joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4314a2
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cd4ae
call fcn.0049d040
sub esp, 0x2a0
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0041913d
pop ecx
mov eax, dword [eax]
push 1
xor edi, edi
push 1
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.00415b6b
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004b994a
lea ecx, [ebp - 0xe4]
call fcn.00428a23
push dword [ebp + 0x2c]
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 3
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.004310b6
mov esi, eax
cmp esi, edi
je 0x43153c
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.004b994a
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4d64d0
call fcn.0042884d
jmp 0x431665
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x431572
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.004b994a
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4d64d0
call fcn.0042884d
or esi, 0xffffffff
jmp 0x431665
push edi
lea ecx, [ebp - 0x2ac]
call fcn.00462180
push 3
lea ecx, [ebp - 0x2ac]
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.00462e70
test al, al
jne 0x4315c6
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x4d5ce0
call fcn.00462250
lea ecx, [ebp - 0x2ac]
call fcn.004621a0
mov byte [ebp - 4], 7
or esi, 0xffffffff
jmp 0x431648
cmp dword [ebp + 0x24], edi
jle 0x43160e
cmp dword [ebp + 0x20], edi
jle 0x43160e
lea ecx, [ebp - 0x2ac]
call fcn.004612c0
lea ecx, [ebp - 0x2ac]
mov esi, eax
call fcn.004612b0
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.004321d2
push dword [ebp + 0x1c]
lea eax, [ebp - 0x2ac]
push dword [ebp + 0x18]
push eax
call fcn.004176b0
add esp, 0x20
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2ac]
push edi
push eax
call fcn.004627a0
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x4d5ce0
call fcn.00462250
lea ecx, [ebp - 0x2ac]
call fcn.004621a0
mov byte [ebp - 4], 8
xor esi, esi
lea ecx, [ebp - 0x74]
call fcn.004b994a
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x4d644c
call fcn.004287da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00415bd8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4326b6
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4cd610
call fcn.0049d040
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4326f4
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00415efd
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b994a
lea eax, [ebp - 0x14]
push eax
call fcn.0041913d
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00415b6b
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b994a
push dword [ebp + 8]
lea edi, [esi + 0x70]
mov ecx, edi
call fcn.004b9ae1
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x68]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.00432497
test eax, eax
je 0x43274b
mov esi, eax
jmp 0x432780
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
je 0x432765
or esi, 0xffffffff
jmp 0x432780
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x2c]
or esi, 0xffffffff
cmp eax, esi
je 0x432780
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00415bd8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x451bed
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4cfa2a
call fcn.0049d040
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00451c9a
mov eax, dword [0x56c338]
lea ecx, [esi + 0x14]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x56c338]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0x4d838c
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x56c338]
mov dword [esi + 0x3c], eax
mov eax, dword [0x56c338]
mov dword [esi + 0x40], eax
mov eax, dword [0x56c338]
mov dword [esi + 0x44], eax
mov edi, 0x570b34
mov byte [ebp - 4], 6
push edi
mov dword [esi], 0x4d8380
call fcn.004b9ae1
push edi
lea ecx, [esi + 0x18]
call fcn.004b9ae1
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.004b9ae1
push edi
lea ecx, [esi + 0x40]
call fcn.004b9ae1
push edi
lea ecx, [esi + 0x44]
call fcn.004b9ae1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x459088
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d0067
call fcn.0049d040
sub esp, 0xe4
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x4591e6
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4591e6
lea ecx, [ebp - 0xf0]
call fcn.0041fddc
push ebx
push 0x74
push dword [ebp + 8]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
push eax
call fcn.0041ff45
mov ecx, eax
call fcn.0041f8a5
test al, al
jne 0x4590ed
or esi, 0xffffffff
jmp 0x4591b8
lea eax, [ebp - 0x10]
push str.MediaFormats
push eax
lea ecx, [ebp - 0xf0]
call fcn.0041fa0d
lea ecx, [ebp - 0x10]
call fcn.0041f8a5
test al, al
jne 0x4590e5
push 0x570b34
lea eax, [ebp - 0x1c]
push 0x4f4f8c
push eax
lea ecx, [ebp - 0x10]
call fcn.0041fa54
mov ecx, eax
call fcn.0041f8ad
push eax
lea ecx, [ebp - 0x14]
call fcn.004b99be
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [ebp - 0x14]
call fcn.0049d9d5
pop ecx
test eax, eax
pop ecx
je 0x459150
push 1
pop esi
jmp 0x4591ac
lea eax, [ebp - 0x18]
push str.Categories
push eax
lea ecx, [ebp - 0x10]
call fcn.0041fa0d
lea ecx, [ebp - 0x18]
call fcn.0041f8a5
test al, al
je 0x459172
or esi, 0xffffffff
jmp 0x4591ac
cmp dword [esi + 0x10], ebx
jle 0x4591aa
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ebp + 8]
push dword [edi + 8]
push eax
call fcn.0041fa0d
lea ecx, [ebp + 8]
call fcn.0041f8a5
test al, al
jne 0x4591cb
lea eax, [ebp + 8]
push eax
push edi
call fcn.004591fa
inc ebx
pop ecx
cmp ebx, dword [esi + 0x10]
pop ecx
jl 0x459177
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b994a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.0041fdf3
mov eax, esi
jmp 0x4591e9
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b994a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.0041fdf3
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x468dd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.004612b0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x468e02
mov dword [esp + 0x2c], 0
jmp 0x468e1d
mov ecx, ebp
call fcn.004612b0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.004612b0
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.004612c0
cmp eax, esi
jae 0x468e5d
mov ecx, ebp
call fcn.004612c0
mov dword [esp + 0x10], eax
jmp 0x468e61
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.00461100
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x468ecd
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x468ec8
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.00461600
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x468ebb
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.00461a70
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x468e88
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x468e76
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x46e0f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x46e120
push esi
call fcn.0046e5f0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x46e119
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x46e1a3
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x46e18f
mov eax, dword [esi + 8]
test eax, eax
je 0x46e144
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46e18b
cmp eax, 2
je 0x46e18f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46e137
cmp eax, 3
je 0x46e16a
cmp eax, 1
jne 0x46e137
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46e137
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46e137
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0046e1d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x46e1c3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0046e1d0
add esp, 4
pop esi
ret
Function at 0x485a00
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x485a1a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x485a1a
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x49e288
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49e2a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a0d5e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x49e2cb
test byte [esp + 8], 2
je 0x49e2cb
call fcn.004a0dd1
mov dword [eax], 0xd
call fcn.004a0dda
mov dword [eax], 5
jmp 0x49e2a4
xor eax, eax
ret
Function at 0x4b4b70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0049e2d0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4b4c3b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4b4c3b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4b4bee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4b4bf9
or bh, 8
and edi, 0x8000000
je 0x4b4c14
mov eax, dword [0x57497c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4b4c3b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4b503b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4b505f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4b507a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4badd1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bae09
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b9e08
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b9ddf
jmp 0x4bae15
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4bae19
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x570e30
mov ecx, edi
call fcn.004b9ae1
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x4bae6c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4bae7f
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004b9e08
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004b9ddf
jmp 0x4bae7f
mov ecx, esi
call fcn.004bcdc0
test eax, eax
je 0x4bae7f
push edi
mov ecx, eax
call fcn.004badd1
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x4bc538
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bc57a
call fcn.004c6c19
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4bc57a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bc571
xor eax, eax
jmp 0x4bc582
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bc588
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c73f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.004c6c19
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4c742d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c742d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4c7431
xor eax, eax
jmp 0x4c74af
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004b8dd9
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x4c7469
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x4c7453
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004c75a0
push ebx
mov edi, eax
call fcn.004b8e02
test edi, edi
pop ecx
je 0x4c74ab
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004c7369
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004c74b4
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x43e717
Capabilities:
Resolve function by parsing pe exports

Disassembly:
repne scasb al, byte es:[edi]
call 0x7b68ca
pushal
mov byte [esp], 0xd8
lea esp, [esp + 0x28]
jne 0x4522a6
push 0x728ba76f
xadd cx, si
mov ecx, edi
call fcn.0042c979
adc al, 0x91
lea eax, [ebx - 0x668f7e37]
push ebp
shrd ebp, esi, cl
neg bp
mov ebp, esp
test ch, cl
sub esp, 0x18
sal eax, cl
movsx ax, dl
inc eax
push esi
lea eax, [esp - 0x273693f9]
bts eax, 0x16
push edi
sal ax, 2
das
btc ax, ax
shr al, 3
push ebx
btr ax, sp
cwde
sbb al, bl
push edx
sub ax, dx
and ah, al
pushfd
aaa
mov eax, dword [ebp + 8]
test dh, al
cmp dh, 0x25
test al, 0x84
test eax, eax
pushal
lea esp, [esp + 0x24]
je 0x4522a6
bswap dx
mov esi, dword [eax + 0x3c]
shl edx, cl
add esi, eax
shrd dx, sp, cl
dec dh
test dh, dl
movzx dx, dl
mov edx, dword [esi + 0x78]
cmp ch, 0x16
bt sp, dx
cmp ecx, 0x2e3120f4
bt si, sp
test edx, edx
push 0x7ba0e653
mov word [esp], dx
call fcn.0042f84e
test al, 0x7c
clc
push 0xef3abf54
bsf di, bp
sub esp, 0xfffffffc
add ebx, esp
cmc
clc
neg di
mov edi, ebx
sub al, 0xb2
sub al, 0xc1
inc al
mov al, 0x2e
cmc
stc
clc
jmp 0x43c878

Function at 0x43e8d2
Capabilities:
Encode data using xor

Disassembly:
xor ah, bh
aad 0xd2
aam 0x67
push edi
sbb byte [esi - 0x7c], al
sub ebp, edx
mov byte [0x7133f596], al
or al, 0x14
lodsd eax, dword [esi]
std
not si
not si
not si
movzx si, cl
mov esi, dword [esp + 0xc]
call fcn.007b7e61
test byte [esi + 0x4ca15a59], bh
sub dword fs:[esi - 0x756e6674], esp
cwde
mov al, 0xea
cmp eax, 0x883976f
insd dword es:[edi], dx
mov bl, 0xef
sub eax, 0xc7fdac74
jp 0x43e8bc
enter 0x30e8, 0x66
push ecx
adc byte [ebp + 0x6d], 0xc8
mov dword es:[0x8b80948b], eax
mov esi, ebp
mov ch, 0xc5
sbb dword [ebx - 0x7bc5a699], ebx
sub dword [eax - 0x4b], esp
aas
pushfd
nop
pop ecx
salc
int3

Function at 0x7b9e04
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], 0x70
stc
call fcn.0042d8bf
xor al, 0xea
bt dx, bx
test esi, esi
pushfd
sub al, 0x56
jmp 0x42ee45
mov dword [esp], 0xefa39d9b
inc al
cmp ah, 0xe4
push eax
stc
jmp 0x7b6d3e

Function at 0x7ba105
Capabilities:
Encode data using xor

Disassembly:
stc
cmp byte [edi - 1], 0
pushal
lea esp, [esp + 0x24]
jne 0x432bd5
mov di, bx
sar di, cl
call fcn.004401c5
adc eax, dword [0x14e88f8e]
div dword fs:[esp + edi*4 + 0x1d]
pop ss
sub byte [ecx + edx*4], bl
xchg ebp, eax
invalid
Function at 0xd2470c
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xff
mov ecx, 0x6bf37872
invalid
jmp 0xd24716
pushal
call 0xd2471c
pop ebp
sub ebp, 0x10
sub ebp, 0x92470c
jmp 0xd24732
mov eax, 0x92470c
add eax, ebp
add eax, 0x4c
mov ecx, 0x59f
mov edx, 0x8274dc8b
xor byte [eax], dl
inc eax
dec ecx
jne 0xd24749
jmp 0xd2475c
add byte [esi], al
add dh, byte [edi + 0xa8b8b8b]
dec edx
jae 0xd246f3
mov ecx, dword [ebx - 0x72ccb978]
mov ecx, dword [ebx - 0x745cce75]
mov ecx, dword [ebx + 0x4388697c]
mov edi, dword [ecx + ebp*2 - 0x78]
inc ebx
add byte [edx], cl
xchg dword [ebx + 0x4e888b8b], ecx
fcmovnu st(0), st(3)
jecxz 0xd24775
out dx, eax
xchg esp, eax
mov esp, ebx
and ebp, dword [ecx - 7]
mov ecx, dword [edx + 0x27e3afa7]
retf