joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488fd0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ce4a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14c
mov eax, dword [0x54fef0]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x15c], 0
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x164]
lea ecx, [esp + 0xc]
push esi
mov byte [esp + 0x160], 1
call fcn.004bf919
push 0x4fd338
lea ecx, [esp + 0x10]
call fcn.004bfb6c
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x489073
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 0
call fcn.004bf7dc
lea ecx, [esp + 8]
mov dword [esp + 0x15c], 0xffffffff
call fcn.004bf7dc
xor eax, eax
jmp 0x4891b8
push ebp
mov ebp, dword [esp + 0x16c]
push edi
mov edi, dword [esp + 0x174]
lea edx, [esp + 0x48]
push 0x4fd334
push edx
call fcn.0049c9d4
add esp, 8
test eax, eax
je 0x489169
lea eax, [esp + 0x48]
push 0x4fd330
push eax
call fcn.0049c9d4
add esp, 8
test eax, eax
je 0x489169
test ebp, ebp
jne 0x4890d5
lea ecx, [esp + 0x48]
push str.desktop.ini
push ecx
call fcn.0049ca83
add esp, 8
test eax, eax
je 0x489169
push esi
lea ecx, [esp + 0x14]
call fcn.004bf919
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004bfb93
lea edx, [esp + 0x48]
lea ecx, [esp + 0x10]
push edx
call fcn.004bfb6c
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x489115
mov ecx, dword [esp + 0x10]
and al, 0xfe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test byte [esp + 0x1c], 0x10
je 0x489137
mov edx, dword [esp + 0x10]
push edi
push ebp
push edx
mov ecx, ebx
call fcn.00488fd0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x489169
test edi, edi
je 0x48915e
lea ecx, [esp + 0x48]
push str.index.dat
push ecx
call fcn.0049ca83
add esp, 8
test eax, eax
jne 0x48915e
lea edx, [esp + 0x48]
mov ecx, ebx
push edx
push esi
call fcn.004891e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x489083
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov byte [esp + 0x164], 0
call fcn.004bf7dc
lea ecx, [esp + 0x10]
mov dword [esp + 0x164], 0xffffffff
call fcn.004bf7dc
pop edi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x154]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x158
ret 0xc
Function at 0x4891e0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ce4bb
push eax
mov eax, 0x2718
mov dword fs:[0], esp
call fcn.0049d290
mov eax, dword [0x54fef0]
push edi
mov dword [esp + 4], eax
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 0x2724], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x272c]
push ecx
lea ecx, [esp + 8]
call fcn.004bf919
push 0x5c
lea ecx, [esp + 8]
call fcn.004bfb93
mov edx, dword [esp + 0x2730]
lea ecx, [esp + 4]
push edx
call fcn.004bfb6c
mov eax, dword [esp + 4]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x489286
lea ecx, [esp + 4]
mov dword [esp + 0x2724], eax
call fcn.004bf7dc
xor eax, eax
jmp 0x489303
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
mov esi, eax
push 0x40
push edi
sub esi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jbe 0x4892e1
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x2710
push 0
jbe 0x4892d3
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push 0x2710
push edx
push edi
call ebx
sub esi, 0x2710
jne 0x4892ad
jmp 0x4892e1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov dword [esp + 0x272c], 0xffffffff
call fcn.004bf7dc
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x271c]
pop edi
mov dword fs:[0], ecx
add esp, 0x2724
ret 8
Function at 0x489320
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x24]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
je 0x489450
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
push eax
push 0x40000
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x48943f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push ecx
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x48943f
mov eax, dword [esp + 0x34]
test eax, eax
je 0x48943a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x20019
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x48943f
push eax
push eax
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x34]
push ebp
lea eax, [esp + 0x44]
push edx
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x48943f
push 0x105
call fcn.004bf51d
mov esi, eax
mov eax, dword [esp + 0x30]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x489431
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edx, dword [esp + 0x10]
push 0x105
push esi
push edi
push edx
call ebx
test eax, eax
jne 0x489421
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push 1
push eax
push esi
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00489320
jmp 0x489428
cmp eax, 0x103
je 0x489431
mov eax, dword [esp + 0x2c]
inc edi
cmp edi, eax
jb 0x4893f7
push esi
call fcn.004bf546
add esp, 4
mov ebp, 1
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x489450
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop esi
pop ebp
add esp, 0x14
ret 0x10

Function at 0x48c4e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2180
push 0x49e684
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.0049c9a0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48c690
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x48c6d1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x48c73e
cmp dword [esp + 0x1c], 2
jne 0x48c73e
cmp dword [esp + 0x10], 5
jne 0x48c73e
cmp dword [esp + 0x14], 1
jne 0x48c73e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x48c728
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x48c719
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x48c721
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x48c73e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret

Function at 0x490090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cea38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4900d3
mov eax, dword [esi]
jmp 0x4900d5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x4900f6
push 0x4fe220
push edi
push eax
call fcn.004ab4c1
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x490156
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x490156
mov eax, dword [esi]
test eax, eax
je 0x49013d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x49014d
push eax
call fcn.004bf546
add esp, 4
push esi
call fcn.004bf546
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc

Function at 0x490960
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4909c6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4909c6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4909a7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x490d50
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x490d88
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x491a60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x491aa9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x491f20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ced00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00491ad0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00491b50
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00491b50
lea ecx, [esi + 0xc]
call fcn.004bf767
lea ecx, [esi + 0x10]
call fcn.004bf767
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004930f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004930f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004930f0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004bf7dc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004bf7dc
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x496420
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4cf068
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00496810
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x58f0f4
call fcn.0049e778
mov ecx, dword [0x4e2624]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00493b50
mov esi, 0x4e267c
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4964c7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4964be
cmp al, 0xff
je 0x4964be
dec al
mov byte [ecx], al
jmp 0x4964c7
push ecx
call fcn.004bf546
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004bb700
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x49650d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x496504
cmp al, 0xff
je 0x496504
dec al
mov byte [ecx], al
jmp 0x49650d
push ecx
call fcn.004bf546
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0049e7ff
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x49a3d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x49a491
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x49a43b
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x49a46f
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x49a46f
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x49a3fe
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49a4a0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x49a559
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x49a4f7
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x49a53f
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x4ff0c0]
je 0x49a511
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x49a52c
test al, 0x40
je 0x49a523
mov ecx, dword [ebx + 0x20]
jmp 0x49a52a
test al, 0x80
je 0x49a53f
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x49a53f
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x49a4c4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4b5d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d0190
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004aaa3e
mov eax, dword [0x4e5888]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004aa970
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004b6850
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4b5e07
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4b5dfe
cmp al, 0xff
je 0x4b5dfe
dec al
mov byte [ecx], al
jmp 0x4b5e07
push ecx
call fcn.004bf546
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4b5e38
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4b5e2f
cmp al, 0xff
je 0x4b5e2f
dec al
mov byte [ecx], al
jmp 0x4b5e38
push ecx
call fcn.004bf546
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4c1baa
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c1be2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004bfc37
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004bfc0f
jmp 0x4c1bee
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c329b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c32dd
call fcn.004c9058
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c32dd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c32d4
xor eax, eax
jmp 0x4c32e5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c32eb
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c9588
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c95b6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c95d4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c94ee
jmp 0x4c95d4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c95d4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c94ee
test edi, edi
mov eax, edi
jne 0x4c95be
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1002454
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.0100241b
or dword [ebp - 4], 0xffffffff
mov esi, 0x105
push esi
mov dword [ebp - 0x10], esi
call fcn.0100286a
push esi
mov edi, eax
call fcn.0100286a
test edi, edi
pop ecx
pop ecx
mov ebx, eax
je 0x10025ce
test ebx, ebx
je 0x10025c3
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10022bc
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10025c3
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp - 4]
call dword [entry0]
test eax, eax
jne 0x10025c3
cmp dword [ebp - 0xc], 2
jne 0x10024ef
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10025c3
cmp dword [ebp - 0xc], 2
mov eax, ebx
je 0x10024f1
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [ebp - 8], eax
call fcn.01002898
push ebx
call fcn.01002898
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
cmp dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
je 0x1002524
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0x10022f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x1002592
push 0x1002314
push eax
call ebx
test eax, eax
mov dword [ebp - 0x14], eax
je 0x1002592
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100286a
mov edi, eax
test edi, edi
pop ecx
je 0x1002592
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0x10]
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x100258b
push esi
push edi
call dword [ebp - 0x14]
push edi
call fcn.01002898
pop ecx
cmp dword [ebp - 8], 0
je 0x10025d9
push 0x1002330
push dword [ebp - 8]
call ebx
test eax, eax
je 0x10025b4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
test edi, edi
je 0x10025ce
push edi
call fcn.01002898
pop ecx
test ebx, ebx
je 0x10025d9
push ebx
call fcn.01002898
pop ecx
cmp dword [ebp - 4], 0xffffffff
pop edi
pop esi
pop ebx
je 0x10025eb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret 0x10
Function at 0x401760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea ecx, [esp + 4]
call fcn.00401000
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40177f
test al, 0x10
jne 0x40177f
mov eax, 1
ret
xor eax, eax
ret

Function at 0x401990
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x80
lea ecx, [esp + 8]
call fcn.00401000
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 4]
call fcn.00401000
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret

Function at 0x4019c0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push 0xffffffffffffffff
push 0x419228
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x423080]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
mov dword [esp + 4], eax
call fcn.00401000
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401a04
test al, 0x10
je 0x401a16
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00414ff0
mov dword [esp + 0x28], 0
mov eax, dword [eax]
push eax
call fcn.00401a70
add esp, 0x10
lea ecx, [esp + 8]
call fcn.004010a0
push 1
lea ecx, [esp + 0x2c]
call fcn.00401000
push eax
lea ecx, [esp + 0x2c]
call fcn.00401000
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret