joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443010
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x443048]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443029
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443038
or bl, 4
test esi, 0x20000000
je 0x443043
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44964c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44965e
add esp, 0xfffffff0
call fcn.00403cbc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b620
mov eax, dword [0x456898]
mov dword [eax + 4], ebx
mov dword [eax], 0x4499f0
mov eax, dword [0x4568a4]
mov dword [eax + 4], ebx
mov dword [eax], 0x4499fc
mov eax, ebx
call fcn.00449a08
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x445ed0
push eax
push 0
push 0
mov eax, dword [0x4569b8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41cfb0]
call fcn.0041e3b4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41cfb0]
call fcn.0041e3b4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41cfb0]
call fcn.0041e3b4
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00449e28
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449d04
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449d04
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449d04
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44979b
call fcn.00403d14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x449ae8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449c93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x449c74
mov dl, 1
mov eax, dword [0x411b70]
call fcn.00403940
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004046c4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x449c63
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043770c
test al, al
je 0x449c56
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x449ca4
lea eax, [ebp - 0x254]
call fcn.004091b8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x449c56
xor eax, eax
push ebp
push 0x449c4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x449cdc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x449c38
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040492c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x449c38
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040492c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449c56
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x449b59
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415cb8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449c9a
lea eax, [ebp - 0x260]
call fcn.004046c4
ret

Function at 0x44a5c8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x457bf8]
cmp byte [eax + 0xa5], 0
jne 0x44a639
cmp dword [0x457c10], 0
jne 0x44a5fa
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44a584
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x457c10], eax
cmp dword [0x457c0c], 0
jne 0x44a615
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x457c0c], eax
cmp dword [0x457c14], 0
jne 0x44a639
push esp
push 0
push 0
push 0x44a528
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x457c14], eax
pop edx
ret
Function at 0x44a730
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44a747
add esp, 0xfffffff0
call fcn.00403cbc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b620
mov eax, dword [0x4569a4]
cmp word [eax + 2], 0
jne 0x44a76f
mov eax, dword [0x4569a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044bbe0
mov eax, dword [0x456a28]
cmp word [eax + 2], 0
jne 0x44a789
mov eax, dword [0x456a28]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044bdd8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411680]
call fcn.00403940
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d760]
call fcn.0042336c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44a910
mov eax, dword [0x4568ec]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042373c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44c348
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4568ec]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040aa34
test eax, eax
je 0x44a87e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b14
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040aa5c
test eax, eax
je 0x44a892
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040492c
mov eax, dword [0x456818]
cmp byte [eax], 0
jne 0x44a8c6
mov eax, ebx
call fcn.0044aa38
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044c524
mov eax, ebx
call fcn.0044ce64
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44a906
call fcn.00403d14
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44acac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x457bf8]
cmp dword [eax + 0x30], 0
je 0x44ad56
cmp dword [ebx + 0x94], 0
jne 0x44ad50
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44ac3c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44ad50
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44ad16
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44ad50
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413d20
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44ad25
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44b834
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44b869
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047b4
jmp 0x44b876
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404718
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44c700
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44c741
mov eax, esi
call fcn.00432fd0
test al, al
je 0x44c741
mov eax, dword [ebx + 0x84]
call fcn.00432ccc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c741
push 0
mov eax, dword [ebx + 0x84]
call fcn.00432ccc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45090c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x450a8b
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 7
ja case.default.0x45094f
jmp dword [eax*4 + 0x450956]
lea eax, [ebp - 0x104]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.0040492c
jmp case.default.0x45094f
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
call fcn.004505a4
mov eax, dword [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
mov dl, byte [ebp - 0x104]
call fcn.004048a4
mov edx, dword [ebp - 0x10c]
mov eax, ebx
pop ecx
call fcn.004049c8
jmp case.default.0x45094f
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
call fcn.00450600
mov eax, dword [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
mov dl, byte [ebp - 0x104]
call fcn.004048a4
mov edx, dword [ebp - 0x114]
mov eax, ebx
pop ecx
call fcn.004049c8
jmp case.default.0x45094f
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.004029f8
mov eax, dword [ebp - 0x118]
mov edx, ebx
call fcn.00450740
jmp case.default.0x45094f
mov eax, ebx
call fcn.004508a0
jmp case.default.0x45094f
mov eax, ebx
call fcn.004508c4
jmp case.default.0x45094f
mov eax, ebx
call fcn.004508e8
jmp case.default.0x45094f
mov eax, ebx
mov edx, dword [0x457c20]
call fcn.00404718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450a92
lea eax, [ebp - 0x118]
mov edx, 5
call fcn.004046e8
ret

Function at 0x450a98
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x450b28
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x450b03
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
call fcn.00450680
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.004048b4
mov edx, dword [ebp - 8]
pop eax
call fcn.00404984
mov eax, dword [ebp - 4]
call fcn.00404b74
push eax
call sub.kernel32.dll_WinExec
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x4510bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x4510db
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00450cfc
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x45113d
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00450cfc
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x45118c
add ebx, 0x400
dec edi
jne 0x45118a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4511d4
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.00404b64
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x4513eb
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00450cc0
test al, al
je 0x451256
call fcn.00450cc0
test al, al
je 0x451256
call fcn.00450cc0
test al, al
je 0x451256
call fcn.00450cc0
test al, al
je 0x451256
call fcn.00450cc0
test al, al
je 0x451256
call fcn.00450cc0
test al, al
je 0x451256
push esi
push edi
mov esi, 0x4557b4
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x4557fc
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.0040497c
push eax
mov eax, dword [ebp + 0x14]
call fcn.00404b74
pop edx
call fcn.004510bc
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x4512a6
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x4512bc
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x4513d5
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x4512d9
cmp dword [ebp + 0xc], 0
je 0x451355
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x4512ff
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x4512e1
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.00450cd0
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.00450cd0
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00450cfc
pop ecx
mov eax, dword [esi]
call fcn.00450cd0
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.00450cd0
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x4513c6
cmp byte [ebp + 8], 0
jne 0x4513ad
mov edi, ebx
mov eax, dword [edi]
call fcn.00450cd0
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.00450cd0
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00450cfc
pop ecx
mov eax, dword [esi]
call fcn.00450cd0
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.00450cd0
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x4513c6
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.00450cfc
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x4512cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4513f2
lea eax, [ebp + 0x14]
call fcn.004046c4
ret
Function at 0x4514e4
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b64
mov eax, dword [ebp - 8]
call fcn.00404b64
xor eax, eax
push ebp
push 0x451671
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0xa
mov eax, dword [ebp - 4]
call fcn.00404b74
push eax
mov eax, dword [0x457710]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x451632
push ebx
mov eax, dword [0x457710]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x451632
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
je 0x451632
push esi
call sub.kernel32.dll_LockResource
mov esi, eax
test esi, esi
je 0x451632
push ebx
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4514a4]
call fcn.00405bfc
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov edx, esi
call fcn.00407410
push 0
push 0
lea eax, [ebp - 0x20]
mov edx, dword [0x4569b4]
mov edx, dword [edx]
call fcn.004048b4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.004513fc
mov eax, ebx
add eax, eax
lea eax, [eax + eax*2]
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x4514c4]
call fcn.00405bfc
add esp, 4
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.0044cfb0
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00404b74
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x451632
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x45162c
mov byte [ebp - 9], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451678
lea eax, [ebp - 0x20]
call fcn.004046c4
lea eax, [ebp - 0x14]
mov edx, dword [0x4514c4]
call fcn.00405d1c
lea eax, [ebp - 0x10]
mov edx, dword [0x4514a4]
call fcn.00405d1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046e8
ret
Function at 0x4516a4
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b64
mov eax, dword [ebp - 8]
call fcn.00404b64
xor eax, eax
push ebp
push 0x4517ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0xa
mov eax, dword [ebp - 4]
call fcn.00404b74
push eax
mov eax, dword [0x457710]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x4517bb
push ebx
mov eax, dword [0x457710]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x4517bb
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
je 0x4517bb
push esi
call sub.kernel32.dll_LockResource
mov esi, eax
test esi, esi
je 0x4517bb
push ebx
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x451684]
call fcn.00405bfc
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov edx, esi
call fcn.00407410
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [0x4569b4]
mov edx, dword [edx]
call fcn.004048b4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.004513fc
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00404b74
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4517bb
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x4517b5
mov byte [ebp - 9], 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4517f3
lea eax, [ebp - 0x18]
call fcn.004046c4
lea eax, [ebp - 0x10]
mov edx, dword [0x451684]
call fcn.00405d1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046e8
ret
Function at 0x429600
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48d45b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00481c60
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x429682
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047fa80
mov eax, dword [eax]
push 0x4aa234
push eax
call fcn.00471c94
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00481eeb
test bl, bl
je 0x429682
push 0x4aa234
lea ecx, [esp + 0xc]
call fcn.0048227b
push 0x4add94
lea ecx, [esp + 0xc]
call fcn.0048227b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4296be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00481eeb
jmp 0x429789
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x429742
lea edx, [esp + 0x7c]
push 0x4add90
push edx
call fcn.00471c94
add esp, 8
test eax, eax
je 0x429742
lea eax, [esp + 0x7c]
push 0x4add8c
push eax
call fcn.00471c94
add esp, 8
test eax, eax
je 0x429742
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4296d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00481eeb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x429f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x429fe2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc