joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5efac0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x677010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov ecx, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x453db4
mov eax, dword [ecx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x453e9a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x453e91
mov eax, dword [ebp - 0x10]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00476ee6
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 3
jne 0x453e7d
mov edx, dword [ebp - 0x10]
nop
lea ecx, [edx - 1]
xor eax, eax
mov bl, 1
test ecx, ecx
jle 0x453e7d
nop dword [eax + eax]
cmp word [esi + eax*2], 0
jne 0x453e71
movzx ecx, word [esi + eax*2 + 2]
test cx, cx
je 0x453e71
mov word [esi + eax*2], cx
xor ecx, ecx
mov word [esi + eax*2 + 2], cx
xor bl, bl
mov edx, dword [ebp - 0x10]
inc eax
lea ecx, [edx - 1]
cmp eax, ecx
jl 0x453e50
test bl, bl
je 0x453e40
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00414ef0
push esi
call fcn.00476ee1
add esp, 4
mov bl, 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x45d14f
cmp dword [edi], 2
jae 0x45d14f
pop edi
mov eax, 0x7a
pop esi
pop ebp
ret 0xc
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45d1b7
cmp dword [ebp + 0x10], 7
je 0x45d187
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
test esi, esi
je 0x45d1b1
test cl, 1
jne 0x45d17c
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x45d17c
cmp word [esi + eax*2 - 2], 0
jne 0x45d17c
cmp eax, 1
jbe 0x45d1b1
cmp word [esi + eax*2 - 4], 0
jne 0x45d17c
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x46f470
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jne 0x46f48b
pop edi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
je 0x46f516
push eax
call fcn.00476ee6
mov esi, eax
add esp, 4
test esi, esi
jne 0x46f4b9
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x46f50d
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
push 0x63fe60
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x46f50d
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x46f50d
mov eax, dword [ecx + 8]
mov dword [edi + 4], eax
mov eax, dword [ecx + 0xc]
push esi
mov dword [edi], eax
call fcn.00476ee1
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00476ee1
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fd30
Capabilities:
Check for time delay via queryperformancecounter
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f17e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x677010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], vtable.srl::Timer.0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [esi + 0x14], 8
jb 0x46fd7a
mov esi, dword [esi]
push 0
push 0x84000100
push 0
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
test ebx, ebx
je 0x46fe57
push 0x3e9
call fcn.00476ee6
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 0
push 0
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x46fe33
mov ecx, 0x3e8
nop word [eax + eax]
mov eax, dword [ebp + 8]
cmp eax, 0x3e8
mov dword [ebp - 0x10], 0
cmova eax, ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp + 8], eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46fe33
mov eax, dword [ebp - 0x10]
add edi, eax
adc esi, 0
test eax, eax
je 0x46fe33
push 0
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov ecx, 0x3e8
test eax, eax
jne 0x46fde0
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov dword [eax + 4], esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x18]
call fcn.00476ee1
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.00476b10
mov dword [ebp - 4], 1
mov dword [ebp - 0x30], vtable.srl::Timer.0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4732b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f1cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x677010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x20019
mov dword [ebp - 4], 0
push dword [edx]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00436690
mov ecx, dword [ebp - 0x24]
test eax, eax
jne 0x4733fa
xor esi, esi
mov dword [ebp - 0x10], esi
mov eax, 0x3e8
mov byte [ebp - 4], 1
mov edx, 2
mul edx
test edx, edx
ja 0x473342
jb 0x473331
cmp eax, 0xffffffff
ja 0x473342
push eax
call fcn.005c9188
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x7d0
push eax
push esi
lea eax, [ebp - 0x18]
xor edi, edi
push eax
push edi
push dword [ebx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x473388
cmp eax, 0xea
jne 0x4733c9
push 0x7d0
push esi
call fcn.005c6c00
mov ecx, dword [ebp - 0x24]
add esp, 8
test eax, eax
je 0x473345
mov esi, eax
mov dword [ebp - 0x10], esi
jmp 0x473345
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x47339c
cmp eax, 2
je 0x47339c
mov eax, 0xd
jmp 0x4733c9
mov ecx, dword [ebp - 0x14]
test esi, esi
je 0x4733c3
test ecx, ecx
je 0x4733be
test cl, 1
jne 0x4733b7
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], di
je 0x4733c3
mov eax, 0xd
jmp 0x4733c9
xor eax, eax
mov word [esi], ax
mov edi, ecx
shr edi, 1
xor eax, eax
test eax, eax
sete bl
test eax, eax
jne 0x4733df
mov ecx, dword [ebp + 0xc]
push esi
mov word [esi + edi*2], ax
call fcn.0040d500
push esi
mov byte [ebp - 4], 2
call fcn.005c6b78
mov byte [ebp - 4], 0
add esp, 4
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x473413
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov al, bl
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476930
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x677010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov dword [edi], 0
movq xmm0, qword [str.Data_Buffer]
mov eax, dword [0x643f40]
movq qword [ebp - 0x24], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
push 0x3c
mov esi, eax
call fcn.005c9188
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x24]
push 0x3e8
push 0x3c
push ebx
push 0
push 0x20
push eax
push 0xee9f5836
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x4769bd
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bc745
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bc745
mov esp, ebp
pop ebp
ret 8

Function at 0x479f4e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x479f98
call fcn.00491f54
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x479f95
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x479fe6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x479fc4
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.005bcfca
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x479fc4
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x479fe4
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.005bcfca
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x486fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x5f2b8e
call fcn.005bd033
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x48706a
push dword [ebp + 8]
mov ecx, eax
call fcn.004872f1
mov esi, eax
test esi, esi
je 0x4870fc
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x487053
push edx
call fcn.00476ee6
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x487053
xor edi, edi
inc edi
jmp 0x48705d
push dword [ebx]
call fcn.00476ee1
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00436740
jmp 0x4870fa
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.005bcfca
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4870f2
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.00476ee6
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x4870ec
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402cfe
push edi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00402cfe
shl bl, 4
sub bl, 0x51
add al, bl
mov edx, edi
test edx, edx
jns 0x4870dd
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x4870b5
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00402325
mov eax, edi
call fcn.005bcffc
ret 0x10

Function at 0x487104
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x487157
push esi
push dword [ebp + 8]
call fcn.004872f1
mov edi, eax
test edi, edi
jne 0x487127
mov eax, dword [ebp + 0x10]
jmp 0x487169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x487122
mov eax, dword [ebp - 8]
jmp 0x487169
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48abd1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x48ac16
call fcn.00491f54
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48ac16
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x48ac32
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00493559
mov ebx, eax
test edi, edi
je 0x48ac30
test esi, esi
je 0x48ac30
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48b620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x48b6de
cmp dword [esi + 0x20], 0
je 0x48b6de
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48b6de
cmp dword [ebp + 8], 0
je 0x48b6de
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00491f54
push 0x604b28
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x48b6af
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x48b6de
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0050feb7
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x48b6cf
test edi, edi
je 0x48b6cf
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x48b6da
mov ecx, esi
call fcn.0048b3c3
mov eax, ebx
jmp 0x48b6e0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48ff33
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5f7741
call fcn.005bd033
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x48ff59
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x48ffb8
call fcn.004771d4
push eax
lea ecx, [ebp - 0x10]
call fcn.004022fc
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.005bcfca
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005ce248
push eax
call fcn.004032e9
add esp, 0x14
test esi, esi
je 0x48ffab
push esi
call fcn.005ce0d0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402325
mov eax, ebx
call fcn.005bcffc
ret 8
Function at 0x4922a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x4922d0
cmp dword [ebx + 0x80], 0
jne 0x4922d0
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.00491f54
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.00492563
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x49230a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00491f54
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x492341
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00492362
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x493ed6
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5f3154
call fcn.005bd033
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00493fb7
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.004771d4
push eax
lea ecx, [ebx + 0x18]
call fcn.004022fc
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.00403074
push dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x493f4c
push eax
push dword [ebx + 8]
call fcn.004946c8
push dword [ebx + 0xc]
mov ecx, 0x67eb84
push eax
call fcn.004950d8
mov eax, ebx
call fcn.005bcffc
ret 0x18

Function at 0x4940cb
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4940f4
call fcn.00491f54
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x494121
push esi
push eax
mov ecx, 0x67eb84
call fcn.004950d8
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.004946c8
int3
Function at 0x4aaed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x4aaee9
call fcn.00491f54
mov esi, dword [eax + 0xc]
push 0x606504
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4aaf3f
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4aaf3e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4aaf1f
xor esi, esi
jmp 0x4aaf35
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.004aaf47
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x505cc9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x505d87
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x505d7c
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x505d7c
neg eax
sbb eax, eax
and eax, ecx
cmp dword [ebx], eax
jne 0x505d7c
mov eax, dword [ebx + 4]
sub eax, 1
je 0x505d50
sub eax, 1
je 0x505d1c
sub eax, 1
jne 0x505d7c
mov edi, 0x428e
jmp 0x505d55
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x505d55
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call fcn.005bcfca
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x505d55
add edi, 3
jmp 0x505d55
mov edi, 0x3ea0
push edi
call fcn.004795fd
test eax, eax
je 0x505d87
push edi
push eax
mov ecx, 0x6807f8
call fcn.0040335b
test eax, eax
je 0x505d87
mov eax, dword [0x6807f8]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
jmp 0x505d7e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00477c7d
int3