joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462e15
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x5034ce
call fcn.004e43cd
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CGeneralPage.0
lea ecx, [esi + 0xe60]
mov dword [ebp - 4], 0x2b
call fcn.0043434b
lea ecx, [esi + 0xe54]
mov byte [ebp - 4], 0x2a
mov dword [ecx], vtable.CBrush.0
call fcn.004023a8
lea ecx, [esi + 0xe4c]
mov byte [ebp - 4], 0x29
mov dword [ecx], vtable.CFont.0
call fcn.004023a8
lea ecx, [esi + 0xdf0]
mov byte [ebp - 4], 0x28
call fcn.004aebf5
lea ecx, [esi + 0xd9c]
mov byte [ebp - 4], 0x27
call fcn.004aebf5
lea ecx, [esi + 0xd3c]
mov byte [ebp - 4], 0x26
call fcn.004d23e4
lea ecx, [esi + 0xc54]
mov byte [ebp - 4], 0x25
call fcn.00454a64
lea ecx, [esi + 0xb6c]
mov byte [ebp - 4], 0x24
call fcn.00454a64
lea ecx, [esi + 0xa84]
mov byte [ebp - 4], 0x23
call fcn.00454a64
lea ecx, [esi + 0x99c]
mov byte [ebp - 4], 0x22
call fcn.00454a64
mov ecx, dword [esi + 0x980]
push 0x10
pop ebx
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x97c]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x978]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x974]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x970]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x96c]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x968]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x964]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x960]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x95c]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x958]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x954]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x950]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x94c]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x948]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x944]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0x8f0]
mov byte [ebp - 4], 0x11
call fcn.004d23e4
lea ecx, [esi + 0x89c]
mov byte [ebp - 4], bl
call fcn.004d23e4
lea ecx, [esi + 0x7b8]
mov byte [ebp - 4], 0xf
call fcn.0045473d
lea ecx, [esi + 0x6d4]
mov byte [ebp - 4], 0xe
call fcn.0045473d
lea ecx, [esi + 0x5f0]
mov byte [ebp - 4], 0xd
call fcn.0045473d
lea ecx, [esi + 0x50c]
mov byte [ebp - 4], 0xc
call fcn.0045473d
lea ecx, [esi + 0x428]
mov byte [ebp - 4], 0xb
call fcn.0045473d
lea ecx, [esi + 0x3d4]
mov byte [ebp - 4], 0xa
call fcn.0044f927
lea ecx, [esi + 0x380]
mov byte [ebp - 4], 9
call fcn.0044f927
lea ecx, [esi + 0x32c]
mov byte [ebp - 4], 8
call fcn.0044f927
lea ecx, [esi + 0x2d8]
mov byte [ebp - 4], 7
call fcn.0044f927
mov byte [ebp - 4], 6
lea ecx, [esi + 0x284]
call fcn.0044f927
lea ecx, [esi + 0x230]
mov byte [ebp - 4], 5
call fcn.0044f927
lea ecx, [esi + 0x1dc]
mov byte [ebp - 4], 4
call fcn.0044f927
lea ecx, [esi + 0x188]
mov byte [ebp - 4], 3
call fcn.0044f927
lea ecx, [esi + 0x134]
mov byte [ebp - 4], 2
call fcn.0044f927
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], 1
call fcn.0044f927
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 0
call fcn.0044f927
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004d92ba
call fcn.004e44a5
ret
Function at 0x46d4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x504adb
call fcn.004e43cd
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CMiscPage.0
lea ecx, [esi + 0xf60]
mov dword [ebp - 4], 0x28
call fcn.0043434b
mov ecx, dword [esi + 0xf58]
push 0x10
pop ebx
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0xe74]
mov byte [ebp - 4], 0x26
call fcn.0045473d
lea ecx, [esi + 0xe20]
mov byte [ebp - 4], 0x25
call fcn.0044f927
mov ecx, dword [esi + 0xe1c]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0xdc8]
mov byte [ebp - 4], 0x23
call fcn.004aeb7d
mov ecx, dword [esi + 0xdc4]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0xd70]
mov byte [ebp - 4], 0x21
call fcn.0044f927
mov ecx, dword [esi + 0xd6c]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0xc84]
mov byte [ebp - 4], 0x1f
call fcn.00454a64
lea ecx, [esi + 0xc20]
mov byte [ebp - 4], 0x1e
call fcn.004d23e4
mov ecx, dword [esi + 0xc1c]
sub ecx, ebx
call fcn.00401285
mov byte [ebp - 4], 0x1c
lea ecx, [esi + 0xbc8]
call fcn.0044f927
lea ecx, [esi + 0xb70]
mov byte [ebp - 4], 0x1b
call fcn.0044f927
lea ecx, [esi + 0xb1c]
mov byte [ebp - 4], 0x1a
call fcn.0044f927
lea ecx, [esi + 0xac8]
mov byte [ebp - 4], 0x19
call fcn.004aebf5
lea ecx, [esi + 0xa74]
mov byte [ebp - 4], 0x18
call fcn.004aebf5
lea ecx, [esi + 0x98c]
mov byte [ebp - 4], 0x17
call fcn.00454a64
lea ecx, [esi + 0x8a4]
mov byte [ebp - 4], 0x16
call fcn.00454a64
lea ecx, [esi + 0x7bc]
mov byte [ebp - 4], 0x15
call fcn.00454a64
lea ecx, [esi + 0x6d4]
mov byte [ebp - 4], 0x14
call fcn.00454a64
lea ecx, [esi + 0x5ec]
mov byte [ebp - 4], 0x13
call fcn.00454a64
lea ecx, [esi + 0x504]
mov byte [ebp - 4], 0x12
call fcn.00454a64
lea ecx, [esi + 0x4fc]
mov byte [ebp - 4], 0x11
mov dword [ecx], vtable.CBrush.0
call fcn.004023a8
lea ecx, [esi + 0x48c]
mov byte [ebp - 4], bl
call fcn.004aebf5
lea ecx, [esi + 0x438]
mov byte [ebp - 4], 0xf
call fcn.004aebf5
lea ecx, [esi + 0x3e4]
mov byte [ebp - 4], 0xe
call fcn.004aebf5
lea ecx, [esi + 0x390]
mov byte [ebp - 4], 0xd
call fcn.004aebf5
lea ecx, [esi + 0x33c]
mov byte [ebp - 4], 0xc
call fcn.004aebf5
lea ecx, [esi + 0x2e8]
mov byte [ebp - 4], 0xb
call fcn.004aebf5
lea ecx, [esi + 0x294]
mov byte [ebp - 4], 0xa
call fcn.004aebf5
lea ecx, [esi + 0x23c]
mov byte [ebp - 4], 9
call fcn.004aebf5
mov ecx, dword [esi + 0x234]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0x1e0]
mov byte [ebp - 4], 7
call fcn.0044f927
mov ecx, dword [esi + 0x1dc]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0x17c]
mov byte [ebp - 4], 5
call fcn.0044fb0d
mov ecx, dword [esi + 0x178]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x174]
sub ecx, ebx
call fcn.00401285
mov ecx, dword [esi + 0x170]
sub ecx, ebx
call fcn.00401285
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 1
call fcn.0045473d
mov ecx, dword [esi + 0x88]
sub ecx, ebx
call fcn.00401285
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004d92ba
call fcn.004e44a5
ret
Function at 0x477a5a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x50650c
call fcn.004e43cd
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
push 0x128
call fcn.004793f7
and dword [ebp - 4], 0
lea ecx, [esi + 0x94]
mov dword [esi], vtable.CCompanyProfile.0
call fcn.0044facc
mov edi, 0x510f7c
push edi
lea ecx, [esi + 0xf4]
mov byte [ebp - 4], 1
call fcn.004018fe
push edi
lea ecx, [esi + 0xf8]
mov byte [ebp - 4], 2
call fcn.004018fe
push edi
lea ecx, [esi + 0xfc]
mov byte [ebp - 4], 3
call fcn.004018fe
push edi
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 4
call fcn.004018fe
push edi
lea ecx, [esi + 0x104]
mov byte [ebp - 4], 5
call fcn.004018fe
push edi
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 6
call fcn.004018fe
push edi
lea ecx, [esi + 0x10c]
mov byte [ebp - 4], 7
call fcn.004018fe
push edi
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 8
call fcn.004018fe
push edi
lea ecx, [esi + 0x114]
mov byte [ebp - 4], 9
call fcn.004018fe
lea ecx, [esi + 0x118]
call fcn.0042a380
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 0xb
call fcn.0044f967
lea ecx, [esi + 0x170]
mov byte [ebp - 4], 0xc
call fcn.0044f967
lea ecx, [esi + 0x1c4]
mov byte [ebp - 4], 0xd
call fcn.0044f967
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xe
call fcn.0044f967
lea ecx, [esi + 0x26c]
mov byte [ebp - 4], 0xf
call fcn.0044f967
lea ecx, [esi + 0x2c0]
mov byte [ebp - 4], 0x10
call fcn.0044f967
lea ecx, [esi + 0x314]
mov byte [ebp - 4], 0x11
call fcn.0044f967
lea ecx, [esi + 0x368]
mov byte [ebp - 4], 0x12
call fcn.0044f967
lea ecx, [esi + 0x3bc]
mov byte [ebp - 4], 0x13
call fcn.0044f967
lea ecx, [esi + 0x410]
mov byte [ebp - 4], 0x14
call fcn.0044f967
push edi
lea ecx, [esi + 0x464]
mov byte [ebp - 4], 0x15
call fcn.004018fe
lea ecx, [esi + 0x468]
mov byte [ebp - 4], 0x16
call fcn.004b0598
mov ebx, vtable.CButton.0
mov dword [esi + 0x468], ebx
lea ecx, [esi + 0x4bc]
mov byte [ebp - 4], 0x17
call fcn.004b0598
mov dword [esi + 0x4bc], ebx
lea ecx, [esi + 0x510]
mov byte [ebp - 4], 0x18
call fcn.004549cb
lea ecx, [esi + 0x5f8]
mov byte [ebp - 4], 0x19
call fcn.004549cb
lea ecx, [esi + 0x6e0]
mov byte [ebp - 4], 0x1a
call fcn.0044f967
push edi
lea ecx, [esi + 0x734]
mov byte [ebp - 4], 0x1b
call fcn.004018fe
lea ecx, [esi + 0x738]
mov byte [ebp - 4], 0x1c
call fcn.0044f967
push edi
lea ecx, [esi + 0x78c]
mov byte [ebp - 4], 0x1d
call fcn.004018fe
lea ecx, [esi + 0x790]
mov byte [ebp - 4], 0x1e
call fcn.0044f967
push edi
lea ecx, [esi + 0x7e4]
mov byte [ebp - 4], 0x1f
call fcn.004018fe
lea ecx, [esi + 0x7ec]
mov byte [ebp - 4], 0x20
call fcn.004549cb
lea ebx, [esi + 0x8d4]
mov ecx, ebx
call fcn.0042a380
lea eax, [esi + 0x8d8]
and dword [eax + 4], 0
mov dword [eax], vtable.CBrush.0
mov byte [ebp - 4], 0x23
lea ecx, [esi + 0x8e0]
call fcn.004549cb
lea ecx, [esi + 0x9c8]
mov byte [ebp - 4], 0x24
call fcn.00454689
push edi
lea ecx, [esi + 0xaac]
mov byte [ebp - 4], 0x25
call fcn.004018fe
push edi
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0x26
call fcn.004018c7
and dword [esi + 0x7e8], 0
push edi
mov ecx, ebx
call fcn.004018c7
mov eax, esi
call fcn.004e44a5
ret
Function at 0x4aea4e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004ba334
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4aea87
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004ae69f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4aeae5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4aeb09
cmp dword [edi + 0x54], 0
jne 0x4aeb09
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004ba334
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004aeaa6
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b50b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4b50fc
call fcn.004ba334
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4b50fc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4b5118
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004b4c2f
mov esi, eax
test edi, edi
je 0x4b5116
test ebx, ebx
je 0x4b5116
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4b5c04
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x50ab52
call fcn.004e43cd
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4b5c29
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4b5c6f
lea ecx, [ebp - 0x10]
call fcn.0042a380
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b580a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401285
mov eax, esi
call fcn.004e44a5
ret 8
Function at 0x4c1352
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
mov ecx, esi
test al, 1
je 0x4c1376
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x4c1384
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x4c1370
xor eax, eax
inc eax
pop esi
ret
Function at 0x4d9408
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4d9420
mov edi, dword [esi + 0xc]
jmp 0x4d9460
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4d9439
call fcn.004b6051
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4d944e
call fcn.004b6051
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4d9460
call fcn.004b6051
call fcn.004ba334
cmp dword [eax + 0x3c], 0
je 0x4d9475
push edi
mov ecx, ebx
call fcn.004d827d
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004d932e
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4d9493
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d949f
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4d9aaf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.004ba334
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x4d9ac9
xor eax, eax
jmp 0x4d9b12
push ebx
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x4d9b11
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004d9a4d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x4db486
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x50e657
call fcn.004e43cd
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004018fe
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4db4e8
call fcn.004b9c0e
cmp eax, 1
jne 0x4db4e8
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.004048c3
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401bc7
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401285
mov dword [ebp + 8], reloc.ODBC32.dll_SQLAllocConnect
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401285
mov eax, esi
call fcn.004e44a5
ret 0x10
Function at 0x4db511
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x50e657
call fcn.004e43cd
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004018fe
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4db573
call fcn.004b9c0e
cmp eax, 1
jne 0x4db573
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.004048c3
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401bc7
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401285
mov dword [ebp + 8], reloc.ODBC32.dll_SQLAllocConnect
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401285
mov eax, esi
call fcn.004e44a5
ret 0x14

Function at 0x4e43be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x551bc0]
jne 0x4e43c8
repz ret
jmp fcn.004ebf5c

Function at 0x4f10f7
Capabilities:
Encode data using xor

Disassembly:
call fcn.004eab6e
xchg edx, eax
and edi, ecx
xchg edi, edx
shl ebx, 0xa
test dword [0x550837], 0x55d28ee8
jno 0x4f10c9
xor eax, 0x1b628bec
sub dword [0x55779b], eax
inc edi
and ecx, edi
xchg edi, eax
shr ecx, 0x18
call fcn.004f8184
or esi, 0x6654e100
mov dword [0x5577ad], edx
mov ecx, 0x30c8891d
xchg edi, eax
xor eax, dword [0x54f34b]
shl esi, 4
add al, 0x33
sbb eax, 0x552bc3
call fcn.004eab6e
and dword [0x5578df], edi
sub esi, 0x43f15877
shl ebx, 0x1e
xor eax, 0x448938a0
call fcn.004bfe17
neg edi
mov dword [0x557a76], edi
dec edx
xor dword [0x557957], ecx
dec ecx
jne 0x4f10ed
test edi, 0x3462c51b
je 0x4f113b
ror ebx, 0x16
mov ecx, 0x4c98be83
Function at 0x4f4c5f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004eb89c
and dword [ebp - 4], 0
cmp dword [0x556558], 0
mov ebx, eax
jne 0x4f4d10
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4f4dc1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x531b50
push edi
call esi
test eax, eax
je 0x4f4dc1
push eax
call fcn.004eb82a
mov dword [esp], 0x531b40
push edi
mov dword [0x556558], eax
call esi
push eax
call fcn.004eb82a
mov dword [esp], 0x531b2c
push edi
mov dword [0x55655c], eax
call esi
push eax
call fcn.004eb82a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x556560], eax
call esi
push eax
call fcn.004eb82a
pop ecx
mov dword [0x556568], eax
test eax, eax
je 0x4f4d10
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004eb82a
pop ecx
mov dword [0x556564], eax
mov eax, dword [0x556564]
cmp eax, ebx
je 0x4f4d68
cmp dword [0x556568], ebx
je 0x4f4d68
push eax
call fcn.004eb8a5
push dword [0x556568]
mov esi, eax
call fcn.004eb8a5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4f4d68
test edi, edi
je 0x4f4d68
call esi
test eax, eax
je 0x4f4d5f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4f4d5f
test byte [ebp - 0xc], 1
jne 0x4f4d68
or dword [ebp + 0x10], 0x200000
jmp 0x4f4da1
mov eax, dword [0x55655c]
cmp eax, ebx
je 0x4f4da1
push eax
call fcn.004eb8a5
pop ecx
test eax, eax
je 0x4f4da1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4f4da1
mov eax, dword [0x556560]
cmp eax, ebx
je 0x4f4da1
push eax
call fcn.004eb8a5
pop ecx
test eax, eax
je 0x4f4da1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x556558]
call fcn.004eb8a5
pop ecx
test eax, eax
je 0x4f4dc1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4f4dc3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411ebc
Capabilities:
Encode data using xor

Disassembly:
jae 0x411e4a
movsx eax, si
imul edi, ecx
mov esi, ebp
push 0xd9daa6
mov al, ch
lea ebp, [0x530cd90a]
mov ch, ch
lea edx, [0xfd530fcc]
test eax, esi
jae 0x411e68
sbb bh, ch
xchg ecx, edi
sbb ah, 0x45
xchg ebp, ebx
add eax, 0xcc4366a7
xor esi, eax
mov edx, ebx
and eax, eax
mov ch, 0xef
lea ebp, [0xc6ce5399]
lea esi, [0xebeb521c]
xchg ecx, edi
mov bl, al
sbb ebp, 0x9c8c2081
mov ecx, 0xf78273e5
xchg ah, bh
mov bh, 0x11
mov bh, cl
call 0x411ebc
sbb eax, esi
dec ah
je 0x411eab
inc edi
mov esi, eax
add ebp, 0xf42f
mov cl, 0x92
sub ebp, 0x7398
push 0
pop edi
test dl, 0x65
lea esi, [0x803eeaca]
inc eax
imul ecx, ebx
test ch, dl
add esi, eax
xor al, 0xae
inc ecx
add edi, 0xfff1f27d
test dl, cl
mov ebx, ebp
add edi, 0xe0d84
mov ebp, 0x134e2ec9
add dh, 0x3c
movsx ebx, dx
dec ebx
test cl, bh
test edi, ecx
mov ebx, esi
cmp edi, 0x2c5
jl 0x411ebf
pop ebp
or bl, al
mov eax, 0xfeab94f5
dec cl
test cl, cl
dec eax
sub al, dh
mov ebx, edi
cmp al, 0xe5
push ebx
test ebx, 0xbc7968e
imul eax, edx, 0x67182b1c
inc eax
imul esi, ebx
mov al, 0xb5
adc eax, edi
mov bh, dh
inc esi
imul ebx, esi, 0x2f2fe981
imul eax, ebx, 0x905f5555
test ch, bl
and ah, ch
sbb esi, esi
mov edx, eax
mov bh, al
mov edi, 0xfff1cd6c
js 0x411f58
imul ecx, edi, 0x3b0600fb
test cl, bl
sub edi, 0x7949
sub edi, 0x7949
jbe 0x411f65
cmp eax, 0xb994455
add ebp, edi
xchg al, cl
add ebp, 0xeddc3
mov ecx, eax
imul edx, eax
imul ecx, ebp
mov edi, 0xccec59ba
dec ecx
add ebx, edi
mov dl, 0x52
dec eax
push ebp
or edx, edi
imul ecx, ecx
mov ah, 0x87
ret
Function at 0xa6d370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xa6d38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xa96074
push ecx
mov edi, eax
call fcn.00a81198
mov esi, eax
add esp, 8
test esi, esi
jne 0xa6d3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00a8102e
push esi
call fcn.00a80fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xa70850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xa708ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xa9b720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa708ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00a811e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xa708ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xa9b720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa7092a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00a82082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xa70957
mov word [eax], si
add eax, 2
push eax
call fcn.00a82030
add esp, 4
jmp 0xa70959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xa708ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xa708b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xa70ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret