joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee148
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x52a4f9
call fcn.004da3b8
sub esp, 0x9c
mov eax, dword [0x566450]
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa8], esi
call fcn.004f5c38
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFileDialog.0
call fcn.00401fad
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
jne 0x4ee1d9
mov edi, 0x94
push edi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.004dc410
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x4ee1d2
cmp dword [ebp - 0xa0], 5
mov dword [ebp + 0x20], 0x58
jae 0x4ee1d9
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.004dbe89
cmp eax, ebx
pop ecx
mov dword [esi + 0x70], eax
jne 0x4ee1ee
call fcn.004edbf5
push dword [ebp + 0x20]
push ebx
push eax
call fcn.004dc410
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x74], eax
add esp, 0xc
neg eax
sbb eax, eax
add eax, 0x7005
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x1c0], ebx
lea ecx, [esi + 0x7c]
mov byte [ecx], bl
lea edi, [esi + 0xbc]
mov byte [edi], bl
mov dword [eax], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0x104
mov eax, dword [esi + 0x70]
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x70]
push 0x40
pop ecx
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x70]
or edx, 0x80020
or dword [eax + 0x34], edx
test byte [ebp + 0x14], cl
je 0x4ee26b
mov eax, dword [esi + 0x70]
and byte [eax + 0x36], 0x7f
call fcn.0050bec1
cmp dword [ebp + 0x10], ebx
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x44], 0x4ee978
je 0x4ee297
push 0x104
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp + 0x18], ebx
je 0x4ee2cd
push dword [ebp + 0x18]
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.00402e4c
push ebx
mov ecx, edi
call fcn.00401fcb
jmp 0x4ee2b6
mov byte [eax], bl
inc eax
push 0x7c
push eax
call fcn.004de683
cmp eax, ebx
pop ecx
pop ecx
jne 0x4ee2b3
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004da561
leave
ret 0x1c

Function at 0x4f2cd4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x4f2d0d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004cb898
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004bd470
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x4f4026
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4f4069
call fcn.0050bec1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4f4069
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4f4084
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004f318b
test ebx, ebx
mov esi, eax
je 0x4f4082
test edi, edi
je 0x4f4082
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4f49c5
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x528f7e
call fcn.004da3b8
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x4f49ea
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4f4a36
call fcn.004f5862
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a56
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4f5fe3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x4f601a
call fcn.0050bec1
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f602b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x4f6064
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x4f6049
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x4f6051
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x4f6062
test ax, ax
jne 0x4f6062
test si, si
je 0x4f6064
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x4f6073
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4f62d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x529201
call fcn.004da3b8
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.0050bec1
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x4f6313
call fcn.0050bec1
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4f6324
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4f6330
or eax, 0xffffffff
jmp 0x4f6433
mov ecx, esi
call fcn.004f5e05
mov dword [ebp - 0x14], eax
call fcn.004f2062
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x4f6373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x4f6373
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4f6373
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.004f36ba
push dword [ebp - 0x14]
call fcn.004f1fba
push edi
push eax
push ebx
mov ecx, esi
call fcn.004f60b8
xor ebx, ebx
cmp eax, ebx
je 0x4f63e7
test byte [esi + 0x38], 0x10
je 0x4f63b5
push 4
pop edi
mov ecx, esi
call fcn.004f4318
test ah, 1
je 0x4f63ad
push 5
pop edi
push edi
mov ecx, esi
call fcn.004f1a5e
cmp dword [esi + 0x1c], ebx
je 0x4f63e7
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.004f4564
jmp 0x4f63e7
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x4f63fb
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x4f6414
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4f6414
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004f5e3f
cmp dword [esi + 0x54], ebx
je 0x4f6430
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4f646d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0050bec1
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4f64a4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004f60b8
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4f64fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x54], ebx
jne 0x4f651c
cmp dword [edi + 0x50], 0
jne 0x4f651c
movzx eax, bx
mov dword [edi + 0x50], eax
call fcn.0050bec1
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004f64c3
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x4f83ae
Capabilities:
Get disk information

Disassembly:
mov eax, 0x529f99
call fcn.004da3b8
sub esp, 0x150
mov eax, dword [0x566450]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x154]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor ebx, ebx
cmp eax, ebx
jne 0x4f83f6
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x4f83fa
cmp eax, esi
jb 0x4f8401
xor eax, eax
jmp 0x4f84d6
call fcn.004f5862
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.004f836c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x4f84c6
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4f8455
xor esi, esi
jmp 0x4f84c9
test byte [ebp - 0x158], 2
jne 0x4f8465
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x158], 4
jne 0x4f84c6
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4f84c6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x154], ebx
je 0x4f8451
cmp dword [ebp - 0x154], edi
jbe 0x4f8451
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, edi
add eax, dword [ebp - 0x154]
cmp eax, esi
jge 0x4f8451
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401a56
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004da561
leave
ret 8
Function at 0x4f886f
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0xf0]
sub esp, 0x170
mov eax, dword [0x566450]
push ebx
push esi
push edi
mov dword [ebp + 0xec], eax
call dword [0x563124]
xor ebx, ebx
cmp dword [ebp + 0xf8], ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x100]
mov dword [ebp - 0x78], ebx
mov byte [eax], bl
je 0x4f89bb
mov edi, dword [ebp + 0xfc]
push 0x800
push 0x160
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x4f89bb
test byte [ebp - 0x6a], 1
je 0x4f89bb
lea eax, [ebp - 0x78]
push eax
push 0x5410e8
push ebx
push 0x5410f8
lea ecx, [ebp - 0x80]
call fcn.004f8813
test eax, eax
jl 0x4f89bb
mov eax, dword [ebp - 0x78]
cmp eax, ebx
je 0x4f89bb
lea edx, [ebp - 0x7c]
push edx
push 0x548e18
mov dword [ebp - 0x7c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x4f89ae
cmp dword [ebp - 0x7c], ebx
je 0x4f89ae
cmp edi, ebx
jne 0x4f892f
xor eax, eax
jmp 0x4f8954
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.004da570
mov eax, esp
push dword [ebp - 0x80]
push esi
push edi
push eax
call fcn.00403294
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx]
push ebx
push eax
push ecx
call dword [edx + 0x14]
test eax, eax
jl 0x4f89a1
mov eax, dword [ebp + 0xf8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx]
push 2
push eax
push ecx
call dword [edx + 0x4c]
test eax, eax
jl 0x4f89a1
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push ebx
push ebx
push dword [ebp + 0x104]
push dword [ebp + 0x100]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor ebx, ebx
inc ebx
jmp 0x4f89ae
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x4f89ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x4f89bd
xor eax, eax
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0xec]
call fcn.004da561
pop edi
pop esi
pop ebx
add ebp, 0xf0
leave
ret 0x10
Function at 0x4f8ba0
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.004dc410
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x5410e4]
je 0x4f8ca7
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4f8c10
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x4f8c17
cmp ebx, ebx
jne 0x4f8c17
xor eax, eax
jmp 0x4f8caa
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x4f8c24
mov byte [esi + 0x20], bl
jmp 0x4f8c38
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004d9977
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.004d9977
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004d9977
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x4f8c93
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x4f8ca7
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4fbea6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x566450]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4fbef5
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4fbef5
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4fbf01
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004da561
leave
ret 8
Function at 0x4fea40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x4febc4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x4febc3
push esi
push edi
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.004dbe89
mov esi, eax
test esi, esi
pop ecx
je 0x4febc1
push edi
push ebx
push esi
call fcn.004daab0
mov edi, dword [esi]
add esp, 0xc
add edi, esi
and dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx*4]
xor eax, eax
cmp ecx, dword [eax*8 + 0x53e180]
je 0x4feab6
inc eax
cmp eax, 4
jb 0x4feaa5
jmp 0x4feb18
cmp dword [ebp + 0x10], 0
je 0x4fead2
cmp dword [eax*8 + 0x53e184], 0x12
je 0x4feb18
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], 0xffffff
jmp 0x4feb18
lea ebx, [eax*8 + 0x53e184]
push dword [ebx]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetSysColor]
push dword [ebx]
movzx eax, ah
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
mov ch, al
mov eax, ebx
push dword [eax]
shl ecx, 8
mov dword [ebp + 8], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], ecx
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x4fea9d
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 4], eax
je 0x4feba3
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call ebx
mov cl, byte [esi + 0xe]
push 0xcc0020
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push esi
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 0xc]
push edi
call ebx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.004dbe9b
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5012c3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x566450]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x501310
push dword [ebp + 8]
call fcn.0050dc8b
mov esi, eax
test esi, esi
je 0x501338
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x501338
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x52be14
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004da561
leave
ret 0xc
Function at 0x50203a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.004f0769
test eax, eax
jne 0x50222a
mov edi, dword [edi + 4]
push ebx
mov ecx, esi
call fcn.004cb881
test byte [esi + 0x7c], 0x20
mov dword [ebp - 0x10], eax
mov ebx, 0x201
jne 0x50207e
cmp edi, ebx
je 0x50207e
cmp edi, 0x202
jne 0x5021d7
cmp edi, 0x200
jb 0x50208e
cmp edi, 0x209
jbe 0x5020a6
cmp edi, 0xa0
jb 0x5021d7
cmp edi, 0xa9
ja 0x5021d7
call fcn.0050bee7
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1c]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x30
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.004dc410
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x28
call dword [eax + 0x6c]
cmp dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], eax
je 0x502104
push dword [ebp - 0x24]
call fcn.004dbe9b
pop ecx
cmp edi, ebx
jne 0x502117
test byte [ebp - 0x41], 0x80
je 0x502117
mov dword [ebp - 8], 1
jmp 0x502135
and dword [ebp - 8], 0
cmp edi, ebx
je 0x502135
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x502135
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x5021a1
cmp dword [ebp - 8], 0
jne 0x5021a1
cmp edi, 0x202
jne 0x502161
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xc8
push 0xe001
jmp 0x502189
test byte [esi + 0x78], 8
jne 0x502192
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x502192
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x78]
je 0x5021ce
push 0x12c
push 0xe000
mov ecx, esi
call fcn.005016eb
jmp 0x5021ce
push dword [ebp - 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x160]
jmp 0x5021ce
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x5021b4
cmp dword [ebp - 8], 0
je 0x5021ce
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xe001
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov ecx, esi
call fcn.004f29a1
test eax, eax
pop ebx
je 0x5021e9
cmp dword [eax + 0x64], 0
jne 0x50222f
cmp dword [ebp - 0x10], 0
je 0x502211
mov edi, dword [ebp - 0x10]
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
jne 0x50222a
mov ecx, edi
call fcn.004f2962
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x5021ef
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50222f
push dword [ebp + 8]
mov ecx, esi
call fcn.004f11ff
jmp 0x502231
xor eax, eax
inc eax
jmp 0x502231
xor eax, eax
pop edi
pop esi
leave
ret 4