joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bc62
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00440447
xor ebx, ebx
cmp dword [0x4c4098], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44bd38
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44be18
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44be18
push eax
call fcn.004403d9
mov dword [esp], 0x49a924
push edi
mov dword [0x4c4098], eax
call esi
push eax
call fcn.004403d9
mov dword [esp], 0x49a910
push edi
mov dword [0x4c409c], eax
call esi
push eax
call fcn.004403d9
mov dword [0x4c40a0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043e2f7
test eax, eax
pop ecx
pop ecx
je 0x44bd06
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043a7ce
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44bd38
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004403d9
cmp eax, ebx
pop ecx
mov dword [0x4c40a8], eax
je 0x44bd38
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004403d9
pop ecx
mov dword [0x4c40a4], eax
mov eax, dword [0x4c40a4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x44bdbd
cmp dword [0x4c40a8], ecx
je 0x44bdbd
push eax
call fcn.00440450
push dword [0x4c40a8]
mov esi, eax
call fcn.00440450
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x44bdbd
cmp edi, ebx
je 0x44bdbd
call esi
cmp eax, ebx
je 0x44bd8a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44bd8a
test byte [ebp - 0x18], 1
jne 0x44bdbd
lea eax, [ebp - 0x10]
push eax
call fcn.0043e32e
test eax, eax
pop ecx
je 0x44bda5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043a7ce
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44bdb4
or dword [ebp + 0x10], 0x200000
jmp 0x44bdf8
or dword [ebp + 0x10], 0x40000
jmp 0x44bdf8
mov eax, dword [0x4c409c]
cmp eax, dword [ebp - 8]
je 0x44bdf8
push eax
call fcn.00440450
cmp eax, ebx
pop ecx
je 0x44bdf8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44bdf8
mov eax, dword [0x4c40a0]
cmp eax, dword [ebp - 8]
je 0x44bdf8
push eax
call fcn.00440450
cmp eax, ebx
pop ecx
je 0x44bdf8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c4098]
call fcn.00440450
cmp eax, ebx
pop ecx
je 0x44be18
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44be1a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x455596
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4555ee
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x4ab6a4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4555e1
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4555f0
xor eax, eax
pop esi
leave
ret 4
Function at 0x45b0a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x493cd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, dword [esp + 0x28]
xor edi, edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi], 0x49dc08
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov edx, dword [ecx]
mov dword [esp + 0x14], edi
call dword [edx + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], eax
pop edi
mov eax, esi
mov dword [0x4c434c], 0x49db68
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x46262a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x493df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esi], 0x49e8fc
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
call fcn.0046a0a0
mov ecx, dword [esp + 8]
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x464900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x493e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 4]
push 4
push str.VoiceManager
push eax
push 0x14
mov dword [esp + 0x30], eax
call fcn.00475930
mov esi, eax
add esp, 0x10
mov dword [esp + 0xc], esi
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x18], ebx
je 0x46496d
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0046a0a0
mov dword [esi + 0xc], eax
pop edi
mov dword [esi + 0x10], ebx
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0xfffffffffffffffd
push 0x49edbc
push ebx
call fcn.00474be0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x479a40
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x493fa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x24]
push 4
push str.CriDelegateWin
push eax
push 0xb8
mov dword [edi], 0
call fcn.00475930
add esp, 0x10
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x479a98
mov ecx, eax
call fcn.004790d0
mov esi, eax
jmp 0x479a9a
xor esi, esi
test esi, esi
mov dword [esp + 0x18], 0xffffffff
jne 0x479acd
push str.E2006082001:Can_not_allocate_memory.
push esi
call fcn.00474b20
add esp, 8
mov dword [edi], 0xfffffffd
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x24]
push ecx
lea edx, [esi + 0xc]
push 0x40
push edx
call fcn.004759c0
add esp, 0xc
test eax, eax
mov dword [esi + 8], eax
je 0x479be7
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x479be7
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 0x50]
push 0x40
push ecx
call fcn.004759c0
add esp, 0xc
test eax, eax
mov dword [esi + 0x4c], eax
je 0x479bb4
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x479bb4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x94], eax
jne 0x479b40
push str.E2006082004:Can_not_create_wait_event.
jmp 0x479bb9
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x479a30
push 0
push 0
call fcn.0043b395
add esp, 0x18
test eax, eax
mov dword [esi + 0x90], eax
jne 0x479b6a
push str.E2006082005:Can_not_create_thread.
jmp 0x479bb9
mov eax, dword [esi + 0xa8]
test eax, eax
jne 0x479b8e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push 0xa
call edi
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x479b80
mov eax, dword [esi + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0xb0], eax
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.E2006082003:Can_not_create_critical_section.
push 0
call fcn.00474b20
add esp, 8
mov dword [edi], 0xffffffff
mov edx, dword [esi]
push 0x4c5810
mov ecx, esi
call dword [edx]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.E2006082002:Can_not_create_critical_section.
push 0
call fcn.00474b20
add esp, 8
mov dword [edi], 0xffffffff
mov eax, dword [esi]
push 0x4c5810
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0x10]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x479db0
Capabilities:
Resume thread

Disassembly:
sub esp, 8
mov ecx, dword [0x4c5bf4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
cmp ecx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x14], eax
mov ebp, 1
je 0x479e6c
mov dword [esp + 0x10], eax
jmp 0x479df0
mov dword [0x4c5bd8], ebp
mov eax, dword [0x4c5bf4]
push 2
push eax
call esi
mov ecx, dword [0x4c5bf4]
push ecx
call edi
mov edx, dword [0x4c5bf4]
push 0x3e8
push edx
call ebx
cmp eax, 0x102
jne 0x479e2c
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x479df0
cmp dword [esp + 0x10], 0x1e
jne 0x479e48
push str.02100901:_Timeout_Error:_adxm_destroy_thrd__vsync_
call fcn.0047f120
add esp, 4
mov dword [esp + 0x14], 0xffffffff
xor eax, eax
mov dword [0x4c5bdc], eax
mov dword [0x4c5bd8], eax
mov eax, dword [0x4c5bf4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x4c5bf0], eax
mov dword [0x4c5bf4], eax
cmp dword [0x4c5bfc], eax
je 0x479efe
mov dword [esp + 0x10], eax
lea esp, [esp]
mov dword [0x4c5be0], ebp
mov ecx, dword [0x4c5bfc]
push 2
push ecx
call esi
mov edx, dword [0x4c5bfc]
push edx
call edi
mov eax, dword [0x4c5bfc]
push 0x3e8
push eax
call ebx
cmp eax, 0x102
jne 0x479ebc
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x479e80
cmp dword [esp + 0x10], 0x1e
jne 0x479ed9
push str.02100902:_Timeout_Error:_ADXWIN_DisableFsThrd
call fcn.0047f120
mov eax, dword [esp + 0x18]
add esp, 4
dec eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [0x4c5be4], eax
mov dword [0x4c5be0], eax
mov ecx, dword [0x4c5bfc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x4c5bf8], eax
mov dword [0x4c5bfc], eax
cmp dword [0x4c5c04], eax
je 0x479f90
mov dword [esp + 0x10], eax
mov edi, edi
mov dword [0x4c5be8], ebp
mov edx, dword [0x4c5c04]
push 2
push edx
call esi
mov eax, dword [0x4c5c04]
push eax
call edi
mov ecx, dword [0x4c5c04]
push 0x3e8
push ecx
call ebx
cmp eax, 0x102
jne 0x479f4c
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jl 0x479f10
cmp dword [esp + 0x10], 0x1e
jne 0x479f69
push str.02100903:_Timeout_Error:_adxm_destroy_thrd__mwidle_
call fcn.0047f120
mov eax, dword [esp + 0x18]
add esp, 4
dec eax
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [0x4c5bec], esi
mov dword [0x4c5be8], esi
mov edx, dword [0x4c5c04]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4c5c00], esi
mov dword [0x4c5c04], esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x47a0d0
Capabilities:
Create thread

Disassembly:
push 0x4c5bf0
push 4
push 0
push 0x47a020
push 0x100000
push 0
call fcn.0043b395
mov dword [0x4c5bf4], eax
mov eax, dword [0x4c5bf4]
add esp, 0x18
test eax, eax
jne 0x47a10c
push str.E02100911_:_The_error_occurred_within_the_CreateThread_function.
call fcn.0047f120
add esp, 4
or eax, 0xffffffff
ret
push 0x4c5bf8
push 4
push 0
push 0x47a090
push 0x100000
push 0
call fcn.0043b395
mov dword [0x4c5bfc], eax
mov eax, dword [0x4c5bfc]
add esp, 0x18
test eax, eax
jne 0x47a148
push str.E02100912_:_The_error_occurred_within_the_CreateThread_function.
call fcn.0047f120
add esp, 4
or eax, 0xffffffff
ret
push 0x4c5c00
push 4
push 0
push 0x479cd0
push 0x100000
push 0
call fcn.0043b395
mov dword [0x4c5c04], eax
mov eax, dword [0x4c5c04]
add esp, 0x18
test eax, eax
jne 0x47a184
push str.E02100913_:_The_error_occurred_within_the_CreateThread_function.
call fcn.0047f120
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x47a190
Capabilities:
Resume thread

Disassembly:
push edi
push 0x4c5bb0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x47a28e
push esi
push eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
call fcn.0047b430
xor esi, esi
mov dword [0x4c5bd8], esi
mov dword [0x4c5bdc], esi
mov dword [0x4c5be8], esi
mov dword [0x4c5bec], esi
mov dword [0x4c5bc4], esi
call fcn.0047f370
push esi
push esi
call fcn.0047f280
push esi
push esi
call fcn.0047f2a0
push 0x479c30
call fcn.0047f450
add esp, 0x14
cmp edi, esi
jne 0x47a218
mov dword [0x4c5bb4], 2
mov dword [0x4c5bb8], 1
mov dword [0x4c5bbc], 0xfffffff1
jmp 0x47a231
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [0x4c5bb4], eax
mov dword [0x4c5bb8], ecx
mov dword [0x4c5bbc], edx
call fcn.0047a0d0
test eax, eax
jl 0x47a243
call fcn.00479fa0
test eax, eax
jge 0x47a24f
call fcn.00479db0
pop esi
pop edi
jmp fcn.0047f410
mov eax, dword [0x4c5bb8]
push eax
call fcn.0047c0e0
mov ecx, dword [0x4c5bf4]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
add esp, 4
push ecx
call edi
mov edx, dword [0x4c5bfc]
push edx
call edi
mov eax, dword [0x4c5c04]
push eax
call edi
push esi
push 0x479c50
push 6
call fcn.0047f700
add esp, 0xc
pop esi
pop edi
ret
Function at 0x47b2d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
call dword [0x4c5cb4]
mov ebx, dword [ebp + 8]
mov esi, eax
mov eax, dword [0x4c5cc4]
test eax, eax
je 0x47b315
cmp esi, ebx
jae 0x47b317
mov eax, dword [0x4c5cc4]
test eax, eax
jge 0x47b30f
mov eax, dword [0x4c5cc4]
neg eax
cmp esi, eax
jae 0x47b30f
or esi, 0xffffffff
jmp 0x47b315
add esi, dword [0x4c5cc4]
cmp esi, ebx
jbe 0x47b31b
xor esi, esi
xor edx, edx
lea ecx, [ebx + 0x32]
mov eax, 0x5f5e100
div ecx
xor edx, edx
div edi
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, ebx
sub eax, esi
imul eax, eax, 0x186a0
div ecx
xor edx, edx
div edi
mov edi, eax
cmp edi, 1
jle 0x47b35f
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
cmp esi, ebx
jae 0x47b423
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ecx]
lea ecx, [esp + 0x10]
push ecx
call ebx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4c5cd0]
call fcn.0048f430
mov esi, eax
mov edi, edx
mov edi, edi
lea edx, [esp + 0x18]
push edx
call ebx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x4c5cd0]
call fcn.0048f430
push 0
sub eax, esi
push 0xf4240
sbb edx, edi
push edx
push eax
call fcn.0043eb90
mov ecx, dword [0x4c5c9c]
push ecx
mov ecx, dword [0x4c5c98]
push ecx
push edx
push eax
call fcn.0043ebd0
cmp eax, dword [esp + 0xc]
jl 0x47b390
call dword [0x4c5cb4]
mov ecx, dword [0x4c5cc4]
test ecx, ecx
mov ecx, dword [ebp + 8]
je 0x47b40f
cmp eax, ecx
jae 0x47b411
mov edx, dword [0x4c5cc4]
test edx, edx
jge 0x47b409
mov edx, dword [0x4c5cc4]
neg edx
cmp eax, edx
jae 0x47b409
or eax, 0xffffffff
jmp 0x47b40f
add eax, dword [0x4c5cc4]
cmp eax, ecx
ja 0x47b423
mov edx, ecx
shr edx, 1
cmp eax, edx
jb 0x47b423
cmp eax, ecx
jb 0x47b370
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x488580
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push edi
je 0x4885c5
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4885c5
push esi
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4885b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4885b4
pop esi
xor eax, eax
pop edi
ret
mov edx, dword [esp + 0xc]
mov dword [edi], esi
pop esi
mov dword [edi + 4], edx
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x48e3f4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4b8670]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0048e389
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043d5f0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x48e443
cmp dword [ebp - 0x1c], 5
jb 0x48e45b
jmp 0x48e457
cmp dword [ebp - 0x10], 1
jne 0x48e45b
cmp dword [ebp - 0x1c], 4
ja 0x48e457
jne 0x48e45b
cmp dword [ebp - 0x18], 0
jbe 0x48e45b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4a578c
call fcn.0048e27a
test eax, eax
jge 0x48e47c
mov byte [0x4d7028], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043a513
add ebp, 0x78
leave
ret
Function at 0x495fc1
Capabilities:
Terminate process

Disassembly:
push 0x60
push 0x4b1800
call fcn.0043db84
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x439f81
push 0x12
call fcn.00439ed1
pop ecx
jmp 0x43a10a
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push 0
test eax, eax
jne 0x439f9f
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x43a10a
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x439fd1
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
mov eax, ecx
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x4c3540], esi
mov dword [0x4c3548], eax
mov dword [0x4c354c], ecx
mov dword [0x4c3550], edx
mov dword [0x4c3544], edi
call fcn.00439ef5
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
push ebx
call fcn.00440a21
pop ecx
test eax, eax
jne 0x43a019
push 0x1c
call fcn.00439ed1
pop ecx
call fcn.00440842
test eax, eax
jne 0x43a02a
push 0x10
call fcn.00439ed1
pop ecx
call fcn.00440325
mov dword [ebp - 4], ebx
call fcn.004400e5
test eax, eax
jge 0x43a043
push 0x1b
call fcn.0043e24e
pop ecx
call fcn.00440046
mov dword [0xefcbf4], eax
call fcn.0043fee5
mov dword [0x4c3528], eax
call fcn.0043fe3a
test eax, eax
jge 0x43a068
push 8
call fcn.0043e24e
pop ecx
call fcn.0043fc14
test eax, eax
jge 0x43a079
push 9
call fcn.0043e24e
pop ecx
push ebx
call fcn.0043e36a
pop ecx
test eax, eax
je 0x43a08b
push eax
call fcn.0043e24e
pop ecx
call fcn.0043fbce
test byte [ebp - 0x44], bl
je 0x43a09b
movzx ecx, word [ebp - 0x40]
jmp 0x43a09e
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call fcn.0048e714
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x43a0bb
push eax
call fcn.0043e4de
call fcn.0043e500
jmp 0x43a0f0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x43a10f
mov eax, 0xff
call fcn.0043dbc9
ret
call fcn.00440a7b
jmp 0x439f36
push 0x4b6fe8
jmp 0x495fd1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x43a115
Function at 0xdbf370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xdbf38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xde8074
push ecx
mov edi, eax
call fcn.00dd3198
mov esi, eax
add esp, 8
test esi, esi
jne 0xdbf3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00dd302e
push esi
call fcn.00dd2fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xdc2850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xdc28ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xded720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xdc28ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00dd31e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xdc28ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xded720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xdc292a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00dd4082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xdc2957
mov word [eax], si
add eax, 2
push eax
call fcn.00dd4030
add esp, 4
jmp 0xdc2959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xdc28ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xdc28b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xdc2ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret