joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46eb7a
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0xfc], edi
je 0x46ec1d
push str.FontSizeChanged_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi + 0xd0]
lea ecx, [esi + 0x108]
add eax, 0x128
push eax
call fcn.00465cef
mov ecx, esi
call fcn.00469aa3
push str.text
lea ecx, [esi + 0xd8]
call fcn.00472762
test al, al
je 0x46ec1d
cmp dword [esi + 0xd4], edi
je 0x46ec1d
mov ecx, esi
call fcn.004667c3
push edi
push 0x4eebe4
push 0x4eebb0
push edi
push dword [esi + 0xd4]
call sub.VCRUNTIME140.dll___RTDynamicCast
add esp, 0x14
test eax, eax
je 0x46ec1d
cmp dword [esi + 0x130], edi
lea ecx, [esi + 0x134]
push ecx
setne cl
movzx ecx, cl
push ecx
push dword [esi + 0x10c]
mov ecx, eax
push dword [esi + 0x100]
call fcn.0045628d
pop edi
pop esi
ret
Function at 0x479262
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x4b204a
call fcn.004a7676
mov dword [ebp - 0x24], ecx
xor edi, edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.0040d765
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10], edi
je 0x479293
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push str.CLSID9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47934a
mov esi, edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x10], esi
je 0x47934a
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
push str.idex
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x1c], 1
je 0x4792e4
cmp dword [ebp - 0x1c], 2
jne 0x47934a
lea ecx, [ebp - 0x14]
call fcn.0040d870
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
shr eax, 1
inc eax
push eax
call fcn.0040e373
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push str.idex
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47932b
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x20]
xor esi, esi
shr eax, 1
inc esi
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00412b02
test esi, esi
je 0x47934a
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
push esi
call fcn.0040dc67
xor edi, edi
inc edi
jmp 0x47934d
mov esi, dword [ebp - 0x14]
lea ecx, [esi - 0x10]
call fcn.0040bb70
cmp dword [ebp - 0x10], 0
je 0x479364
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.004a7644
ret
Function at 0x47d3ba
Capabilities:
Check if file exists

Disassembly:
push 0x134
mov eax, 0x4b2c2e
call fcn.004a76a9
mov edi, ecx
lea ecx, [ebp - 0x120]
call fcn.0047bdba
and dword [ebp - 4], 0
lea ecx, [ebp - 0x11c]
push dword [eax]
call fcn.0040d6dc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx - 0x10]
call fcn.0040bb70
push str._cfgdata_drawingCfg.dat
lea ecx, [ebp - 0x11c]
call fcn.0046ff3e
push dword [ebp - 0x11c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47d4bf
mov ecx, dword [ebp - 0x11c]
lea edx, [ebp - 0x120]
and dword [ebp - 0x120], 0
call fcn.0043f55e
mov esi, eax
test esi, esi
je 0x47d4bf
lea ecx, [ebp - 0x13c]
call fcn.00461bcb
push 0xfde9
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], eax
call fcn.0040db07
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x13c]
push dword [ebp - 0x118]
call fcn.00412112
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x118], eax
je 0x47d49f
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x13c]
mov ecx, edi
push eax
call fcn.0047d4d3
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x13c]
call fcn.004120e8
mov ecx, dword [ebp - 0x11c]
lea ecx, [ecx - 0x10]
call fcn.0040bb70
call fcn.004a7658
ret

Function at 0x482bf8
Capabilities:
Hide graphical window

Disassembly:
push 0x18
mov eax, 0x4b347e
call fcn.004a7676
mov ebx, ecx
push dword [ebp + 8]
lea esi, [ebx + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], esi
call fcn.0040d6dc
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00483823
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov esi, dword [esi]
add ecx, 0xfffffff0
call fcn.0040bb70
push dword [ebp + 8]
cmp edi, esi
je 0x482c63
lea ecx, [ebp + 8]
call fcn.0040d6dc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp + 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004837a0
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [ebp + 8]
jmp 0x482cba
lea ecx, [ebp - 0x10]
call fcn.0040d6dc
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.004839a8
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov esi, dword [ebx]
add ecx, 0xfffffff0
call fcn.0040bb70
cmp edi, esi
je 0x482cc2
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.0040d6dc
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00483925
push 0
mov eax, dword [eax]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040bb70
call fcn.004a7644
ret 4
Function at 0x484c28
Capabilities:
Create process on windows

Disassembly:
push 8
mov eax, 0x4b371a
call fcn.004a7676
mov edi, ecx
lea ecx, [ebp - 0x10]
call fcn.0040d765
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00484ca1
call fcn.0041a850
push ecx
push ecx
mov ecx, eax
call fcn.0041a89d
call fcn.0041a850
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.0041af6c
mov esi, dword [ebp - 0x10]
push ebx
push ebx
push esi
push dword [ebp - 0x14]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x20], 1
lea ecx, [ecx - 0x10]
call fcn.0040bb70
lea ecx, [esi - 0x10]
call fcn.0040bb70
call fcn.004a7644
ret

Function at 0x48546b
Capabilities:
Accept command line arguments

Disassembly:
push 0x38
mov eax, 0x4b38ef
call fcn.004a7676
push 2
pop esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x44]
call fcn.0045e8d4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov edi, str.hotKey
push edi
call fcn.00470d15
test eax, eax
je 0x4854d9
push edi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x44]
call fcn.0045ec51
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, dword [ebp - 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0040bb70
cmp edi, 0x141
jne 0x4854ce
xor esi, esi
inc esi
jmp 0x4854d9
xor eax, eax
cmp edi, 0x541
cmove esi, eax
lea ecx, [ebp - 0x40]
call fcn.00470da0
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0040bb70
mov eax, esi
call fcn.004a7644
ret

Function at 0x486e50
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, str.85A304D0_E819_430d_87A0_28B781FD24C6
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x486e70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x486e9a
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x486e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x486e91
push esi
jmp 0x486e66
xor eax, eax
mov dword [0x4eb04c], esi
inc eax
pop esi
ret 4
Function at 0x488637
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x4ea00c]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.00419790
mov esi, eax
test esi, esi
je 0x48869d
cmp dword [esp + 0xc], ebx
je 0x488696
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x48872c
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4886e1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00488637
mov esi, eax
test esi, esi
jne 0x488743
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x4886b8
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x48870b
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.00488546
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x48872a
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a439a
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x48868a
Function at 0x488ae4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x4b3d44
call fcn.004a7715
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x488b61
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x488b61
call fcn.0048823f
mov esi, eax
jmp 0x488c38
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x488b84
call fcn.0048823f
jmp 0x488c2b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x488b7a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x488bb4
mov esi, 0x8007000e
jmp 0x488c2d
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0048b62c
jmp 0x488bda
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x488bad
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x488b7a
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004896e3
mov esi, eax
test edi, edi
je 0x488c38
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x488c51
lea ecx, [ebp - 0x418]
call fcn.0048b883
mov eax, esi
call fcn.004a7667
ret 0x10
Function at 0x48d3e7
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x10
test edx, edx
jle 0x48d491
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebx - 1]
add eax, edx
mov dword [ebp - 0x10], eax
mov cl, byte [edi]
test cl, cl
je 0x48d474
movzx eax, cl
mov al, byte [eax + 0x4c0850]
test ebx, ebx
jle 0x48d465
mov esi, dword [ebx*4 + 0x4c0990]
movzx edx, al
sub esi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
movzx eax, byte [esi + edi]
add eax, edx
mov dword [ebp - 8], 0xff
xor edx, edx
div dword [ebp - 8]
movzx eax, dl
mov edx, dword [ebp - 0xc]
mov al, byte [eax + 0x4c0750]
xor al, byte [edi + 1]
mov byte [edi], al
lea edi, [edi + 1]
sub ebx, 1
jne 0x48d431
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp ebx, eax
jge 0x48d482
mov ecx, eax
add edi, ebx
sub ecx, ebx
jmp 0x48d47a
test eax, eax
jle 0x48d482
mov ecx, eax
lea esi, [edi + 1]
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
sub edx, 1
mov dword [ebp + 0xc], edx
jne 0x48d409
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4989e6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x4ea00c]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
cmp eax, dword [esi + 0x1c]
jne 0x498a37
movsd xmm1, qword [eax + 0x10]
push 2
pop ecx
call fcn.004580ad
movsd xmm1, qword [0x4c9060]
subsd xmm1, xmm0
mulsd xmm1, qword [0x4c90a0]
cvttsd2si ebx, xmm1
jmp 0x498ac9
cmp eax, dword [esi + 0x18]
jne 0x498af5
movsd xmm1, qword [eax + 0x10]
xor ecx, ecx
inc ecx
call fcn.004580ad
xor eax, eax
lea edi, [esp + 0x118]
stosd dword es:[edi], eax
movaps xmm1, xmm0
mulsd xmm1, qword [0x4c90a0]
push ecx
push ecx
stosd dword es:[edi], eax
movsd qword [esp], xmm0
push 0x4c865c
cvttsd2si ebx, xmm1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x124]
push eax
call fcn.0043b9f6
add esp, 0x10
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x118]
push 3
push eax
call fcn.0040db07
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call edi
lea eax, [esp + 0x14]
cmp dword [esp + 0x10], eax
je 0x498ac2
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push 0x4c86b0
call edi
add esi, 0xffffffbc
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
cmp bl, byte [eax + 4]
je 0x498af5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, esi
mov byte [eax + 4], bl
mov eax, dword [esi]
call dword [eax + 8]
mov ecx, dword [eax + 0x48]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a439a
mov esp, ebp
pop ebp
ret 4
Function at 0x49a4bc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0x27
ja 0x49a584
je 0x49a56f
sub eax, 8
je 0x49a5f1
sub eax, 5
je 0x49a543
sub eax, 0xe
je 0x49a51f
sub eax, 0xa
je 0x49a50a
sub eax, 1
jne 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
push 0x26
jmp 0x49a611
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
push 0x25
jmp 0x49a611
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
cmp dword [esi + 0x70], 0
je 0x49a616
mov eax, dword [ecx]
push 1
call dword [eax + 0x28]
jmp 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
cmp dword [esi + 0xfc], 2
mov eax, dword [ecx]
jne 0x49a567
call dword [eax + 0x84]
jmp 0x49a616
call dword [eax + 0x2c]
jmp 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
push 0x27
jmp 0x49a611
cmp eax, 0x28
je 0x49a605
cmp eax, 0x2e
je 0x49a5f1
cmp eax, 0x53
je 0x49a5be
cmp eax, 0x5a
jne 0x49a616
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
cmp dword [esi + 0x9c], 0
je 0x49a616
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x49a616
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
cmp dword [esi + 0x70], 0
je 0x49a616
cmp dword [esi + 0xfc], 2
mov eax, dword [ecx]
jne 0x49a5ea
call dword [eax + 0x7c]
jmp 0x49a616
push 1
call dword [eax + 0x30]
jmp 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
mov eax, dword [ecx]
call dword [eax + 0xac]
jmp 0x49a616
mov ecx, dword [esi + 0xe0]
test ecx, ecx
je 0x49a616
push 0x28
mov eax, dword [ecx]
call dword [eax + 0x24]
pop esi
pop ebp
ret 4
Function at 0x4a20fb
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
push 0
push 0
push 0x402
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x4a356c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x4c
mov edi, ecx
call fcn.004a43b6
pop ecx
mov ecx, eax
mov dword [ebp - 0xc], eax
call fcn.004a1dd4
push 0x58
mov dword [0x4f0350], eax
call fcn.004a43b6
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, esp
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [edx], ecx
mov ecx, dword [ebp + 0x14]
push ecx
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
push edi
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.004a3510
mov ebx, eax
mov ecx, ebx
mov dword [ebp - 0xc], ebx
call fcn.004a376c
mov ecx, dword [0x4f0350]
push 0
call fcn.004a1fbf
mov eax, dword [ebx + 0x10]
mov ecx, dword [0x4f0350]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call fcn.004a1e97
mov eax, dword [0x4f0350]
push 0x4c8f80
mov eax, dword [eax]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ecx
mov ecx, dword [0x4f0350]
push ebx
call fcn.004a2121
mov ecx, dword [0x4f0350]
push ecx
push 0x8000088
push ecx
mov eax, dword [ecx]
mov byte [eax + 0x28], 0
mov eax, dword [ecx]
lea ecx, [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
call fcn.00497c32
mov eax, dword [ebp + 0x14]
push 0x18
push dword [ebx + 0x14]
add eax, 0x14
push dword [ebx + 0x10]
push eax
mov eax, dword [ebp + 0x10]
add eax, 0x14
push eax
mov eax, dword [0x4f0350]
push 0xffffffffffffffff
mov eax, dword [eax]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
push 1
push edi
push ebx
call esi
mov ecx, dword [0x4f0350]
mov ecx, dword [ecx]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
call esi
mov ecx, dword [0x4f0350]
push 1
call fcn.004a2093
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a6b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5c70
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4ea00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x214], eax
cmp dword [0x4f02c0], 0
je 0x4a6b4d
mov eax, dword [0x4f02c0]
mov dword [ebp - 0x214], eax
push str.BINDATA
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4a6b78
jmp 0x4a6ca4
mov eax, dword [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4a6ba0
jmp 0x4a6ca4
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jne 0x4a6bcf
jmp 0x4a6ca4
mov ecx, dword [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x220], eax
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.VCRUNTIME140.dll_memcpy]
add esp, 0xc
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x22c]
push eax
push 1
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x224]
call fcn.0048ed70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
call fcn.0048ed90
push 0
lea ecx, [ebp - 0x224]
call fcn.0048ee00
push eax
call fcn.0048e670
add esp, 8
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0048e4d0
mov eax, dword [ebp - 0x238]
jmp 0x4a6d07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x4a6d05
push 0x1fe
push 0
lea edx, [ebp - 0x210]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.Function:__s__image_id:_d__Last_error:__d
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x4c0f6c
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a439a
mov esp, ebp
pop ebp
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404a42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x404a51
pop dword [ebp - 0xc]
mov eax, 0xd919b08c
add eax, 0x272699c5
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x9dcffa3b
sub dword [ebp - 0x1c], 0x4f7db4f0
mov dword [ebp - 0x18], 0xaeefc9d9
add dword [ebp - 0x18], 0x8343826c
mov dword [ebp - 0x14], 0xd2930009
sub dword [ebp - 0x14], 0x8646bbdb
mov dword [ebp - 0x10], 0x77fc9b84
add dword [ebp - 0x10], 0x8803647c
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xd305018d
add eax, 0x2d3bcebf
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x80e0f2d1
sub dword [ebp - 0x1c], 0xc6e897b
mov dword [ebp - 0x18], 0xe8c350dc
sub dword [ebp - 0x18], 0xa756ef67
mov dword [ebp - 0x14], 0xd68c5f3a
add dword [ebp - 0x14], 0x8ce30d32
mov dword [ebp - 0x10], 0xda7dbbc1
add dword [ebp - 0x10], 0x2582443f
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xba369c31
sub eax, 0xb9f5cbe9
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x386a2
push 0
call eax
mov ecx, 0x704d74d9
add ecx, 0x8fb2ceee
mov esi, eax
mov edx, 0x7077baf9
add edx, 0x8fc9f507
add edx, dword [ebp - 0xc]
mov edi, 0x4674115d
sub edi, 0x603998e8
xor dword [ebp - 4], ebx
mov ebx, dword [edx]
xor ebx, edi
xor dword [ebp - 4], edi
mov dword [esi], ebx
sub dword [ebp - 8], 0xf8c3fafb
add esi, 0x590e205
sub esi, 0x590e201
add edx, 0xf8615531
add edx, 0x79eaad3
loop 0x404b73
add eax, 0xf8007f2f
sub eax, 0xf7ff7d40
mov ebx, eax
add eax, 0xe50b6f9b
sub eax, 0xe50b6f96
mov ecx, 0xb2128ee2
add ecx, 0x4e2d711e
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4024a5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4024e4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4024e4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4024e4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4024e4
cmp dword [ecx + 0x74], 0xe
jbe 0x4024e4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret