joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497a8e
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
test esi, esi
je 0x497aae
cmp word [esi], 0
je 0x497aae
call fcn.00497b32
test eax, eax
jne 0x497ab0
mov ecx, esi
pop esi
jmp 0x497d00
xor eax, eax
pop esi
ret
mov edi, edi
push esi
mov esi, ecx
movzx eax, word [esi]
test ax, ax
je 0x497e1c
mov edx, eax
cmp dx, 0x60
je 0x497e3f
cmp dx, 0x7e
je 0x497e3f
cmp dx, 0x21
je 0x497e3f
cmp dx, 0x40
je 0x497e3f
cmp dx, 0x23
je 0x497e3f
cmp dx, 0x24
je 0x497e3f
cmp dx, 0x25
je 0x497e3f
cmp dx, 0x5e
je 0x497e3f
cmp dx, 0x26
je 0x497e3f
cmp dx, 0x2a
je 0x497e3f
cmp dx, 0x28
je 0x497e3f
cmp dx, 0x29
je 0x497e3f
cmp dx, 0x3d
je 0x497e3f
cmp dx, 0x2b
je 0x497e3f
cmp dx, 0x7b
je 0x497e3f
cmp dx, 0x7d
je 0x497e3f
cmp dx, 0x5c
je 0x497e3f
cmp dx, 0x7c
je 0x497e3f
cmp dx, 0x3b
je 0x497e3f
cmp dx, 0x27
je 0x497e3f
cmp dx, 0x22
je 0x497e3f
cmp dx, 0x2c
je 0x497e3f
cmp dx, 0x3c
je 0x497e3f
cmp dx, 0x3e
je 0x497e3f
cmp dx, 0x2f
je 0x497e3f
cmp dx, 0x3f
je 0x497e3f
cmp dx, 0x20
je 0x497e3f
cmp dx, 0x5b
je 0x497e3f
cmp dx, 0x5d
je 0x497e3f
cmp dx, 9
je 0x497e3f
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x497d13
push 0x3a
push esi
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
cmp eax, esi
je 0x497e3f
test eax, eax
je 0x497e3a
lea ecx, [eax + 2]
call fcn.00497c71
test eax, eax
je 0x497e3f
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x499c36
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, edx
xor ebx, ebx
push edi
mov edi, 0x400000
test esi, esi
jne 0x499c51
mov esi, edi
not esi
push esi
push edi
mov edx, esi
mov ecx, edi
call fcn.004999a6
test eax, eax
je 0x499ea1
push esi
push edi
push 0x40
pop edx
call fcn.004999a6
test eax, eax
je 0x499ea1
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x499ea1
mov eax, dword [0x40003c]
cmp eax, esi
jae 0x499ea1
push esi
lea ecx, [eax + 0x400000]
mov edx, 0xf8
push edi
call fcn.004999a6
test eax, eax
je 0x499ea1
cmp dword [ecx], 0x4550
jne 0x499ea1
movzx eax, word [ecx + 0x14]
cmp eax, esi
jae 0x499ea1
add ecx, 0x18
mov edi, 0x10b
movzx edx, word [ecx]
cmp dx, di
jne 0x499d01
cmp eax, 0x60
jb 0x499ea1
push esi
mov edi, 0x400000
mov edx, 0xe0
push edi
call fcn.004999a6
test eax, eax
je 0x499ea1
mov eax, dword [ecx + 0x5c]
add ecx, 0x70
jmp 0x499d37
mov edi, 0x20b
cmp dx, di
jne 0x499ea1
cmp eax, 0x70
jb 0x499ea1
push esi
mov edi, 0x400000
mov edx, 0xf0
push edi
call fcn.004999a6
test eax, eax
je 0x499ea1
mov eax, dword [ecx + 0x6c]
sub ecx, 0xffffff80
cmp eax, 2
jbe 0x499ea1
mov eax, dword [ecx]
mov dword [ebp - 8], eax
test eax, eax
je 0x499ea1
mov edx, dword [ecx + 4]
test edx, edx
je 0x499ea1
lea ecx, [eax + 0x400000]
test ecx, ecx
je 0x499ea1
push esi
push edi
call fcn.004999a6
test eax, eax
je 0x499ea1
push 0x10
pop eax
cmp edx, eax
jb 0x499ea1
movzx edi, word [ecx + 0xe]
test edi, edi
je 0x499ea1
movzx eax, word [ecx + 0xc]
mov dword [ebp - 4], ebx
lea ecx, [ecx + eax*8]
add ecx, 0x10
test edi, edi
je 0x499dd3
push esi
push 0x400000
push 8
pop edx
call fcn.004999a6
test eax, eax
je 0x499ea1
mov eax, dword [ebp - 4]
push 0x10
pop edx
cmp word [ecx], dx
je 0x499dc9
add ecx, 8
inc eax
mov dword [ebp - 4], eax
cmp eax, edi
jb 0x499d9d
cmp eax, edi
je 0x499ea1
jmp 0x499dd6
push 0x10
pop edx
mov edi, dword [ecx + 4]
test edi, edi
jns 0x499e79
mov ecx, dword [ebp - 8]
and edi, 0x7fffffff
push esi
push 0x400000
lea eax, [ecx + 0x400000]
add edi, eax
mov ecx, edi
call fcn.004999a6
test eax, eax
je 0x499ea1
cmp word [edi + 0xe], bx
jne 0x499e17
cmp word [edi + 0xc], bx
je 0x499ea1
push esi
push 0x400000
push 8
lea ecx, [edi + 0x10]
pop edx
call fcn.004999a6
test eax, eax
je 0x499ea1
mov edi, dword [ecx + 4]
test edi, edi
jns 0x499e79
mov ecx, dword [ebp - 8]
and edi, 0x7fffffff
push esi
push 0x400000
push 0x10
lea eax, [ecx + 0x400000]
add edi, eax
pop edx
mov ecx, edi
call fcn.004999a6
test eax, eax
je 0x499ea1
cmp word [edi + 0xe], bx
jne 0x499e64
cmp word [edi + 0xc], bx
je 0x499ea1
push esi
push 0x400000
push 8
lea ecx, [edi + 0x10]
pop edx
call fcn.004999a6
test eax, eax
je 0x499ea1
mov edi, dword [ebp - 8]
mov ecx, dword [ecx + 4]
push esi
push 0x400000
lea eax, [edi + 0x400000]
push 0x10
add ecx, eax
pop edx
call fcn.004999a6
test eax, eax
je 0x499ea1
mov eax, dword [ecx]
lea ebx, [eax + 0x400000]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x49bc0a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
push edx
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x43c], edi
call fcn.0049bbbc
lea eax, [ebp - 0x43c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x49bca2
mov eax, dword [section..data]
cmp eax, section..data
je 0x49bd69
test byte [eax + 0x1c], 1
je 0x49bd69
cmp byte [eax + 0x19], 4
jb 0x49bd69
call fcn.0042386b
push esi
lea ecx, [ebp - 0x220]
push ecx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.0049bb1f
jmp 0x49bd69
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x440]
mov esi, edi
push eax
lea eax, [ebp - 0x438]
push eax
push edi
jmp 0x49bd05
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x438]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49bce8
test dx, dx
je 0x49bce4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49bce8
add eax, 4
add ecx, 4
test dx, dx
jne 0x49bcc2
mov eax, edi
jmp 0x49bced
sbb eax, eax
or eax, 1
test eax, eax
je 0x49bd21
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x440]
inc esi
push eax
lea eax, [ebp - 0x438]
push eax
push esi
push dword [ebp - 0x43c]
mov dword [ebp - 0x440], 0x109
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x49bcb9
jmp 0x49bd24
xor edi, edi
inc edi
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x49bd69
mov eax, dword [section..data]
cmp eax, section..data
je 0x49bd69
test byte [eax + 0x1c], 1
je 0x49bd69
cmp byte [eax + 0x19], 2
jb 0x49bd69
call fcn.0042386b
mov ecx, dword [section..data]
push esi
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xb
pop ecx
call fcn.0049bb88
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004fb5e0
leave
ret 4
Function at 0x49bd81
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x500144]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, edx
push edi
mov dword [esp + 0xc], eax
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test esi, esi
je 0x49bdc3
mov dword [esi], edi
cmp dword [ebp + 0x1c], edi
jne 0x49bdd8
push ebx
lea ecx, [esp + 0x2c]
call fcn.0049bbbc
lea eax, [esp + 0x28]
jmp 0x49bdda
mov eax, ebx
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push edi
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x49be43
mov eax, dword [section..data]
cmp eax, section..data
je 0x49bf58
test byte [eax + 0x1c], 1
je 0x49bf58
cmp byte [eax + 0x19], 4
jb 0x49bf58
call fcn.0042386b
push dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.0049bb1f
jmp 0x49bf58
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push edi
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x14], eax
mov ecx, section..data
test eax, eax
je 0x49beb6
mov eax, dword [section..data]
cmp eax, ecx
je 0x49bf15
test byte [eax + 0x1c], 1
je 0x49bf15
cmp byte [eax + 0x19], 4
jb 0x49bf15
call fcn.0042386b
push dword [esp + 0x14]
push dword [esp + 0x10]
push ebx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0049b9dd
jmp 0x49bf15
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp ebx, dword [ebp + 0x14]
je 0x49bf0c
cmp ebx, 3
jne 0x49bed3
cmp dword [ebp + 0x14], 4
jne 0x49bed3
cmp eax, 4
je 0x49bf0c
mov eax, dword [section..data]
cmp eax, ecx
je 0x49bf15
test byte [eax + 0x1c], 1
je 0x49bf15
cmp byte [eax + 0x19], 3
jb 0x49bf15
call fcn.0042386b
push dword [ebp + 0x14]
push ebx
push dword [esp + 0x14]
push dword [esp + 0x30]
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0049ba7b
jmp 0x49bf15
test esi, esi
je 0x49bf12
mov dword [esi], eax
xor edi, edi
inc edi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x49bf58
mov eax, dword [section..data]
cmp eax, section..data
je 0x49bf58
test byte [eax + 0x1c], 1
je 0x49bf58
cmp byte [eax + 0x19], 2
jb 0x49bf58
call fcn.0042386b
mov ecx, dword [section..data]
push esi
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xf
pop ecx
call fcn.0049bb88
mov ecx, dword [esp + 0x244]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004fb5e0
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4a3311
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x4174b8
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a3370
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x417530
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a3370
cmp dword [ebp - 0xc], 4
jne 0x4a3370
cmp dword [ebp - 0x10], 1
sete bl
cmp dword [ebp - 4], 0
je 0x4a337f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret
Function at 0x4a3706
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x5c
push 0x501a10
mov dword [ebp - 0x2c], 0x10
call sub.msvcrt.dll_wcschr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4a37b5
mov eax, dword [section..data]
mov esi, section..data
cmp eax, esi
je 0x4a37ab
test byte [eax + 0x1c], 1
mov edi, 0x417630
je 0x4a377a
cmp byte [eax + 0x19], 2
jb 0x4a377a
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x71
pop ecx
call fcn.004238e7
mov eax, dword [section..data]
cmp eax, esi
je 0x4a37ab
test byte [eax + 0x1c], 1
je 0x4a37ab
cmp byte [eax + 0x19], 3
jb 0x4a37ab
call fcn.0042386b
mov ecx, 0x501a10
mov edx, edi
push ecx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x72
pop ecx
call fcn.004330da
mov esi, 0x80070057
jmp 0x4a385b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4a381d
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a3806
test byte [eax + 0x1c], 1
je 0x4a3806
cmp byte [eax + 0x19], 2
jb 0x4a3806
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x417630
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x73
pop ecx
call fcn.00421fda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4a385b
movzx esi, si
or esi, 0x80070000
jmp 0x4a385b
mov ecx, 0x501a10
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x4a384f
test edi, edi
je 0x4a3843
lea eax, [ebx + 2]
mov dword [edi], eax
mov dword [0x50160c], 1
jmp 0x4a385b
test edi, edi
je 0x4a3855
mov dword [edi], esi
mov dword [0x50160c], esi
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret 4
Function at 0x4a68c7
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 2
mov ebx, ecx
xor edi, edi
pop eax
mov ecx, 0x501e14
xchg dword [ecx], eax
cmp eax, 1
jne 0x4a6927
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a69aa
test byte [eax + 0x1c], 8
je 0x4a69aa
cmp byte [eax + 0x19], 2
jb 0x4a69aa
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
mov edx, 0x417cf0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x77
pop ecx
call fcn.00421fda
jmp 0x4a69aa
push edi
push edi
push 0x10
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x5035f0]
call esi
push edi
push dword [ebx + 0x8c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x4a69aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a6994
test byte [eax + 0x1c], 8
je 0x4a6994
cmp byte [eax + 0x19], 2
jb 0x4a6994
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
mov edx, 0x417cf0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x78
pop ecx
call fcn.00421fda
test edi, edi
jle 0x4a69a3
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x4a69aa
mov edi, 0x80004005
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4a9a1d
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0x24]
xor esi, esi
push 8
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], esi
cmp word [edx], si
jne 0x4a9abe
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4a9abb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x4a9aa3
test byte [eax + 0x1c], 8
je 0x4a9aa3
cmp byte [eax + 0x19], 2
jb 0x4a9aa3
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x418160
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00421fda
test esi, esi
jle 0x4a9ab2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4a9b10
mov esi, 0x80004005
jmp 0x4a9b10
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx + 0x30], eax
test eax, eax
jne 0x4a9b0a
mov eax, dword [section..data]
mov esi, 0x8007000e
cmp eax, section..data
je 0x4a9b10
test byte [eax + 0x1c], 8
je 0x4a9b10
cmp byte [eax + 0x19], 2
jb 0x4a9b10
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x418160
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.00421fda
jmp 0x4a9b10
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret 8
Function at 0x4ac26f
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov edi, dword [ebx]
mov eax, dword [edi]
mov esi, dword [eax + 0x58]
mov ecx, esi
call dword [0x5035f0]
mov ecx, edi
call esi
xor edi, edi
mov esi, eax
mov dword [ebp - 4], esi
cmp dword [ebx + 0xc], edi
jne 0x4ac40c
cmp dword [ebx + 0x838], edi
jne 0x4ac40c
mov ecx, dword [ebp + 0x14]
sub ecx, 1
je 0x4ac39e
sub ecx, 1
je 0x4ac39e
sub ecx, 1
je 0x4ac39e
sub ecx, 3
je 0x4ac39e
sub ecx, 1
je 0x4ac371
mov eax, dword [ebp + 0x18]
sub eax, 1
je 0x4ac34d
sub eax, 1
je 0x4ac34d
sub eax, 1
je 0x4ac34d
sub eax, 1
je 0x4ac30a
dec eax
sub eax, 1
je 0x4ac34d
push edi
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x10]
jmp 0x4ac41a
mov edi, dword [ebx]
mov eax, dword [edi]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x5035f0]
mov ecx, edi
call esi
test eax, eax
jne 0x4ac33e
cmp dword [ebp + 0xc], eax
jne 0x4ac33e
push 5
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4ac349
push 0
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
jmp 0x4ac302
cmp dword [ebp + 8], edi
je 0x4ac420
push dword [ebp + 0x18]
mov ecx, ebx
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ac26f
jmp 0x4ac420
push edi
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 7
je 0x4ac301
cmp dword [esi*4 + 0x418800], 1
jne 0x4ac301
push 5
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
jmp 0x4ac401
push edi
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4ac420
call fcn.004a3a6a
test eax, eax
je 0x4ac3f5
mov edi, dword [ebx]
mov eax, dword [edi]
mov esi, dword [eax + 0x50]
mov ecx, esi
call dword [0x5035f0]
mov ecx, edi
call esi
test eax, eax
je 0x4ac3f3
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x4187e4], 1
jne 0x4ac3f3
mov edi, dword [ebx]
mov eax, dword [edi]
mov esi, dword [eax + 0x64]
mov ecx, esi
call dword [0x5035f0]
mov ecx, edi
call esi
test eax, eax
je 0x4ac38f
xor edi, edi
push 5
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x4ac420
push edi
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4eacc6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov ebx, edx
xor edi, edi
call fcn.004ea8df
mov esi, eax
test esi, esi
jne 0x4ead12
mov eax, dword [section..data]
cmp eax, section..data
je 0x4ead38
test byte [eax + 0x1c], 8
je 0x4ead38
cmp byte [eax + 0x19], 2
jb 0x4ead38
call fcn.004f44e3
push eax
mov eax, dword [section..data]
mov edx, 0x41bee4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.004238e7
jmp 0x4ead38
push 5
movzx eax, bx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4ead38
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4ead38
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4ec6c1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
xor esi, esi
cmp dword [0x500ba8], 2
je 0x4ec743
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x4ec751
test byte [eax + 0x1c], 1
je 0x4ec713
cmp byte [eax + 0x19], 2
jb 0x4ec713
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x41c940
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1b
pop ecx
call fcn.004238e7
mov eax, dword [section..data]
cmp eax, edi
je 0x4ec751
test byte [eax + 0x1c], 1
je 0x4ec751
cmp byte [eax + 0x19], 2
jb 0x4ec751
call fcn.004f44e3
push eax
mov eax, dword [section..data]
mov edx, 0x41c45c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.004238e7
jmp 0x4ec751
push dword [0x502088]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4edc64
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebx + 0x60]
call fcn.004f06cf
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebx + 0x80]
call fcn.004f05e2
lea ecx, [ebx + 0x60]
call fcn.004f06ae
mov dword [ebx + 0x78], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
mov ecx, ebx
call fcn.004ef106
mov edi, eax
test edi, edi
js 0x4edd44
mov esi, dword [ebp - 4]
test esi, esi
je 0x4edd40
push esi
mov ecx, ebx
call fcn.004edb4d
lea ecx, [esi + 8]
mov edi, eax
call fcn.004eb810
test edi, edi
js 0x4edd01
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push esi
xor edi, edi
call fcn.00465e60
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0x14
jb 0x4edca7
jmp 0x4edd8e
mov eax, dword [section..data]
cmp eax, section..data
je 0x4edd3d
test byte [eax + 0x1c], 8
je 0x4edd3d
cmp byte [eax + 0x19], 2
jb 0x4edd3d
call fcn.004f44e3
push edi
push 0x41c21c
push eax
mov eax, dword [section..data]
mov edx, 0x41c45c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5e
pop ecx
call fcn.004333f8
push esi
jmp 0x4edd89
xor edi, edi
jmp 0x4edd8e
mov eax, dword [section..data]
cmp eax, section..data
je 0x4edd80
test byte [eax + 0x1c], 8
je 0x4edd80
cmp byte [eax + 0x19], 2
jb 0x4edd80
call fcn.004f44e3
push edi
push 0x41c1e8
push eax
mov eax, dword [section..data]
mov edx, 0x41c45c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5d
pop ecx
call fcn.004333f8
cmp dword [ebp - 4], 0
je 0x4edd8e
push dword [ebp - 4]
call fcn.00465e60
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
and dword [ebx + 0x78], 0
cmp ecx, 0x14
jb 0x4edda4
mov ecx, ebx
call fcn.004eefe0
lea ecx, [ebp - 0xc]
call fcn.004262d0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4f45e8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 4
push esi
mov esi, dword [ebp + 0x14]
jne 0x4f460f
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x4f4619
cmp dword [ebp + 8], 3
jne 0x4f46b5
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp + 0x24]
mov edx, 0x80
push eax
push dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0x104]
call fcn.0041f843
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx eax, word [ebp - 0x306]
push eax
movzx eax, word [ebp - 0x308]
push eax
movzx eax, word [ebp - 0x30a]
push eax
movzx eax, word [ebp - 0x30c]
push eax
movzx eax, word [ebp - 0x30e]
push eax
movzx eax, word [ebp - 0x312]
push eax
movzx eax, word [ebp - 0x314]
push eax
push 0x41c6b0
lea eax, [ebp - 0x304]
push 0xff
push eax
call fcn.0041f7a9
add esp, 0x3c
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004fb5e0
leave
ret

Function at 0x4f524d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0x502074
mov dword [0x502078], eax
call fcn.004f59c0
mov esi, eax
test esi, esi
jns 0x4f52a9
mov eax, dword [section..data]
cmp eax, section..data
je 0x4f52c0
test byte [eax + 0x1c], 8
je 0x4f52c0
cmp byte [eax + 0x19], 2
jb 0x4f52c0
call fcn.0042386b
push esi
push 0x41c7fc
push eax
mov eax, dword [section..data]
mov edx, 0x41c848
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x58
pop ecx
call fcn.0042371b
jmp 0x4f52c0
mov eax, 0x502068
xor esi, esi
mov dword [0x50206c], esi
mov dword [0x502070], eax
mov dword [0x502068], eax
mov eax, esi
pop esi
ret