joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4b0f11
jmp dword [ecx*4 + 0x4b0f80]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x4b1110
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005c44f5
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4b1174
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4b1174
lea edx, [ebp - 0x108]
push edx
call dword [0x65700c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.005bdb17
mov esp, ebp
pop ebp
ret

Function at 0x4b1190
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b1110

Function at 0x4b1330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.004949a0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.005d5b60
add esp, 0x10
pop ebp
ret

Function at 0x4b6000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x4b601b
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.00494900
push edx
push eax
call fcn.00494930
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x4b6068
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.00494900
push edx
push eax
call fcn.00494930
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x4b606a
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b7160
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4b7193
push 0x2e
push esi
call fcn.005c2fe0
add esp, 8
test eax, eax
je 0x4b7191
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4b71a0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4b71d3
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x4b88f0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4b8912
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4b8906
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x4b8942
cmp dword [esi + 8], 0
jne 0x4b8935
mov ecx, dword [eax + 8]
push 0x62e02c
push ecx
call fcn.005c21f4
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4b8935
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.005c2fa7
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4b8964
mov eax, dword [esi + 8]
test eax, eax
je 0x4b895e
push eax
call fcn.005c0853
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x4b96e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4b970b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x4b9752
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x4b9755
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x4b97b6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x4b9780
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x4b97ef
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x5fe338
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x5fe339
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x4b97c0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bd369
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4bd394
call fcn.004c6335
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
jne 0x4bd3b7
push eax
push dword [esi + 4]
call fcn.004bd2ef
push esi
push eax
mov ecx, 0x65f560
call fcn.004bcf43
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4bdc5c
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5e030e
call fcn.005c5dbe
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004bdc1c
and dword [ebp - 4], 0
mov dword [esi], vtable.CHttpConnection.0
call fcn.004bc495
push eax
lea ecx, [esi + 0x18]
call fcn.0040304f
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00405d27
push dword [esi + 8]
mov ebx, dword [ebx + 8]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [esi + 4], eax
test eax, eax
jne 0x4bdcd4
push eax
push dword [esi + 8]
call fcn.004bd2ef
push dword [esi + 0xc]
mov ecx, 0x65f560
push eax
call fcn.004bcf43
mov eax, esi
call fcn.005c5e96
ret 0x1c

Function at 0x4be512
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x4be55a
push 0x5fec30
push 4
push eax
call fcn.005c7d19
push eax
call fcn.004bb607
add esp, 0x10
jmp 0x4be570
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4be5f3
push edi
call fcn.005c2b43
mov edi, dword [eax]
call fcn.005c2b43
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.005be163
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.005c2b43
cmp dword [eax], 0
je 0x4be5c7
call fcn.005c2b43
push dword [eax]
call fcn.004bb962
pop ecx
jmp 0x4be5ce
call fcn.005c2b43
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x4be5f3
cmp dword [ebp - 0x11c], esi
jae 0x4be5f3
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x4be5f5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005bdb17
leave
ret
Function at 0x4be602
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push 0x5fec54
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.004be465
pop ecx
cmp eax, esi
je 0x4be6ec
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x4be6ec
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.005c2720
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x4be6ec
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x4be6ec
cmp esi, 0x14
jge 0x4be6ec
push 0x10
push 0
push edi
call fcn.005c7f3a
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4be6db
call fcn.005c2b43
cmp dword [eax], 0x22
je 0x4be6db
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.005c7439
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x4be6b1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x65f5a4], 0
jne 0x4be777
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x4be7a0
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.004be512
pop ecx
pop ecx
test eax, eax
jne 0x4be7a2
inc edi
cmp edi, esi
jl 0x4be77d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bdb17
leave
ret 8
Function at 0x4c0c37
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4c0c7f
call fcn.004c6335
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4c0c7f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4c0cc2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4c0cab
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4c0cab
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x4c0cbf
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4c2aae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004c6335
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4c2ae7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004c26f0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4c2b45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4c2b69
cmp dword [edi + 0x74], 0
jne 0x4c2b69
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.004c6335
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004c2b06
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4c6bb1
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5e3f16
call fcn.005c5dbe
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4c6bd6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4c6c28
call fcn.004bc495
push eax
lea ecx, [ebp - 0x10]
call fcn.0040304f
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005c741c
push eax
call fcn.004bb607
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004030a5
mov eax, esi
call fcn.005c5e96
ret 8

Function at 0x4d05d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4d0619
call fcn.004c6335
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d0619
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4d0635
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004d00d7
mov esi, eax
test edi, edi
je 0x4d0633
test ebx, ebx
je 0x4d0633
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4d4484
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4d44b9
xor eax, eax
jmp 0x4d450c
lea eax, [ebp - 0x210]
push eax
call fcn.005c7439
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x4d44ea
push 0x600cec
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005c9899
add esp, 0xc
test eax, eax
jne 0x4d44b5
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005c9899
add esp, 0xc
test eax, eax
jne 0x4d44b5
lea eax, [ebp - 0x210]
push eax
call fcn.004bcdb9
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005bdb17
leave
ret
Function at 0x4e3784
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004e3443
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4e37ce
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004bd939
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004bd2a7
jmp 0x4e37d9
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004d11ef
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4e37df
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.004c645a
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4e381c
call fcn.004e3443
mov dword [esi + 0xc], 1
jmp 0x4e3821
call fcn.004e3443
cmp dword [esi], 0
je 0x4e386a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x4e3842
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004bd939
jmp 0x4e3854
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00402fed
push pe_nt_image_headers32
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004bd2a7
jmp 0x4e388e
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4e388e
push dword [esi]
push dword [ebp + 8]
call fcn.004d11ef
pop esi
pop ebp
ret 0xc

Function at 0x50d8d5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00595719
call fcn.004c5d66
cmp dword [eax + 0x14], 0
jne 0x50d8f2
mov ecx, esi
pop esi
jmp fcn.0050d3da
pop esi
ret

Function at 0x510f02
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0050f5f8
call fcn.004c5d66
cmp dword [eax + 0x14], 0
jne 0x510f1f
mov ecx, esi
pop esi
jmp fcn.005108d5
pop esi
ret
Function at 0x54bda0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x54bdba
call fcn.004c6335
mov esi, dword [eax + 0xc]
push dword [0x663324]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x54bdd8
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x54bdd0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x54be05
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x54bdd2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0054bcce
mov esi, eax
jmp 0x54bdf7

Function at 0x59eab3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x59eacb
mov edi, dword [esi + 0xc]
jmp 0x59eb0b
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x59eae4
call fcn.004c72cb
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x59eaf9
call fcn.004c72cb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x59eb0b
call fcn.004c72cb
call fcn.004c6335
cmp dword [eax + 0x3c], 0
je 0x59eb20
push edi
mov ecx, ebx
call fcn.0059d8ef
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0059e9cd
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x59eb3e
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x59eb4a
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5bdb17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65bf90]
jne 0x5bdb21
repz ret
jmp fcn.005cac54
Function at 0x5db665
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005cd688
and dword [ebp - 0x14], 0
cmp dword [0x6658a0], 0
mov dword [ebp - 0x18], eax
jne 0x5db718
push 0x603370
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5db7c0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6269f4
push ebx
call edi
test eax, eax
je 0x5db7c0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x6269e4
push ebx
mov dword [0x6658a0], eax
call edi
push eax
call esi
push 0x6269d0
push ebx
mov dword [0x6658a4], eax
call edi
push eax
call esi
push 0x6269b4
push ebx
mov dword [0x6658a8], eax
call edi
push eax
call esi
mov dword [0x6658b0], eax
test eax, eax
je 0x5db718
push 0x62699c
push ebx
call edi
push eax
call esi
mov dword [0x6658ac], eax
mov eax, dword [0x6658ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5db771
cmp dword [0x6658b0], ecx
je 0x5db771
push eax
call esi
push dword [0x6658b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5db771
test ebx, ebx
je 0x5db771
call edi
test eax, eax
je 0x5db768
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5db768
test byte [ebp - 8], 1
jne 0x5db771
or dword [ebp + 0x10], 0x200000
jmp 0x5db7a4
mov eax, dword [0x6658a4]
cmp eax, dword [ebp - 0x18]
je 0x5db7a4
push eax
call esi
test eax, eax
je 0x5db7a4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5db7a4
mov eax, dword [0x6658a8]
cmp eax, dword [ebp - 0x18]
je 0x5db7a4
push eax
call esi
test eax, eax
je 0x5db7a4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6658a0]
call esi
test eax, eax
je 0x5db7c0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5db7c2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bdb17
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx