ja case.0x46f7b4.1
jmp dword [eax*4 + 0x46f964]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
cmp eax, ecx
jle 0x46f7df
mov dword [esi + 8], 9
mov dword [esi], 3
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov al, byte [ebx + 0x2cd]
test al, al
lea eax, [esi + 0x348]
je 0x46f82d
push 2
push eax
call fcn.0046f980
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0x34c]
add esp, 8
mov eax, dword [edx]
mov dword [eax + 0xdc], ecx
mov eax, dword [ebx + 0x1c8]
mov ecx, dword [ebx + 0x1cc]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x46f838
push ecx
push eax
push ebx
call fcn.0046a040
add esp, 0xc
jmp 0x46f838
push 1
push eax
call fcn.0046f980
add esp, 8
mov eax, dword [esi + 0xc]
push 0
push 0
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
inc edx
push edx
push ebx
call fcn.00474d10
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x46f85f
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
push edi
push 0
push eax
push 0
push ebp
push str._s_c_s_c
lea ecx, [esi + 0x34a]
push 0x200
push ecx
call fcn.0045cbb0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x10]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0xc]
not ecx
mov eax, dword [eax + 0x14]
dec ecx
lea ecx, [edx + ecx + 4]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push edx
push eax
push 0
push ecx
mov ecx, dword [esi + 0x10]
lea eax, [esi + 0x348]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
pop edi
jge 0x46f8e7
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edx, dword [esi + 0xc]
push eax
push edx
call fcn.00467bb0
push eax
push 0x4bbb68
push ebx
call fcn.0045cf40
add esp, 0x14
push ebp
call fcn.0045f8a0
add esp, 4
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Connected_for_transmit
push 0x4bbb68
push ebx
call fcn.0045ced0
push esi
mov dword [esi], 2
call fcn.0046f180
push 4
push esi
call fcn.0046fb90
add esp, 0x18
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.Connected_for_receive
push 0x4bbb68
push ebx
call fcn.0045ced0
push esi
mov dword [esi], 1
call fcn.0046f180
push 3
push esi
call fcn.0046f9a0
add esp, 0x18
pop esi
pop ebp
pop ebx
pop ecx
ret
push str.tftp_send_first:_internal_error_n
push ebx
call fcn.0045cf40
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x46f9a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0xc]
mov ebx, dword [eax]
mov eax, dword [esp + 0x14]
sub eax, 3
je 0x46fa5c
sub eax, 2
je 0x46fa02
dec eax
je 0x46f9d9
push str.tftp_rx:_internal_error
push 0x4bbb68
push ebx
call fcn.0045cf40
add esp, 0xc
jmp 0x46fb3c
mov edx, dword [esi + 0x14]
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.0045ced0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
add esp, 0xc
cmp ecx, eax
jle 0x46fa0d
mov dword [esi + 8], 8
mov dword [esi], 3
jmp 0x46fb3c
mov edx, dword [esi + 0x138]
lea eax, [esi + 0xb8]
push edx
mov edx, dword [esi + 0x10]
push eax
push 0
lea ecx, [esi + 0x348]
push 4
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
jge 0x46fb3c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov eax, dword [esi + 0xc]
push eax
call fcn.00467bb0
push eax
push 0x4bbb68
push ebx
call fcn.0045cf40
add esp, 0x14
jmp 0x46fb3c
lea ecx, [esi + 0x144]
push ecx
call fcn.0046f6e0
xor edx, edx
mov di, ax
mov dx, word [esi + 0x28]
add esp, 4
and edi, 0xffff
inc edx
cmp edx, edi
je 0x46fabd
push edi
push str.Received_unexpected_DATA_packet_block__d_n
push ebx
call fcn.0045ced0
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
add esp, 0xc
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
cmp eax, ecx
jle 0x46fabd
xor eax, eax
mov ax, word [esi + 0x28]
inc eax
push eax
push str.tftp_rx:_giving_up_waiting_for_block__d_n
push ebx
call fcn.0045cf40
add esp, 0xc
mov eax, 0x47
pop edi
pop esi
pop ebx
ret
mov word [esi + 0x28], di
lea edi, [esi + 0x348]
push 4
push edi
mov dword [esi + 0x14], 0
call fcn.0046f980
mov cx, word [esi + 0x28]
push ecx
push edi
call fcn.0046fb70
mov edx, dword [esi + 0x138]
mov ecx, dword [esi + 0x10]
add esp, 0x10
lea eax, [esi + 0xb8]
push edx
push eax
push 0
push 4
push edi
push ecx
call dword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
jge 0x46fb24
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edx, dword [esi + 0xc]
push eax
push edx
call fcn.00467bb0
push eax
push 0x4bbb68
push ebx
call fcn.0045cf40
add esp, 0x14
mov ecx, dword [esi + 0x13c]
xor eax, eax
cmp ecx, 0x204
setge al
dec eax
and eax, 2
inc eax
mov dword [esi], eax
xor eax, eax
push 0
mov ax, word [esi + 0x28]
push 0x200
cdq
push edx
push eax
call fcn.0042ba60
push edx
push eax
push ebx
call fcn.00469fc0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x46fb90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ebp, dword [eax]
mov eax, dword [esp + 0x18]
sub eax, 4
je 0x46fc35
dec eax
je 0x46fbf3
dec eax
je 0x46fbca
push str.tftp_tx:_internal_error
push 0x4bbb68
push ebp
call fcn.0045cf40
add esp, 0xc
jmp 0x46fd9b
mov edx, dword [esi + 0x14]
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebp
call fcn.0045ced0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x1c]
add esp, 0xc
cmp ecx, eax
jle 0x46fbfe
mov dword [esi + 8], 8
mov dword [esi], 3
jmp 0x46fd9b
mov edx, dword [esi + 0x138]
mov ecx, dword [esi + 0x140]
lea eax, [esi + 0xb8]
push edx
push eax
mov eax, dword [esi + 0x10]
add ecx, 4
push edi
lea edx, [esi + 0x348]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
jge 0x46fd9b
jmp 0x46fd7c
lea edx, [esi + 0x144]
push edx
call fcn.0046f6e0
mov dx, word [esi + 0x28]
and eax, 0xffff
mov ecx, edx
add esp, 4
and ecx, 0xffff
cmp eax, ecx
je 0x46fcf7
push ecx
push eax
push str.Received_ACK_for_block__d__expecting__d_n
push ebp
call fcn.0045ced0
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
add esp, 0x10
inc edx
mov eax, edx
mov dword [esi + 0x14], edx
cmp eax, ecx
jle 0x46fc9e
xor eax, eax
mov ax, word [esi + 0x28]
push eax
push str.tftp_tx:_giving_up_waiting_for_block__d_ack
push ebp
call fcn.0045cf40
add esp, 0xc
mov edi, 0x37
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x138]
mov eax, dword [esi + 0x140]
lea edx, [esi + 0xb8]
push ecx
push edx
mov edx, dword [esi + 0x10]
add eax, 4
push edi
lea ecx, [esi + 0x348]
push eax
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
jge 0x46fcf0
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov eax, dword [esi + 0xc]
push eax
call fcn.00467bb0
push eax
push 0x4bbb68
push ebp
call fcn.0045cf40
add esp, 0x14
mov edi, 0x37
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x14], edi
lea edi, [esi + 0x348]
inc edx
push 3
push edi
mov word [esi + 0x28], dx
call fcn.0046f980
mov cx, word [esi + 0x28]
push ecx
push edi
call fcn.0046fb70
add esp, 0x10
cmp word [esi + 0x28], 1
jbe 0x46fd3b
cmp dword [esi + 0x140], 0x200
jge 0x46fd3b
mov dword [esi], 3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0xc]
lea ebx, [esi + 0x140]
push ebx
push 0x200
push edx
call fcn.00463820
add esp, 0xc
test eax, eax
jne 0x46fdbd
mov eax, dword [esi + 0x138]
mov edx, dword [ebx]
lea ecx, [esi + 0xb8]
push eax
mov eax, dword [esi + 0x10]
push ecx
add edx, 4
push 0
push edx
push edi
push eax
call dword [sym.imp.WSOCK32.dll_sendto]
test eax, eax
jge 0x46fd9b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.00467bb0
push eax
push 0x4bbb68
push ebp
call fcn.0045cf40
add esp, 0x14
xor eax, eax
push 0
mov ax, word [esi + 0x28]
push 0x200
cdq
push edx
push eax
call fcn.0042ba60
push edx
push eax
push ebp
call fcn.00469fe0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x471330
Capabilities:
Send data
Send data on socket

Disassembly:
mov al, byte [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
lea ecx, [esp + 0x14]
mov edx, dword [esi + 0x7c]
mov edi, dword [esi]
push 3
push ecx
push edx
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], al
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jge 0x47137a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0045cf40
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
push eax
push ebx
push str.SENT
push ecx
call fcn.004713a0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4761c0
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
xor eax, eax
mov esi, dword [ebx]
push edi
push 0x4bf310
mov edi, 6
mov al, byte [esi + 0x2ee]
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_getprotobyname]
test eax, eax
je 0x4761ed
movsx edi, word [eax + 8]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push 4
push ecx
push 1
push edi
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jge 0x476226
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push ebx
call fcn.00467bb0
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0045ced0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0045ced0
add esp, 8
pop edi
pop esi
pop ebx
ret

Function at 0x478320
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a8
push esi
lea eax, [esp + 0x1c]
push edi
push eax
push 0x202
mov dword [esp + 0x10], 0
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov edi, dword [esp + 0x1b4]
mov dword [esp + 0xc], 0x10
push edi
mov word [esp + 0x14], 2
call dword [sym.imp.WSOCK32.dll_htons]
push 0
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_htonl]
push 6
push 1
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4783d3
push esi
call fcn.0047a410
add esp, 4
test eax, eax
jne 0x4783cc
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jne 0x4783cc
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
jl 0x4783cc
push 0x80
push esi
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x478402
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
call fcn.0042e2c2
mov ecx, dword [eax]
push ecx
call fcn.0047f095
add esp, 4
push eax
push edi
push str.open_listening_port__d_:__s
push 0
push 2
call fcn.00479e70
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x1a8
ret
mov eax, esi
pop edi
pop esi
add esp, 0x1a8
ret

Function at 0x478410
Capabilities:
Get socket status

Disassembly:
mov eax, 0x1020
call fcn.0042b9c0
mov ecx, dword [esp + 0x1028]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
push esi
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
mov esi, dword [esp + 0x1028]
push edi
lea eax, [esp + 0x24]
or edi, 0xffffffff
lea ecx, [esi + 1]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 1
mov dword [esp + 0xc], edx
lea edx, [esp + 8]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 1
jne 0x47849b
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.WSOCK32.dll_accept]
pop edi
pop esi
add esp, 0x1020
ret
mov eax, edi
pop edi
pop esi
add esp, 0x1020
ret
Function at 0x47e130
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0042b9c0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x47e1fb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x47e1fb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x47e1ae
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x47e1b9
or bh, 8
and edi, 0x8000000
je 0x47e1d4
mov eax, dword [0x4cd39c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x47e1fb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x47e5fb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x47e61f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x47e63a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x482d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x482d92
cmp dword [edi + 0x3c], 0
jne 0x482d92
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00489baa
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00482dbf
pop edi
pop esi
pop ebx
ret 8

Function at 0x4843c7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4843ff
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00486cdb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00486cb3
jmp 0x48440b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x485990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4859d2
call fcn.00489baa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4859d2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4859c9
xor eax, eax
jmp 0x4859da
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004859e0
pop edi
pop esi
pop ebx
ret 4

Function at 0x48a6c1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48a6ef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48a70d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048a627
jmp 0x48a70d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48a70d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048a627
test edi, edi
mov eax, edi
jne 0x48a6f7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x35e323de
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x4588449c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403760
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4a02f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00401b70
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4037b4
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.004035d0
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00401b70
cmp dword [esp + 0x24], 8
jb 0x4037fa
mov eax, dword [esp + 0x10]
push eax
call fcn.0045a870
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4082a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49ce00
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], ebx
call fcn.0043ce30
mov edi, 8
mov byte [esp + 0x54], 1
cmp dword [eax + 0x18], edi
jb 0x408305
mov eax, dword [eax + 4]
jmp 0x408308
add eax, 4
lea ecx, [esp + 0x2c]
push ecx
mov edx, 0x4a9e18
mov ecx, eax
call fcn.00433100
add esp, 4
mov byte [esp + 0x54], bl
cmp dword [esp + 0x28], edi
jb 0x408333
mov edx, dword [esp + 0x14]
push edx
call fcn.0045a870
add esp, 4
cmp dword [esp + 0x44], edi
mov esi, dword [esp + 0x30]
jae 0x408341
lea esi, [esp + 0x30]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40836b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
cmp al, bl
je 0x40836b
lea eax, [esp + 0x2c]
push 1
push eax
call fcn.00433390
add esp, 8
cmp dword [esp + 0x44], edi
jb 0x40837e
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0045a870
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00478599
add esp, 0x48
ret