joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473208
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x3c], eax
mov eax, 0x79f838
call fcn.0074df70
mov dword [ebp - 0x1c], 4
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00453ca4
add dword [ebp - 0x1c], 2
mov word [ebp - 0x28], 0xc
lea edx, [ebp - 8]
lea eax, [ebp - 8]
call fcn.00453ca4
add dword [ebp - 0x1c], 2
mov dword [ebp - 0x94], 0x44
xor edx, edx
mov dword [ebp - 0x90], edx
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov word [ebp - 0x62], 0
xor eax, eax
mov dword [ebp - 0x8c], eax
xor edx, edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x68], 1
xor ecx, ecx
mov dword [ebp - 0x84], ecx
xor eax, eax
mov dword [ebp - 0x80], eax
xor edx, edx
mov dword [ebp - 0x6c], edx
mov word [ebp - 0x64], 5
mov word [ebp - 0x28], 0x18
lea eax, [ebp - 0x14]
call fcn.00453790
push eax
add dword [ebp - 0x1c], 2
mov edx, 0x793c00
lea eax, [ebp - 0x10]
call fcn.004539c4
add dword [ebp - 0x1c], 2
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
pop ecx
call fcn.00453d6c
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
call fcn.00453790
mov ecx, eax
add dword [ebp - 0x1c], 2
lea edx, [ebp - 8]
pop eax
call fcn.00453d6c
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004537c8
mov word [ebp - 0x28], 0xc
lea ecx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x94]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
call fcn.00453ce0
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x47337f
xor eax, eax
push eax
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 4]
mov edx, 2
call fcn.004537c8
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
jmp 0x473417
push 0x64
push dword [ebp - 0x50]
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
je 0x4733d6
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0xb0]
push ecx
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4733c6
cmp dword [ebp - 0xac], 0x12
je 0x4733d6
lea eax, [ebp - 0xb0]
push eax
call sub.USER32.DLL_TranslateMessage
lea edx, [ebp - 0xb0]
push edx
call sub.USER32.DLL_DispatchMessageA
mov ecx, dword [ebp - 0x3c]
cmp byte [ecx + 0x795], 0
je 0x47337f
jmp 0x4733d6
mov al, 1
push eax
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.004537c8
sub dword [ebp - 0x1c], 2
lea eax, [ebp - 4]
mov edx, 2
call fcn.004537c8
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x481c80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x481df5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.004c2a4c
mov eax, dword [ebp - 0x1c]
call fcn.004816c8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x481cd3
lea eax, [ebp - 0x1c]
mov ecx, 1
mov edx, 1
call fcn.004c3284
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetKey_qqrx20System_UnicodeString
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x481db2
xor eax, eax
push ebp
push 0x481dab
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x481d89
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.004c2b34
mov eax, dword [ebp - 0x44]
dec eax
cmp eax, 0
jl 0x481d89
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
test eax, eax
jne 0x481d80
mov eax, dword [ebp - 0x20]
call fcn.004c2a84
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004c2bb4
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_DeleteKey_qqrx20System_UnicodeString
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x481d36
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481db2
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
mov eax, dword [ebp - 0x28]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 0x1c]
call fcn.004c2a84
push eax
mov dl, byte [ebp - 0x15]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetBaseKey_qqro
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481dfc
lea eax, [ebp - 0x48]
call fcn.004c29e8
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004c29f0
ret

Function at 0x481e04
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_RegDeleteValueW
test eax, eax
sete byte [ebp - 9]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x481ec8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x481f9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x481f7d
lea eax, [ebp - 0x14]
mov ecx, 0x100
xor edx, edx
call fcn.004c2b34
mov eax, dword [ebp - 0x38]
dec eax
test eax, eax
jl 0x481f7d
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x100
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x481f75
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004c2bb4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x481f23
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481fa2
lea eax, [ebp - 0x3c]
call fcn.004c29e8
lea eax, [ebp - 0x14]
call fcn.004c29e8
ret

Function at 0x481fa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482071
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x482053
mov ecx, dword [ebp - 0x28]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004c2b34
mov eax, dword [ebp - 0x2c]
dec eax
test eax, eax
jl 0x482053
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_RegEnumValueW
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.004c2bb4
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x482002
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482078
lea eax, [ebp - 0x38]
call fcn.004c29e8
lea eax, [ebp - 0x14]
call fcn.004c29e8
ret
Function at 0x48207c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.004c0234
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
sete byte [ebp - 0xd]
mov eax, dword [ebp - 0x14]
call fcn.004817bc
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x48260c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4826a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00481750
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
test eax, eax
je 0x482692
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, sym.StartupControl.exe__Registry__SRegSetDataFailed
call fcn.004c54fc
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [sym.StartupControl.exe__Registry_ERegistryException_]
call fcn.004afdd0
call fcn.004c1444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4826af
lea eax, [ebp - 0x1c]
call fcn.004c29e8
ret

Function at 0x4826b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482761
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
je 0x482738
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, sym.StartupControl.exe__Registry__SRegGetDataFailed
call fcn.004c54fc
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [sym.StartupControl.exe__Registry_ERegistryException_]
call fcn.004afdd0
call fcn.004c1444
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.004817bc
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482768
lea eax, [ebp - 0x20]
call fcn.004c29e8
ret
Function at 0x482de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482f0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
xor eax, eax
push ebp
push 0x482ee9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x38]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x482ecd
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00482cb0
pop ecx
mov ecx, dword [ebp - 0x2c]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004c2b34
mov eax, dword [ebp - 0x30]
dec eax
test eax, eax
jl 0x482ecd
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegEnumValueW
test eax, eax
jne 0x482ec5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004c2bb4
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00482cb0
pop ecx
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x482e73
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482ef0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call sym.StartupControl.exe__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
ret
Function at 0x4833b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4834e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call sym.StartupControl.exe__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
xor eax, eax
push ebp
push 0x4834bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x38]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call sym.StartupControl.exe__Registry_TRegistry_GetKeyInfo_qqrr20Registry_TRegKeyInfo
test al, al
je 0x4834a1
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00483260
pop ecx
mov ecx, dword [ebp - 0x2c]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004c2b34
mov eax, dword [ebp - 0x30]
dec eax
test eax, eax
jl 0x4834a1
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegEnumValueW
test eax, eax
jne 0x483499
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004c2a84
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004c2bb4
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00483260
pop ecx
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x483447
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4834c4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call sym.StartupControl.exe__Registry_TRegistry_SetCurrentKey_qqrp6HKEY__
ret
Function at 0x4853a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x7b9e6c
push 0xa
push 0x48543c
mov eax, dword [0x7b9cc8]
push eax
call sub.KERNEL32.DLL_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x4853cc
call fcn.004b1eac
push ebx
mov eax, dword [0x7b9cc8]
push eax
call sub.KERNEL32.DLL_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x4853e3
call fcn.004b1eac
push ebx
call sub.KERNEL32.DLL_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4853f5
call fcn.004b1eac
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x7b9e70], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x7b9e74], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x7b9e78], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x7b9e7c], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x7b9e80], ecx
add edx, dword [eax + 0x14]
mov dword [0x7b9e84], edx
pop esi
pop ebx
ret
Function at 0x49f798
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0049f470
dec esi
jne 0x49f7ba
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4a0994
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x7ba17c
cmp dword [edi], 0
jne 0x4a0a10
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x7ba178]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x7a93ac
mov ecx, 2
call fcn.004bfce0
mov edx, 0x4a096c
lea eax, [esi + 5]
call fcn.004a098c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004a098c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4a09e5
mov dword [0x7ba178], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4aa130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4aa1d9
test eax, edx
je 0x4aa1dc
push 0
push 0
cmp word [eax - 0xa], 2
je 0x4aa159
push edx
mov edx, eax
mov eax, esp
call fcn.004c2c24
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x4aa16f
push eax
lea eax, [esp + 8]
call fcn.004c2c24
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4aa17e
movzx eax, word [eax]
sub eax, ecx
jmp 0x4aa1a5
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4aa1bf
add ecx, 4
js 0x4aa196
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x4aa1bc
push eax
mov eax, ecx
mov edx, 2
call fcn.004c1bc0
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4aa1a3
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4aa1a5
xor eax, eax
ret
test eax, eax
je 0x4aa1ec
test edx, edx
jne 0x4aa140
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4ab478
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4ab496
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x4ab4b7
cmp ebx, 3
je 0x4ab4b7
cmp ebx, 0x7b
je 0x4ab4b7
mov eax, esi
call fcn.004ab438
test al, al
jne 0x4ab4bb
xor eax, eax
jmp 0x4ab4bd
mov al, 1
pop esi
pop ebx
ret
Function at 0x4ab4c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4ab4d9
test al, 0x10
jne 0x4ab4dd
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4ab5f8
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004c2a84
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
pop ebx
ret

Function at 0x4af458
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x4af491
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004c2b34
jmp 0x4af49a
mov eax, ebx
mov edx, esi
call fcn.004c29f8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4af4a4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x4af4c6
movzx eax, word [esp]
jmp 0x4af4c8
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4afc50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4afd75
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004afa64
mov esi, eax
mov eax, dword [0x7b956c]
cmp byte [eax], 0
je 0x4afd1d
mov eax, dword [0x7b9570]
call fcn.004c0114
call fcn.004bfc58
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4afc2c]
call fcn.004c467c
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4afd90
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x4afd59
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x7b93e8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x7b9cc8]
call fcn.004c4884
push eax
call sub.USER32.DLL_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.USER32.DLL_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afd7c
lea eax, [ebp - 4]
mov edx, dword [0x4afc2c]
call fcn.004c479c
ret