joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4a80
Capabilities:
Send data
Send http request

Disassembly:
mov eax, 0xa000
call fcn.004eaae0
mov al, byte [0x5913bc]
push esi
mov esi, ecx
push edi
mov byte [esp + 8], al
mov ecx, 0x27ff
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
push 0xa000
push ecx
mov ecx, esi
stosb byte es:[edi], al
call fcn.004d51f0
mov edx, dword [esp + 0xa00c]
mov eax, dword [esi + 0x30d69]
push 0
push 0x4400000
push 0
push 0x5913bc
push str.HTTP_1.0
push edx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edx, eax
test edx, edx
mov dword [esi + 0x30d6d], edx
jne 0x4d4b0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
pop edi
xor eax, eax
pop esi
add esp, 0xa000
ret 4
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.Content_Type:_application_x_www_form_urlencoded_r_n
push ecx
lea ecx, [esp + 0xc]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4d4b55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
pop edi
xor eax, eax
pop esi
add esp, 0xa000
ret 4
pop edi
mov eax, 1
pop esi
add esp, 0xa000
ret 4
Function at 0x4d4d90
Capabilities:
Read data from internet
Receive data

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x30d6d]
test eax, eax
jne 0x4d4daf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 8
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, edx
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, ebx
push 0x5adc8c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x30d6d]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
pop edi
pop ebp
test eax, eax
pop ebx
jne 0x4d4dfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x30d71], eax
xor eax, eax
pop esi
ret 8
mov eax, dword [0x5adc8c]
pop esi
ret 8
Function at 0x4d5580
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
push edi
xor edi, edi
cmp eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jae 0x4d5611
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea ebx, [eax + 0x100]
mov edx, dword [ebx + 0x400]
dec edx
je 0x4d55eb
dec edx
jne 0x4d55f1
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebx
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
lea edi, [edi + eax + 0x1800]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x4d55f1
add edi, 0x2000
mov edx, dword [ecx + 0xc]
add eax, 0x504
add ebx, 0x504
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x4d55a7
pop esi
pop ebp
mov eax, edi
pop ebx
pop edi
add esp, 8
ret
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4d5620
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0xc], 0x400
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x4d565d
lea edi, [esi + ebx]
push 1
push 0x57d97c
push edi
call fcn.004ed6da
add esp, 0xc
test eax, eax
je 0x4d565d
dec esi
dec edi
test esi, esi
ja 0x4d5643
lea eax, [esp + 0x14]
add esi, ebx
push eax
push 1
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d56d1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0x5adc90
push eax
push eax
push str.Content_Type
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4d56ba
mov edi, str.application_octet_stream
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.application_octet_stream
push 0x5adc90
call fcn.004eb375
add esp, 0xc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x5adc90
pop ebx
pop ecx
ret 4
mov edi, str.application_octet_stream
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.application_octet_stream
push 0x5adc90
call fcn.004eb375
add esp, 0xc
mov eax, 0x5adc90
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4d5e50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x53b0e0
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
push 0
push 0x57dac0
push 0x57dac8
lea ecx, [esi + 4]
call fcn.0041f245
mov al, byte [esi + 0xbe]
test al, al
je 0x4d5f70
push 0xa
lea ecx, [esp + 0x14]
call fcn.00505169
mov dword [esp + 0xc], 0x54a510
lea eax, [esp + 4]
push str.passport
push eax
mov ecx, esi
mov dword [esp + 0x5c], 0
call fcn.0040c227
mov eax, dword [eax]
push 1
push eax
push str.passport
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 1
call fcn.004d5aa0
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00505ad8
lea ecx, [esp + 4]
push 0x57f598
push ecx
mov ecx, esi
call fcn.0040c227
mov eax, dword [eax]
push 1
push eax
push 0x57f598
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 2
call fcn.004d5aa0
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00505ad8
lea edx, [esp + 4]
lea ecx, [esp + 0xc]
push edx
call fcn.004d5d00
mov eax, dword [eax]
mov ecx, esi
push eax
push 0
push 0xffffffffffffffff
push 1
mov byte [esp + 0x64], 3
call fcn.004d6fd0
lea ecx, [esp + 4]
mov byte [esp + 0x54], 0
call fcn.00505ad8
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0xc], 0x54a510
call fcn.0050524b
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
push ebx
push 0xa
lea ecx, [esp + 0x38]
call fcn.00505169
mov dword [esp + 0x30], 0x54a510
lea eax, [esp + 8]
mov ebx, 4
push str.uname
push eax
mov ecx, esi
mov dword [esp + 0x60], ebx
call fcn.0040c227
mov eax, dword [eax]
push 1
push eax
push str.uname
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 5
call fcn.004d5aa0
lea ecx, [esp + 8]
mov byte [esp + 0x58], bl
call fcn.00505ad8
lea ecx, [esp + 8]
push str.password
push ecx
mov ecx, esi
call fcn.0040c227
mov eax, dword [eax]
push 1
push eax
push str.passwd
lea ecx, [esp + 0x3c]
mov byte [esp + 0x64], 6
call fcn.004d5aa0
lea ecx, [esp + 8]
mov byte [esp + 0x58], bl
call fcn.00505ad8
lea edx, [esp + 0xc]
lea ecx, [esp + 0x30]
push edx
call fcn.004d5d00
mov eax, dword [eax]
mov ecx, esi
push eax
push 0
push 0xffffffffffffffff
push 1
mov byte [esp + 0x68], 7
call fcn.004d6fd0
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], bl
call fcn.00505ad8
lea ecx, [esp + 0x34]
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x30], 0x54a510
call fcn.0050524b
mov ecx, dword [esp + 0x50]
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x4d6450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53b158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x58c61c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
xor esi, esi
push str._u:_u:_u____
push ecx
mov dword [esp + 0x34], esi
call fcn.00501ac9
add esp, 0x14
lea edx, [edi + 0x99]
lea ecx, [esp + 0xc]
push esi
push edx
call fcn.004e308b
push 0xc350
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.004e30b2
test eax, eax
jne 0x4d64f7
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], al
call fcn.004e30c7
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00505ad8
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [0x58c61c]
push ebx
push ebp
mov dword [esp + 0x38], eax
mov ebp, dword [edi + 0x8d]
mov byte [esp + 0x28], 2
cmp ebp, esi
jle 0x4d654b
mov ecx, dword [edi + 0x89]
lea edx, [ecx + esi*4]
lea ecx, [esp + 0x38]
push edx
call fcn.00505c11
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
call fcn.00501743
test eax, eax
je 0x4d653d
inc esi
cmp esi, ebp
jl 0x4d6511
jmp 0x4d654b
push 1
push esi
lea ecx, [edi + 0x85]
call fcn.00504483
lea ecx, [esp + 0x14]
call fcn.004e30c7
cmp esi, ebp
lea ecx, [esp + 0x38]
setl bl
mov byte [esp + 0x28], 1
call fcn.00505ad8
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 0
call fcn.004e30c7
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00505ad8
mov ecx, dword [esp + 0x20]
mov al, bl
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x4d7500
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 1
push eax
call fcn.004d7c60
push 0
mov ebx, eax
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004d7c60
xor edx, edx
mov dl, byte [ebx + 0x1f]
mov esi, edx
test esi, esi
je 0x4d76b3
cmp esi, 0x1f
jge 0x4d76b3
cmp byte [esi + ebx], 0xe9
jne 0x4d76b3
mov ecx, dword [esi + ebx + 1]
lea edi, [ecx + ebx + 5]
mov cl, byte [ecx + ebx + 5]
cmp cl, 0xe9
je 0x4d7566
push 9
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov edx, dword [edi + 1]
lea ecx, [edx + edi + 5]
cmp ecx, eax
je 0x4d7584
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x4d75ca
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4d75ca
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4d75ca
lea edx, [esp + 0x18]
push edx
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
mov eax, ebx
test esi, esi
mov edx, edi
jle 0x4d75e8
push 0
push eax
push edx
call fcn.004d7ca0
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
lea edx, [ecx + edi]
jl 0x4d75d4
cmp ecx, esi
je 0x4d765a
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4d76bb
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4d76bb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4d76bb
push eax
mov eax, dword [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4d76bb
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4d76a5
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4d76a5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4d76a5
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0x4d76a5
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 8
push 6
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x4dc0d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x53b3bc
call fcn.004ea774
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
mov esi, ecx
push edi
shr eax, 0x10
test ax, ax
mov dword [esi + 0x40], ebx
jne 0x4dc103
cmp dword [esi + 0x3c], 0
jne 0x4dc103
movzx eax, bx
mov dword [esi + 0x3c], eax
call fcn.00520100
mov edi, dword [eax + 0xc]
push 5

Function at 0x4dc1ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x53b3d8
call fcn.004ea774
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x48]
mov ebx, dword [esi + 0x44]
call fcn.00520100
cmp dword [esi + 0x40], 0
je 0x4dc20b
call fcn.00520100
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4dc218
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4dc224
or eax, 0xffffffff
jmp 0x4dc2a6
call fcn.0042e1bb
xor ebx, ebx
cmp eax, ebx
jle 0x4dc232
mov dword [esi + 0x5c], eax
cmp dword [esi + 0x5c], ebx
jle 0x4dc299
mov eax, dword [0x58c61c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0x14], ebx
call fcn.0050c9a4
add esp, 0xc
test eax, eax
je 0x4dc28d
push edi
lea ecx, [ebp - 0x20]
call fcn.0050c7f3
mov ax, word [esi + 0x5c]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call fcn.0050ca13
pop es
add eax, dword [eax]
Function at 0x4e1423
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x53ba58
call fcn.004ea774
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
mov esi, ecx
push edi
shr eax, 0x10
test ax, ax
mov dword [esi + 0x40], ebx
jne 0x4e1451
cmp dword [esi + 0x3c], 0
jne 0x4e1451
movzx eax, bx
mov dword [esi + 0x3c], eax
call fcn.00520100
mov edi, dword [eax + 0xc]
push 5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4e147c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4e1484
or eax, 0xffffffff
jmp 0x4e1510
call fcn.0042e1bb
xor ecx, ecx
cmp eax, ecx
jle 0x4e1495
mov dword [esi + 0x8c], eax
cmp dword [esi + 0x8c], ecx
jle 0x4e1502
mov eax, dword [0x58c61c]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp + 8]
push eax
push ebx
mov dword [ebp - 0x10], ecx
call fcn.0050c9a4
add esp, 0xc
test eax, eax
je 0x4e14f6
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0050c7f3
mov ax, word [esi + 0x8c]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.0050ca13
lea ecx, [ebp - 0x1c]
call fcn.0050c890
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov ebx, eax
call fcn.0050c882
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00505ad8
push edi
push 0
push dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.0050a85f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4e1521
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x53ba74
call fcn.004ea774
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x40], 0
mov edi, dword [esi + 0x48]
mov ebx, dword [esi + 0x44]
je 0x4e155f
call fcn.00520100
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
jmp 0x4e1564
call fcn.00520100
test ebx, ebx
je 0x4e1571
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4e157d
or eax, 0xffffffff
jmp 0x4e1608
call fcn.0042e1bb
xor ebx, ebx
cmp eax, ebx
jle 0x4e158e
mov dword [esi + 0x8c], eax
cmp dword [esi + 0x8c], ebx
jle 0x4e15fb
mov eax, dword [0x58c61c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0x14], ebx
call fcn.0050c9a4
add esp, 0xc
test eax, eax
je 0x4e15ef
push edi
lea ecx, [ebp - 0x20]
call fcn.0050c7f3
mov ax, word [esi + 0x8c]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call fcn.0050ca13
lea ecx, [ebp - 0x20]
call fcn.0050c890
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.0050c882
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00505ad8
mov ecx, esi
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], ebx
call fcn.0050abb2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4ed1d3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4ed1f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ee8af
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4ed216
test byte [esp + 8], 2
je 0x4ed216
call fcn.004ee922
mov dword [eax], 0xd
call fcn.004ee92b
mov dword [eax], 5
jmp 0x4ed1ef
xor eax, eax
ret

Function at 0x4f6e74
Capabilities:
Query environment variable

Disassembly:
cmp edi, ebx
jne 0x4f6e84
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x4f6ec0
cmp byte [edi], bl
mov eax, edi
je 0x4f6e94
inc eax
cmp byte [eax], bl
jne 0x4f6e8a
inc eax
cmp byte [eax], bl
jne 0x4f6e8a
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.004ea998
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x4f6eaa
xor esi, esi
jmp 0x4f6eb5
push ebp
push edi
push esi
call fcn.004eabd0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x4f6ec2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4fa674
Capabilities:
Set environment variable

Disassembly:
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
call fcn.004eff9c
pop ecx
test eax, eax
pop ecx
je 0x4fa6be
jmp 0x4fa6b9
mov dword [0x5b0240], eax
cmp dword [ebp + 0xc], 0
je 0x4fa70a
push dword [ebp + 8]
call fcn.004eafc0
inc eax
inc eax
push eax
call fcn.004ea998
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4fa70a
push dword [ebp + 8]
push esi
call fcn.004eb9e0
mov eax, esi
pop ecx
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 8]
and byte [eax], 0
inc eax
neg ebx
sbb ebx, ebx
not ebx
and ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call fcn.004ea852
pop ecx
xor eax, eax
jmp 0x4fa5f1
Function at 0x500220
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.004eaae0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x5002eb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x5002eb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x50029e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x5002a9
or bh, 8
and edi, 0x8000000
je 0x5002c4
mov eax, dword [0x5e1f1c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x5002eb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5006c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x5006eb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x50070f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
inc eax

Function at 0x50720f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x507247
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00505f7f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00505f57
jmp 0x507253
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x507257
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x5ae180
mov ecx, edi
call fcn.00505c61
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x5072aa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, esi
call fcn.00509ccf
test eax, eax
je 0x5072bd
push edi
mov ecx, eax
call fcn.0050720f
Function at 0x508e45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x508e87
call fcn.00520100
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x508e87
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x508e7e
xor eax, eax
jmp 0x508e8f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00508e95
pop edi
pop esi
pop ebx
ret 4

Function at 0x50a7ed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x50a80f
cmp dword [edi + 0x3c], 0
jne 0x50a80f
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00520100
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0050a83c
pop edi
pop esi
pop ebx
ret 8

Function at 0x50a88a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00520100
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x50a8bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0050a8ce
pop edi
pop esi
pop ebx
ret 8

Function at 0x50bb42
Capabilities:
Query or enumerate registry value

Disassembly:
push eax
xor ebx, ebx
push str.CLSID
push SysReAllocString
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x50bbd5
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push dword [ebp - 8]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x50bbcf
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push str.InProcServer32
push dword [ebp - 4]
call esi
test eax, eax
jne 0x50bbca
mov ecx, dword [ebp + 0xc]
mov esi, 0x104
push esi
call fcn.00505f08
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x5913bc
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
mov esi, eax
call fcn.00505f57
push dword [ebp + 8]
xor eax, eax
cmp esi, ebx
sete al
mov ebx, eax
call edi
push dword [ebp - 4]
call edi
push dword [ebp - 8]
call edi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8