joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
cmp dword [0x5ed9b0], 0
je 0x49d78c
mov eax, dword [0x5ef950]
jmp 0x49d8d0
mov dword [0x5ed9b0], 1
xor eax, eax
mov ax, word [0x5ef94c]
test eax, eax
jne 0x49d7cf
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x5ef948], eax
cmp dword [0x5ef948], 0
jne 0x49d7c6
mov word [0x5ef94c], 1
jmp 0x49d7cf
mov word [0x5ef94c], 2
xor ecx, ecx
mov cx, word [0x5ef94c]
cmp ecx, 2
jne 0x49d82a
mov dword [ebp - 4], 0
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49d82a
cmp dword [0x5ef948], 0
je 0x49d82a
push 0
push 0
mov edx, dword [0x5ef948]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x5ef950], eax
mov eax, dword [0x5ef950]
jmp 0x49d8d0
mov dword [0x5ef950], 3
cmp dword [0x5ef8f4], 0
jne 0x49d8b1
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.Control_PanelDesktop
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49d8af
mov dword [ebp - 0x90], 0x80
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x8c]
push ecx
push 0
push str.WheelScrollLines
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49d8a5
push 0xa
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.00428820
add esp, 0xc
mov dword [0x5ef950], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49d8cb
cmp dword [0x5ef8f0], 0
jne 0x49d8cb
push 0
push 0x5ef950
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x5ef950]
mov esp, ebp
pop ebp
ret

Function at 0x4a0280
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004d46ca
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x4a02d6
push 1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x4a02d4
push str.Warning:_File_save_with_new_name_failed._n
push 0x5e0f24
call fcn.00455d15
add esp, 8
xor eax, eax
jmp 0x4a0311
jmp 0x4a030c
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.004d46ca
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
call dword [edx + 0xa0]
test eax, eax
jne 0x4a030c
push str.Warning:_File_save_failed._n
push 0x5e0f44
call fcn.00455d15
add esp, 8
xor eax, eax
jmp 0x4a0311
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b9416
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b9040
mov dword [ebp - 0x28], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x4b9475
push 0x20
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004b91d4
test eax, eax
jne 0x4b9473
push 0xffffffffffffffff
push 0
mov edx, dword [ebp + 0x14]
push edx
call fcn.004a6a09
mov ecx, dword [ebp + 8]
call fcn.004b915f
jmp 0x4b9494
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0049b763
mov dword [ebp - 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x4b9b04
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004b908e
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x4b9b7d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4b9b54
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0047c687
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4b9b71
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.0047c4d8
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.0047c613
jmp 0x4b9bae
mov ecx, dword [ebp + 0x10]
call fcn.004d46ca
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4b9bae
mov ecx, dword [ebp + 0x10]
call fcn.004d46ca
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.0049b763
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c0bbe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
test ecx, ecx
je 0x4c0be2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x4c0c1c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c0c36
push 0xc9
push str.dlgprop.cpp
call fcn.004d80a0
test eax, eax
je 0x4c0c36
int3
xor eax, eax
test eax, eax
jne 0x4c0c1c
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0xffff
jne 0x4c0d11
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x80000000
test eax, eax
je 0x4c0ce1
push 0x5dd0fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c0c8e
push 0xe1
push str.dlgprop.cpp
call fcn.004d80a0
test eax, eax
je 0x4c0c8e
int3
xor ecx, ecx
test ecx, ecx
jne 0x4c0c74
cmp dword [ebp - 0x18], 0
je 0x4c0cdf
push 0x5dd10c
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4c0cd5
mov eax, 1
test eax, eax
je 0x4c0ccf
push 0xe6
push str.dlgprop.cpp
call fcn.004d80a0
test eax, eax
je 0x4c0ccf
int3
xor ecx, ecx
test ecx, ecx
jne 0x4c0cb2
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4c0d11
mov eax, dword [ebp - 0x14]
and eax, 0xff
cmp eax, 3
jne 0x4c0d11
mov ecx, 1
test ecx, ecx
je 0x4c0d0b
push 0xed
push str.dlgprop.cpp
call fcn.004d80a0
test eax, eax
je 0x4c0d0b
int3
xor edx, edx
test edx, edx
jne 0x4c0cee
call fcn.004f0b63
cmp dword [eax + 0x1038], 0
je 0x4c0d2e
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004c0b73
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004c0a35
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x44], 0
je 0x4c0d5e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x44], 0
cmp dword [ebp - 8], 0
je 0x4c0d73
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4efe2c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x4efe52
push 0x146
push str.afxtls.cpp
call fcn.004d80a0
test eax, eax
je 0x4efe52
int3
xor eax, eax
test eax, eax
jne 0x4efe38
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x4efe71
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x4efef4
cmp dword [ebp + 0xc], 0
je 0x4efe94
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4efed9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4efec0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x4efec7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x4efeef
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x4efeef
mov dword [ebp - 4], 0
jmp 0x4efe68
cmp dword [ebp - 4], 0
je 0x4eff68
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004f04f0
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4eff53
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x4eff5a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4eff71
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x4effb4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4effb2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004efe2c
jmp 0x4effe9
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004f0510
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4effe9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004efe2c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x4effc2
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8

Function at 0x4f332d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x4f3379
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x4f3372
mov eax, dword [ebp + 8]
push eax
push 0x5e0c94
call fcn.00455d15
add esp, 8
xor eax, eax
jmp 0x4f33e5
mov eax, 1
jmp 0x4f33e5
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4f33d2
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4f33d2
cmp dword [ebp - 8], 0
jne 0x4f33d2
mov eax, 1
jmp 0x4f33e5
mov edx, dword [ebp + 8]
push edx
push str.Warning:_registration_database_update_failed_for_key__s._n
call fcn.00455d15
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4fbc58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4fbcfb
cmp dword [ebp + 8], 0
je 0x4fbcfb
lea edx, [ebp - 0xc]
push edx
push 0x5e39c4
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edx, dword [ebp - 0x10]
push edx
call fcn.004f489e
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5200bf
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x55
push str.oledrop1.cpp
mov eax, dword [ebp - 0x24]
push eax
call fcn.004898a0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x38], 0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x520123
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x38]
or al, 1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x34]
or al, 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], eax
jmp 0x520150
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x520150
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x38]
or ecx, 2
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x34]
or ecx, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.004dbe64
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x30], 0
jne 0x52022a
call fcn.004dbe53
cmp eax, dword [ebp + 8]
je 0x52017d
jmp 0x52022a
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x5201b5
push 1
push 0x108
push 0x100
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x52020a
cmp dword [ebp - 0x1c], 0x202
je 0x5201d9
cmp dword [ebp - 0x1c], 0x205
je 0x5201d9
cmp dword [ebp - 0x1c], 0x201
je 0x5201d9
cmp dword [ebp - 0x1c], 0x204
jne 0x5201db
jmp 0x52022a
cmp dword [ebp - 0x1c], 0x100
jne 0x5201ec
cmp dword [ebp - 0x18], 0x1b
jne 0x5201ec
jmp 0x52022a
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
call fcn.004e1d56
neg eax
sbb eax, eax
inc eax
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [0x5efa94]
jbe 0x520225
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x30], 1
jmp 0x520161
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x30]
mov esp, ebp
pop ebp
ret 4
Function at 0x4039a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x42fc30
call fcn.004149e2
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x403a54
test esi, esi
jne 0x403a54
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x403a38
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403a32
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403a32
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x403a21
cmp esi, eax
jae 0x403a25
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403a13
cmp esi, eax
jb 0x403a29
xor eax, eax
jmp 0x403a32
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x403a5d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x42fc30
call fcn.004149e2
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x4039c5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403b58
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403b8a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x403b86
cmp esi, eax
jae 0x403b8a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403b78
cmp esi, eax
jb 0x403b90
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x407b20
Capabilities:
Get token membership
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4237a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x42d4d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [eax]
mov ecx, 0x427b68
mov eax, esi
jmp 0x407b60
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407b86
cmp dx, bx
je 0x407b82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407b86
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x407b60
xor eax, eax
jmp 0x407b8b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
je 0x407ba3
push str._WHo_k_qz
call fcn.00401570
add esp, 4
jmp 0x407ba5
mov eax, esi
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.00401930
lea edx, [ebp - 0x24]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
mov dword [ebp - 4], ebx
push 2
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x14], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x407bfc
mov edx, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x1c], 1
jne 0x407c15
cmp byte [ebp + 0xc], bl
jne 0x407c15
lea ecx, [ebp - 0x1c]
call fcn.0040be10
mov byte [ebp - 4], 1
jmp 0x407c21
lea ecx, [ebp - 0x1c]
call fcn.0040bf60
mov byte [ebp - 4], 2
mov eax, dword [eax]
push eax
push str.:pG_g_eJm_
call fcn.00401570
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 4
push eax
call esi
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1c]
call fcn.0040bf60
mov byte [ebp - 4], 3
mov eax, dword [eax]
push eax
push str.oZ_E_W_
call fcn.00401570
add esp, 4
push eax
call esi
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
push edi
call fcn.0040b0c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407cd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041528c
mov esp, ebp
pop ebp
ret
Function at 0x409f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x431375], 0
push ebx
push esi
push edi
mov edi, eax
mov esi, ecx
jne 0x409f72
call fcn.00409e00
mov byte [0x431375], 1
xor edx, edx
xor eax, eax
mov dword [ebp - 4], edx
test edi, edi
je 0x409fab
lea ecx, [ecx]
movzx ebx, byte [esi]
mov ecx, eax
shr ecx, 0x18
xor ecx, ebx
movzx ebx, byte [ebp - 1]
shl eax, 8
shl edx, 8
xor edx, dword [ecx*4 + 0x430b70]
or eax, ebx
xor eax, dword [ecx*4 + 0x430f70]
inc esi
dec edi
mov dword [ebp - 4], edx
jne 0x409f80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ac20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push 0x428184
mov esi, ecx
call fcn.00401320
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push eax
mov eax, dword [esi + 4]
push eax
call edi
test eax, eax
setne bl
push str.D:FbNF:pkFQQ_
mov dword [esi + 0xc], eax
and bl, 1
call fcn.00401320
mov ecx, dword [esi + 4]
add esp, 4
push eax
push ecx
call edi
test eax, eax
setne dl
push str.UFNopewxFhmxFObJF_
mov dword [esi + 0x10], eax
and bl, dl
call fcn.00401320
add esp, 4
push eax
mov eax, dword [esi + 4]
push eax
call edi
test eax, eax
setne cl
push str._WXUFN_kNmFDp_QpxFXFQQmp__e
mov dword [esi + 0x14], eax
and bl, cl
call fcn.00401320
mov edx, dword [esi + 4]
add esp, 4
push eax
push edx
call edi
test eax, eax
mov dword [esi + 0x18], eax
setne al
push str.D:FbNFWppxiFxq__X_bqQipN
and bl, al
call fcn.00401320
mov ecx, dword [esi + 4]
add esp, 4
push eax
push ecx
call edi
test eax, eax
setne dl
push str.yqF_:pkFQQ
mov dword [esi + 0x1c], eax
and bl, dl
call fcn.00401320
add esp, 4
push eax
mov eax, dword [esi + 4]
push eax
call edi
test eax, eax
setne cl
push str.:pkFQQ_eWpXFQQmp__e
mov dword [esi + 0x28], eax
and bl, cl
call fcn.00401320
mov edx, dword [esi + 4]
add esp, 4
push eax
push edx
call edi
test eax, eax
mov dword [esi + 0x2c], eax
setne al
push str.:pkFQQ__hm:QN_
and bl, al
call fcn.00401320
mov ecx, dword [esi + 4]
add esp, 4
push eax
push ecx
call edi
test eax, eax
setne dl
push str.:pkFQQ__OFPN_
mov dword [esi + 0x20], eax
and bl, dl
call fcn.00401320
add esp, 4
push eax
mov eax, dword [esi + 4]
push eax
call edi
test eax, eax
setne cl
push str.UFNpxwJF__gp:JbNmp__
mov dword [esi + 0x24], eax
and bl, cl
call fcn.00401320
mov edx, dword [esi + 4]
add esp, 4
push eax
push edx
call edi
mov dword [esi + 0x30], eax
test eax, eax
pop edi
setne al
pop esi
and al, bl
pop ebx
mov esp, ebp
pop ebp
ret