joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fed53
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0x11
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xa
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x10], 0x3f400000
mov dword [edi + 0x14], 0x3e800000
mov dword [edi + 0x18], 0x40100000
mov dword [edi + 0x1c], 0x26
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.APNU::CEventContext.0
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x48f308
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x44], eax
mov ebx, dword [ebp + 8]
mov ecx, edi
push ebx
mov byte [ebp - 4], 1
call fcn.0045ca30
mov eax, dword [ebx + 0x34]
lea ecx, [edi + 0x44]
mov dword [edi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x40], eax
lea eax, [ebx + 0x44]
push eax
call fcn.0043a620
cmp dword [edi + 0x48], 0
lea eax, [edi + 0x48]
je 0x48f36d
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push eax
call esi
push eax
push dword [ebx + 0x48]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48f390
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fed89
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xec], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0x3f400000
mov dword [esi + 0x14], 0x3e800000
mov dword [esi + 0x18], 0x40100000
mov dword [esi + 0x1c], 0x26
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
lea edi, [esi + 0x44]
mov dword [esi], vtable.APNU::CEventContext.0
call fcn.0043ae40
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x48f445
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x64
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 1
push 0
push eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
call fcn.004d9060
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x64
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x48f4d2
lea edx, [ebp - 0xd8]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x48f4b2
sub edx, ecx
lea eax, [ebp - 0xd8]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0043b750
jmp 0x48f4e6
call fcn.004db407
push eax
push 0x508d70
push edi
call fcn.0043ad30
add esp, 0xc
mov dword [esi + 0x48], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x491380
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push 0
push 0x80
push 3
push 0
mov edi, ecx
push 1
push SysReAllocStringLen
push dword [edi + 0x34]
mov dword [edi + 0x78], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4913c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x78], eax
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
je 0x4914b8
cmp esi, dword [ebp + 8]
ja 0x49149f
lea ecx, [esi + 1]
push ecx
call fcn.004d7faf
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x4914b8
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test esi, esi
jne 0x49143e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
xor bl, bl
push esi
mov dword [edi + 0x78], eax
call fcn.004d89f6
add esp, 4
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
cmp eax, dword [ebp - 8]
je 0x491466
push esi
mov dword [edi + 0x78], 0xffffffff
xor bl, bl
call fcn.004d89f6
add esp, 4
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [eax + esi], 0
lea ecx, [edi + 4]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
call fcn.0046f120
cmp dword [eax + 0x28], 0
je 0x49148b
mov dword [edi + 0x78], 0xfffffffe
xor bl, bl
push esi
call fcn.004d89f6
add esp, 4
mov al, bl
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
mov dword [edi + 0x78], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [edi + 0x78], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x494170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.004d7790
test eax, eax
jne 0x494187
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc0], eax
test eax, eax
je 0x494180
cmp dword [esi + 0x9c], 0
jne 0x4941c6
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4d6a00
push 0
push 0
call fcn.004da73c
add esp, 0x18
mov dword [esi + 0x9c], eax
xor eax, eax
cmp dword [esi + 0x9c], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x4948f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0044d0e0
mov esi, dword [ebp + 0xc]
or edi, 0xffffffff
mov ebx, dword [ebp + 8]
push 5
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x4949c8
push 0xf0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
test ecx, ecx
je 0x49494e
push ecx
push ebx
call eax
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 8]
xor esi, esi
push ebx
call eax
test eax, eax
je 0x4949b5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x4949b5
push dword [ebp - 4]
push eax
call fcn.0044be80
add esp, 8
mov ebx, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov edi, eax
test edi, edi
je 0x494994
cmp edi, 0xffffffff
jne 0x49499c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebx, dword [ebp - 8]
je 0x4949bd
test ebx, ebx
je 0x4949bd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4949bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4949c8
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4974b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x4974e0
push 0
push 0
call fcn.004da73c
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x497b30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffa40
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x497b74
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push str.PlatformVersion
push dword [0x53e7c8]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004b9fe0
add esp, 0x10
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x497bc0
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [0x53e788]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push str._sOffers
push eax
call fcn.0043ad30
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push reloc.WS2_32.dll_accept
call fcn.0043aa90
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x497c5e
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x497c5e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x497c35
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push dword [0x53d548]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ebx, ebx
je 0x497c69
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x497c89
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x497ca7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffa68
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], vtable.APNU::CRuntimeConstant_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____class_ATL::CAtlMap_int___int__class_ATL::CElementTraits_int____class_ATL::CElementTraits_int____.0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0x11
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0xa
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x20], 0x3f400000
mov dword [ecx + 0x24], 0x3e800000
mov dword [ecx + 0x28], 0x40100000
mov dword [ecx + 0x2c], 0x26
mov dword [ecx + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x499140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.004d7790
test eax, eax
jne 0x499155
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x7c], 0
jne 0x499176
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4d6a00
push 0
push 0
call fcn.004da73c
add esp, 0x18
mov dword [esi + 0x7c], eax
xor eax, eax
cmp dword [esi + 0x7c], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x49aca0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffcc8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0xf003f
push dword [ebx + 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
push dword [ebx + 0x38]
call fcn.0043b290
mov edi, dword [ebp - 0x28]
test eax, eax
jne 0x49addd
xor edi, edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea ecx, [ebx + 4]
call fcn.0049aa10
cmp dword [eax], 0
je 0x49adc2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
call fcn.0049aa10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push dword [eax]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49adaf
cmp dword [ebp - 0x18], 4
jne 0x49adaf
mov eax, dword [ebp - 0x1c]
lea ecx, [ebx + 4]
cmp eax, 0xffffffff
jne 0x49ad88
lea eax, [ebp - 0x10]
push eax
call fcn.0049aa10
lea ecx, [ebx + 4]
mov dword [eax + 0xc], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0049aa10
push dword [eax]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x49adc2
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0049aa10
push eax
mov ecx, ebx
call fcn.0049c580
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
call fcn.0049aa10
mov dword [eax + 0xc], 1
jmp 0x49adc2
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
call fcn.0049aa10
mov dword [eax + 0xc], 0
inc edi
cmp edi, 0x3f
jl 0x49ad06
mov edi, dword [ebp - 0x28]
mov esi, 1
mov dword [ebx + 0x34], 1
jmp 0x49ade6
mov ecx, ebx
call fcn.0049af60
mov esi, eax
test edi, edi
je 0x49adf1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffea8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0
push 0
push 2
push 0
push 0
push dword [edi + 0x40]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push dword [edi + 0x38]
call fcn.0043aa90
mov ebx, dword [ebp - 0x20]
test eax, eax
jne 0x49c6c9
xor esi, esi
add edi, 4
lea ebx, [ebx]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov ecx, edi
call fcn.0049aa10
cmp dword [eax], 0
je 0x49c6c3
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0049aa10
cmp dword [eax + 0xc], 0
je 0x49c6c3
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0049aa10
mov ecx, edi
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0049aa10
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push dword [eax]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc esi
cmp esi, 0x3f
jl 0x49c670
test ebx, ebx
je 0x49c6d4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fffa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x49d0a1
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [0x53eb64]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push dword [0x53eb60]
push 0x509980
push eax
call fcn.0043ad30
mov edi, dword [ebp + 8]
push edi
push 0x2a
call fcn.0049d4c0
add esp, 0x18
test eax, eax
jns 0x49d0f2
push edi
push 0x26
call fcn.0049d4c0
mov esi, eax
add esp, 8
test esi, esi
js 0x49d124
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004c19b0
add esp, 8
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49d10f
xor esi, esi
jmp 0x49d124
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x49d124
movzx esi, si
or esi, 0x80070000
mov edi, dword [ebp - 0x10]
or ecx, 0xffffffff
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x49d148
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x49d4c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004dae70
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push 0x1ffe
push eax
mov word [ebp - 0x2004], ax
lea eax, [ebp - 0x2002]
push eax
call fcn.004d9060
add esp, 0xc
lea eax, [ebp - 0x2004]
push eax
mov eax, dword [ebp + 8]
push 0
push 0
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x49d547
lea edx, [ebp - 0x2004]
push edi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x49d526
sub edx, edi
lea eax, [ebp - 0x2004]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.0043b750
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d89fb
mov esp, ebp
pop ebp
ret
Function at 0x49f6e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500440
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x49f727
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x49f75f
push dword [0x53e788]
lea eax, [ebp - 0x14]
push str._sOffers
push eax
call fcn.0043ad30
add esp, 0xc
jmp 0x49f777
push eax
push dword [0x53e788]
lea eax, [ebp - 0x14]
push str._s_sOffers
push eax
call fcn.0043ad30
add esp, 0x10
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push 0
push 0
push 0x2001f
push 0
push 0
push esi
push reloc.WS2_32.dll_accept
call fcn.0043aa90
test eax, eax
jne 0x49f840
push eax
mov byte [ebp - 4], 2
call fcn.004dc861
add esp, 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x1c]
push str._Y__m__d__H:_M:_S
push eax
call fcn.004827f0
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edi, dword [eax]
mov eax, dword [ebp + 0xc]
test eax, eax
setne cl
test ecx, ecx
je 0x49f819
mov edx, eax
lea ebx, [edx + 2]
mov edi, edi
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x49f7f0
sub edx, ebx
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push eax
push 1
push 0
push edi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0xc]
lea edx, [eax - 0x10]
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x49f843
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x49f843
or edi, 0xffffffff
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x49f851
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x49f86f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a1350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbf08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4a1394
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x53e788]
push 0x509980
push eax
call fcn.0043ad30
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
mov esi, dword [ebp - 0x10]
add esp, 0x10
mov dword [ebp + 0xc], 1
mov dword [ebp - 0x1c], 0
mov ebx, dword [eax]
push 2
push esi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0043b290
mov edi, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x4a1417
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
test edi, edi
je 0x4a1422
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4a144b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a2cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500946
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4a2d6c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4a2d6c
call fcn.004424f0
mov esi, eax
jmp 0x4a2e5c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4a2d8f
call fcn.004424f0
jmp 0x4a2e4f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x4a2dad
call fcn.004424f0
jmp 0x4a2e4f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4a2dce
mov esi, 0x8007000e
jmp 0x4a2e51
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004a1eb0
jmp 0x4a2df8
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4a2e0f
mov esi, 0x8007000e
jmp 0x4a2e51
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4a2e2f
call fcn.004424f0
jmp 0x4a2e4f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004a2b60
mov esi, eax
test edi, edi
je 0x4a2e5c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4a2e80
lea ecx, [ebp - 0x418]
call fcn.004a2410
jmp 0x4a2e80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 0x10