joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483c70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x5656dc
call esi
push 0x56574c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x483c98
call eax
pop esi
add esp, 0x30
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x483d30
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
push 0x565700
push SysReAllocStringLen
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x483d26
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x24], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x483d1b
cmp dword [esp + 0x10], 1
jne 0x483d1b
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
push 0x5656f8
push eax
call dword [sym.imp.MSVCRT.dll_swscanf]
add esp, 0xc
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [esp + 8]
pop esi
add esp, 0x30
ret
push 0x55de58
mov dword [esp + 0xc], 0
call esi
test eax, eax
je 0x483d58
lea edx, [esp + 8]
push edx
push 0x483d70
push 1
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
mov ax, word [esp + 8]
pop esi
add esp, 0x30
ret
Function at 0x489a80
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2090
call fcn.0051e250
mov eax, dword [esp + 0x2098]
push ebx
push esi
push edi
test eax, eax
mov ebx, ecx
jne 0x489b36
mov eax, dword [0x5a1330]
test eax, eax
je 0x489b36
mov ecx, dword [ebx + 0x5c]
add ecx, 0x14f34
call fcn.004096e0
test eax, eax
jne 0x489b36
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x489afd
mov eax, dword [ecx + 0x568c]
test eax, eax
je 0x489afd
mov eax, dword [esp + 0x20a0]
test eax, eax
je 0x489aec
mov ecx, ebx
call fcn.0048cc60
pop edi
pop esi
pop ebx
add esp, 0x2090
ret 8
call fcn.00416e30
pop edi
pop esi
pop ebx
add esp, 0x2090
ret 8
mov eax, dword [esp + 0x20a0]
test eax, eax
je 0x489b1b
mov ecx, ebx
call fcn.0048b8c0
pop edi
pop esi
pop ebx
add esp, 0x2090
ret 8
test ecx, ecx
je 0x489c4e
push 0
call fcn.00416e50
pop edi
pop esi
pop ebx
add esp, 0x2090
ret 8
mov ecx, dword [ebx + 0x5c]
add ecx, 0x14f34
call fcn.00407c40
mov edx, eax
test edx, edx
je 0x489c4e
cmp word [edx], 0
je 0x489c4e
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push 0x53d4a4
lea eax, [esp + 0x14]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea ecx, [esp + 0x1c]
push ecx
call fcn.004bfa80
add esp, 0x14
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov si, ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1056]
mov word [esp + 0x1054], 0
lea edx, [esp + 0x1054]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x823
lea eax, [esp + 0x10]
shr esi, 8
push edx
push eax
and esi, 0xff
call fcn.004d9960
add esp, 0xc
cmp word [esp + 0x1054], 0
je 0x489c01
lea ecx, [esp + 0x1054]
push ecx
mov ecx, ebx
call fcn.00488040
pop edi
pop esi
pop ebx
add esp, 0x2090
ret 8
test esi, esi
jne 0x489c1d
mov eax, dword [esp + 0x20a0]
test eax, eax
jne 0x489c1d
mov eax, dword [0x5a48b0]
test eax, eax
jne 0x489c1d
xor eax, eax
jmp 0x489c22
mov eax, 1
mov edx, dword [0x58be58]
mov edi, dword [esp + 0x20a4]
push edx
push 0
push 0
push eax
xor eax, eax
push 0
test edi, edi
setne al
inc eax
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
mov ecx, ebx
call fcn.00488630
pop edi
pop esi
pop ebx
add esp, 0x2090
ret 8
Function at 0x48d4a0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
add eax, 0xffff9ff0
push esi
cmp eax, 4
mov esi, ecx
ja case.0x48d4bb.24595
jmp dword [eax*4 + 0x48d5b0]
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x48d4e7
mov edx, dword [eax + 0x24]
lea ecx, [eax + 0x24]
call dword [edx + 0x50]
test eax, eax
je 0x48d4e7
mov ecx, esi
call fcn.0048d1c0
pop esi
add esp, 0x208
ret 4
mov ecx, esi
call fcn.0048d220
pop esi
add esp, 0x208
ret 4
mov eax, dword [esi + 4]
push 0
push 0
push 0x5403
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
add esp, 0x208
ret 4
mov cx, word [0x5711d0]
push edi
mov word [esp + 8], cx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x59122c]
push 0x565968
lea edx, [esp + 0xc]
push 0x103
push edx
push eax
call fcn.0043f720
lea ecx, [esp + 0x18]
push ecx
call fcn.00451da0
add esp, 0x14
test eax, eax
pop edi
je case.0x48d4bb.24595
push 5
push 0
lea edx, [esp + 0xc]
push 0x565954
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
add esp, 0x208
ret 4
mov eax, dword [0x58be58]
push eax
push 0
push 1
push 1
push 1
push 1
push 0
push 0xab
call fcn.0049c120
add esp, 4
mov ecx, esi
push eax
call fcn.00488630
pop esi
add esp, 0x208
ret 4

Function at 0x48d5d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push 0x564fd0
push SysReAllocStringLen
xor esi, esi
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x48d619
lea ecx, [esp + 4]
push ecx
push 0x564fd0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x48d619
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 4]
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0
push 0x565984
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48d656
mov eax, dword [esp + 8]
xor edx, edx
cmp eax, 1
sete dl
xor ecx, ecx
mov esi, edx
test eax, eax
sete cl
mov dword [esp + 8], ecx
jmp 0x48d65e
mov dword [esp + 8], 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48d67a
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push 4
push 0
push 0x565984
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00477f70
push 0xffffffffffffffff
push 0
push 1
push 8
push 0x207
call fcn.0041d540
mov ecx, eax
call fcn.0041dc40
mov eax, esi
pop esi
add esp, 0xc
ret 4
Function at 0x48d810
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa2c
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
mov ebp, dword [sym.imp.USER32.dll_LoadStringW]
rep stosd dword es:[edi], eax
mov ecx, dword [0x591228]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x220]
push eax
push 0x1c
push ecx
call ebp
mov eax, dword [0x591228]
lea edx, [esp + 0x424]
push 0x104
push edx
push 0x14
push eax
call ebp
lea ecx, [esp + 0x21c]
push ecx
call fcn.0043fd40
mov eax, dword [esp + 0xa44]
lea edx, [esp + 0x18]
push 0x104
push edx
push eax
call fcn.00440190
push 0
push 0
push 0x80802
lea ecx, [esp + 0x30]
push 0x5659a8
lea edx, [esp + 0x23c]
push ecx
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x448]
push edx
mov edx, dword [0x59122c]
push eax
push ecx
push edx
call fcn.0043fef0
add esp, 0x34
test eax, eax
je 0x48d9c1
lea eax, [esp + 0x14]
push 0x55d14c
push eax
xor edi, edi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x48d986
push esi
push 1
lea ecx, [esp + 0x18]
push 2
push ecx
mov dword [esp + 0x20], 0xfeff
call dword [sym.imp.MSVCRT.dll_fwrite]
mov edx, dword [esp + 0xa50]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_fputws]
add esp, 0x18
cmp eax, 0xffffffff
je 0x48d91c
mov edi, 1
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
test edi, edi
je 0x48d986
lea eax, [esp + 0x14]
push eax
push 0x18
call fcn.0049c120
add esp, 4
lea ecx, [esp + 0x630]
push eax
push 0x208
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [ebx + 0x60]
add esp, 0x10
mov word [esp + 0xa3a], 0
mov edx, dword [eax + 0xef0]
lea ecx, [eax + 0xef0]
lea eax, [esp + 0x62c]
push 0x7d0
push eax
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 4
cmp word [0x57188c], 0
jne 0x48d9a5
mov ecx, dword [0x591228]
push 0x104
push 0x57188c
push 0x32
push ecx
call ebp
push 0x10
push 0x57188c
push 0x1d
call fcn.0049c120
mov edx, dword [ebx + 4]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 4
Function at 0x48def0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.004192f0
test esi, esi
je 0x48df19
mov eax, dword [esi + 0x560c]
cmp eax, 0xffffffff
je 0x48df19
mov ecx, dword [edi + 0x58]
push 1
push eax
call fcn.0050e700
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00416400
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00416420
push 0
mov ecx, esi
call fcn.0041c3e0
push 0
mov ecx, esi
call fcn.00417000
mov ecx, dword [edi + 0x58]
push 0
call fcn.0050e080
test eax, eax
jne 0x48df9e
cmp dword [0x5c29d8], 1
jne 0x48df82
mov ecx, dword [edi + 0x5c]
test ecx, ecx
je 0x48df9e
mov edx, dword [ecx]
call dword [edx + 0x20]
test eax, eax
je 0x48df9e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 0x14
mov eax, dword [0x58be58]
push 0
push 0
push 0
push 1
push eax
push 0
push str.se:blank
mov ecx, edi
call fcn.00485630
pop edi
pop esi
ret 0x14

Function at 0x48e0e0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1250
call fcn.0051e250
mov ax, word [0x5711d0]
push ebx
push esi
mov ebx, ecx
push edi
mov word [esp + 0x214], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x216]
push 0x8e
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.0049c120
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
push 0x53d4a4
lea ecx, [esp + 0x220]
push 0x823
push ecx
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], 0
rep stosd dword es:[edi], eax
push 0x5659f0
push 0x57147c
push 0x53dc6c
lea edx, [esp + 0x2c]
push 0x103
push edx
stosw word es:[edi], ax
call esi
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0043f710
add esp, 0x30
test eax, eax
je 0x48e197
push 5
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
add esp, 0x1250
ret
mov edx, dword [ebx + 4]
push 0
push 0
push 0
push 0x6401
push edx
push 0x2710
push 0
push 0
push 1
push 0x5711d0
lea eax, [esp + 0x23c]
push 0
push eax
call fcn.004792b0
add esp, 0x30
pop edi
pop esi
pop ebx
add esp, 0x1250
ret
Function at 0x48f1c0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x2c
mov eax, dword [0x58be54]
push ebp
push esi
mov esi, ecx
test eax, eax
push edi
mov dword [esp + 0x10], esi
je 0x48f361
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x48f1f2
mov eax, dword [esi + 0x64]
test eax, eax
mov dword [esp + 0x3c], eax
je 0x48f361
mov edi, eax
cmp dword [edi + 0x50], 2
jbe 0x48f361
mov ebp, dword [esp + 0x40]
mov dword [esp + 0xc], 0
test ebp, ebp
jne 0x48f228
mov eax, dword [esi + 4]
mov dword [esp + 0xc], 1
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
test ebp, ebp
je 0x48f361
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ebx
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
push ebp
mov dword [esp + 0x48], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x1c]
push 6
push edx
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_FillRect]
mov edi, dword [edi + 0x562c]
test edi, edi
jne 0x48f28e
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x48f28e
call fcn.0041ce90
mov edi, eax
mov eax, dword [0x5c29e0]
test eax, eax
je 0x48f2ea
test edi, edi
je 0x48f2ea
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48f2ea
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x48f2e6
lea ecx, [esp + 0x2c]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push 0xcc0020
push 0
push 0
push ebx
push edx
push eax
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x48f304
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.0048f400
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0xcc0020
push 0
push 0
push esi
push eax
push ecx
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x48f333
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
test ebx, ebx
je 0x48f33e
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
test esi, esi
pop ebx
je 0x48f34a
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48f361
mov edx, dword [esp + 0x10]
push ebp
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 8
Function at 0x4929c0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
push ebp
lea ebx, [esi + 0x3ab0]
push 0x53d4a4
push 0x103
push ebx
mov dword [esi + 0x3ec0], eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push ebp
lea edi, [esi + 0x3cb8]
push 0x53d4a4
push 0x103
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x20
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 1
push edi
call fcn.0043f890
add esp, 8
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x492a42
push edi
call ebx
test eax, eax
je 0x492a42
mov ecx, esi
call fcn.00492930
mov ecx, esi
call fcn.00492c20
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x493980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004935d0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0x17
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
xor ebp, ebp
cmp ebx, ebp
je 0x493a20
mov edx, dword [esi + 0xc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebp
je 0x493a19
mov eax, dword [esi + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x493a17
mov dword [esi + 0x230], eax
mov dword [esi + 0x22c], ebp
push 0x10
mov byte [esi + 0x224], 0
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x493a0f
lea eax, [edi + 4]
lea ecx, [esi + 0x220]
push eax
push ecx
mov dword [edi], 0x527864
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [edi + 8], eax
jmp 0x493a11
xor edi, edi
mov dword [esi + 0x21c], edi
xor ebp, ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [esi + 0x21c]
mov dword [esi + 0xc], ebp
cmp edi, ebp
mov word [esi + 0x10], bp
je 0x493a88
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebp
je 0x493a4a
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x18]
mov edi, dword [esi + 0x21c]
mov dword [esi + 4], ecx
lea edx, [esp + 0x18]
mov eax, dword [edi + 4]
push edx
push eax
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebp
je 0x493a70
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 8], ecx
mov ecx, dword [esi + 4]
pop edi
cmp ecx, ebp
pop esi
pop ebp
setg al
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x494790
Capabilities:
Write file on windows

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4947c4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp edi, 0xfa000
jae 0x4947d6
mov esi, edi
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4947f8
cmp esi, edi
je 0x494806
sub edi, 0xfa000
add ebx, esi
jmp 0x4947cc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x496c30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x521c81
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test ebp, ebp
je 0x496dfc
mov esi, dword [esp + 0x28]
test esi, esi
je 0x496dfc
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x496dfc
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jbe 0x496dfc
mov eax, dword [ebp + 0x21c]
lea edi, [ebp + 0x21c]
push esi
push eax
lea ebx, [ebp + 0x20c]
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x496ca3
mov esi, dword [ebp + 0x220]
jmp 0x496d15
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, edi
call fcn.00439940
push esi
lea ecx, [esp + 0x24]
call fcn.0043e320
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, ebx
mov dword [esp + 0x20], 0
call fcn.00498ba0
mov esi, dword [eax]
mov eax, dword [esp + 0x20]
mov edx, dword [0x53c120]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x496d0f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x496d0f
mov edx, dword [esp + 0x20]
lea eax, [edx - 0xc]
push eax
call fcn.0051e1fa
add esp, 4
mov dword [ebp + 0x220], esi
cmp esi, dword [ebx + 4]
je 0x496dfc
mov esi, dword [esi + 0x10]
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jae 0x496dfc
mov esi, dword [esi + 4]
test eax, eax
mov esi, dword [esi]
jle 0x496db0
mov ebx, dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
mov edi, dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov ebp, eax
lea ecx, [esp + 0x24]
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [0x588c88]
cmp eax, ecx
mov dword [esp + 0x18], 1
je 0x496d86
lea ecx, [esp + 0x28]
mov esi, eax
call ebx
mov eax, dword [esi]
mov ecx, dword [0x588c88]
cmp eax, ecx
je 0x496d7e
mov esi, eax
mov eax, dword [esi]
cmp eax, ecx
jne 0x496d76
lea ecx, [esp + 0x28]
call edi
jmp 0x496d9f
mov eax, dword [esi + 4]
cmp esi, dword [eax + 8]
jne 0x496d98
mov esi, eax
mov eax, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x496d8e
cmp dword [esi + 8], eax
je 0x496d9f
mov esi, eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call edi
dec ebp
jne 0x496d47
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
push eax
push ecx
mov edx, dword [esi]
push 0x56950c
push edx
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [esi]
push edi
mov word [edi + eax*2 - 2], 0
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dword [esi], eax
add esp, 0x18
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x49a700
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0xc
cmp eax, 3
je 0x49a795
cmp eax, 1
jne 0x49a71a
xor eax, eax
add esp, 0xc
ret
lea eax, [esp]
mov dword [esp + 4], 0
push eax
push 0x20019
push 0
push 0x564fd0
push SysReAllocStringLen
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49a795
mov eax, dword [esp]
test eax, eax
je 0x49a795
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0
push 0x569588
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
jne 0x49a795
xor eax, eax
add esp, 0xc
ret
mov eax, 1
add esp, 0xc
ret

Function at 0x49c060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
and ecx, 0xffff
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x49c0b2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x49c0b2
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x49c0a6
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
pop ebp
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x49c0c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edi
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.0049c060
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x49c0e5
pop edi
ret
mov ecx, dword [esp + 0xc]
push esi
push 0x55d14c
push ecx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x49c118
mov edx, dword [esp + 0x18]
push esi
push 1
push edx
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop esi
mov eax, 1
pop edi
ret