joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fd10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
xor esi, esi
lea ecx, [ebp - 0x224]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.gdiplus.dll_Ordinal_1
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
call fcn.0048fe60
mov edi, dword [ebp - 0x224]
test eax, eax
jne 0x48fdf7
push 0x20a
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004c49e0
add esp, 0xc
mov dword [ebp - 0x214], 0x414
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push str.AutoConfigURL
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48fdf7
mov eax, dword [ebp - 0x218]
cmp eax, 1
je 0x48fdb3
cmp eax, 2
jne 0x48fdf7
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x48fdcf
test al, 1
jne 0x48fdf7
shr eax, 1
cmp word [ebp + eax*2 - 0x212], si
je 0x48fdd8
jmp 0x48fdf7
xor eax, eax
mov word [ebp - 0x210], ax
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48fde1
sub ecx, edx
sar ecx, 1
je 0x48fdf7
mov esi, 1
mov eax, dword [0x543020]
test eax, eax
jne 0x48fe23
push 0x543eb0
push 0x2c
call fcn.004c203f
add esp, 8
test eax, eax
je 0x48fe1c
mov ecx, eax
call fcn.00485670
jmp 0x48fe1e
xor eax, eax
mov dword [0x543020], eax
push esi
push str.use_pac_proxy:_d
push str.proxy
push eax
call fcn.00486af0
add esp, 0x10
test edi, edi
je 0x48fe42
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
Function at 0x490230
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
test eax, eax
je 0x490406
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x490406
call fcn.0048afd0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push esi
push 0x50f7a0
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call fcn.0048af70
add esp, 0x14
cmp eax, 0xffffffff
je 0x4903eb
push edi
test eax, eax
jne 0x4903c9
mov edx, dword [0x54546c]
mov dword [ebp - 0x30], edx
test edx, edx
jne 0x4902bd
mov dword [ebp - 0x30], 0x50f7a0
mov eax, dword [ebp - 0x24]
add eax, eax
mov edx, dword [esi + eax*8]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4902e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.00407020
mov esi, dword [ebx]
mov eax, esi
mov edi, dword [esi + 4]
cmp byte [edi + 0xd], 0
jne 0x49032a
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00408ee0
test al, al
je 0x49031e
mov edi, dword [edi + 8]
jmp 0x490322
mov esi, edi
mov edi, dword [edi]
cmp byte [edi + 0xd], 0
je 0x490306
mov eax, dword [ebx]
cmp esi, eax
je 0x490341
lea eax, [esi + 0x10]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408ee0
test al, al
je 0x49036f
lea eax, [ebp - 0x1c]
mov ecx, ebx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x4fad12
call fcn.00418930
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00418990
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x30]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490377
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x28]
call fcn.00407020
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x4903c6
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4903bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x490418
push edx
push ecx
call fcn.004c1d47
add esp, 8
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push eax
push esi
push 0x50f7a0
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call fcn.0048af70
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4902a1
pop edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
call fcn.004c7ca1
int3
Function at 0x490580
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x490601
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x490590
sub ecx, edx
sar ecx, 1
je 0x490601
push str.Program_Manager
push str.Progman
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4905be
push eax
call fcn.004919f0
add esp, 4
push 5
push 0
push 0
push esi
push str.open
call fcn.00491520
add esp, 0x14
test al, al
je 0x4905e0
mov ecx, 1
mov eax, ecx
pop esi
pop ebp
ret
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
pop esi
setg cl
mov eax, ecx
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4912d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0xc
mov ecx, dword [0x5441c8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x543738]
cmp eax, dword [ecx + 4]
jg 0x4913ba
cmp dword [0x53a318], 0
jne 0x4913a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0048f3b0
add esp, 8
cmp eax, 0x20
jne 0x491324
push 0xa
push str.safe_cloud
jmp 0x49139c
cmp eax, 1
jne 0x491395
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push str.safe_jisu
push str.SOFTWARE360safe
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49138c
cmp dword [ebp - 4], 1
jne 0x49138c
push str.safe_jisu
mov ecx, 0x53a308
call fcn.00407160
mov ecx, dword [ebp + 8]
push 0x53a308
call fcn.004071e0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
push 0xa
push str.safe_geren
jmp 0x49139c
push 0xb
push str.safe_unknow
mov ecx, 0x53a308
call fcn.00407020
mov ecx, dword [ebp + 8]
push 0x53a308
call fcn.004071e0
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
push 0x543738
call fcn.004c1ef5
add esp, 4
cmp dword [0x543738], 0xffffffff
jne 0x4912f6
push 0x4f7550
call fcn.004c1caa
push 0x543738
call fcn.004c1eab
add esp, 8
jmp 0x4912f6
Function at 0x4919f0
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x491a62
push esi
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x491a12
push 9
push ebx
call esi
push 5
push ebx
call esi
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call esi
pop esi
pop ebx
pop ebp
ret

Function at 0x492680
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
call fcn.004833a0
mov ecx, eax
test ecx, ecx
je 0x4927b3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
test ebx, ebx
je 0x4927a1
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4927a1
push edi
mov dword [ebp - 0xb0], vtable.MD5_CTX.0
lea edi, [ebp - 0x54]
mov dword [ebp - 0x98], eax
mov ecx, 0x10
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xac], 0x67452301
mov dword [ebp - 0xa8], 0xefcdab89
mov dword [ebp - 0xa4], 0x98badcfe
mov dword [ebp - 0xa0], 0x10325476
rep stosd dword es:[edi], eax
push edx
push ebx
lea ecx, [ebp - 0xb0]
mov byte [ebp - 0x54], 0x80
call fcn.00492fd0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004927c0
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 8]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, ch
push eax
movzx eax, cl
mov ecx, dword [ebp - 0xc]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
mov edx, dword [ebp - 0x14]
movzx eax, ch
push eax
movzx eax, cl
mov ecx, dword [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0xd]
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx ecx, dh
push ecx
movzx ecx, dl
push ecx
push 0x4fb0c8
push esi
call fcn.004832c0
add esp, 0x48
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00483200
int3
Function at 0x4927c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
lea ecx, [ecx]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x4927e0
mov eax, dword [esi + 0x14]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x492823
mov ecx, 0x78
sub ecx, eax
lea ebx, [esi + 0x5c]
push ecx
push ebx
mov ecx, esi
call fcn.00492fd0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00492fd0
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x492850
xor eax, eax
mov edi, esi
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], 0x67452301
xor ecx, ebp
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
mov byte [ebx], 0x80
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret 4
Function at 0x493200
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.004833a0
mov ecx, eax
test ecx, ecx
je 0x49331c
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], edi
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x4932eb
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4932eb
push ebx
lea eax, [ebp - 0x3c]
xor esi, esi
push eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], esi
xor ebx, ebx
push dword [eax]
call fcn.00493330
add esp, 8
test eax, eax
je 0x493278
mov eax, dword [ebp - 0x34]
mov esi, eax
movzx eax, ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov edi, eax
shr esi, 0x10
shr edi, 0x10
movzx ebx, ax
push ebx
push edi
push dword [ebp - 4]
lea eax, [ebp - 8]
push esi
push str._d._d._d._d
push eax
call fcn.004832c0
mov eax, dword [ebp + 0x10]
add esp, 0x18
test eax, eax
je 0x493298
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4932a4
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4932ad
mov dword [eax], edi
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4932b6
mov dword [eax], ebx
mov edi, dword [ebp - 8]
add edi, 0xfffffff0
push edi
call fcn.00483b30
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
pop ebx
test eax, eax
jg 0x493314
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
add edi, 0xfffffff0
push edi
call fcn.00483b30
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x493314
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00483200
int3
Function at 0x4934a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x80c], ecx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4935a5
push 2
push edi
push 0xffffff00
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], edi
push edi
push eax
call fcn.004c49e0
add esp, 0xc
lea eax, [ebp - 0x808]
push edi
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4935a5
mov eax, dword [ebp - 0x808]
cmp eax, 0x100
ja 0x4935a5
shr eax, 1
cmp eax, 0x11
jb 0x49359e
push esi
lea esi, [ebp + eax*2 - 0x826]
lea eax, [ebp - 0x804]
cmp esi, eax
je 0x49359d
push 0x11
sub esi, 2
push str.____360skin_ver_
push esi
call fcn.004cb87f
add esp, 0xc
test eax, eax
je 0x493577
lea eax, [ebp - 0x804]
cmp esi, eax
jne 0x493554
jmp 0x49359d
test esi, esi
je 0x49359d
mov eax, dword [ebp - 0x80c]
test eax, eax
je 0x49359d
push dword [ebp + 0x10]
push 0
push eax
push esi
call fcn.004935c0
add esp, 0x10
test al, al
je 0x49359d
mov edi, 1
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
Function at 0x494db0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push eax
call fcn.00494be0
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x494deb
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
push eax
call fcn.00483b30
mov esi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [esi], eax
jmp 0x494df8
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00494800
add esp, 8
mov eax, dword [ebp - 4]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x494e13
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x808], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x4969ec
mov esi, dword [esi]
cmp dword [esi - 0xc], 0
je 0x4969ec
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004c49e0
add esp, 0xc
mov dword [ebp - 0x80c], 0x400
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x810], 1
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
mov eax, dword [ebp - 0x808]
push dword [eax]
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4969ec
lea esi, [ebp - 0x804]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x496900
sub esi, ecx
sar esi, 1
jne 0x49692b
mov ecx, edi
call fcn.00483ba0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
lea ebx, [ebp - 0x804]
sub ebx, edx
sar ebx, 1
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x808], eax
test esi, esi
js 0x4969ff
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or ecx, eax
jge 0x496963
push esi
mov ecx, edi
call fcn.004834d0
mov edx, dword [edi]
cmp ebx, dword [ebp - 0x808]
ja 0x4969b3
mov eax, dword [edx - 8]
lea ecx, [esi + esi]
lea ebx, [edx + ebx*2]
test ecx, ecx
je 0x4969c7
test ebx, ebx
jne 0x49698e
call fcn.004cb58e
mov dword [eax], 0x16
call fcn.004c7c91
jmp 0x4969c7
add eax, eax
cmp eax, ecx
jae 0x4969a6
call fcn.004cb58e
mov dword [eax], 0x22
call fcn.004c7c91
jmp 0x4969c7
push ecx
push ebx
push edx
call fcn.004c4ce0
add esp, 0xc
jmp 0x4969c7
push esi
lea eax, [ebp - 0x804]
push eax
push dword [edx - 8]
push edx
call fcn.0048a000
add esp, 0x10
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x4969ff
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [edi]
pop edi
mov word [eax + esi*2], cx
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00483200
int3
Function at 0x496a10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x496aec
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x496aec
mov eax, dword [ebp + 0x10]
push esi
push edi
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp + 0x14], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x496a57
cmp ecx, dword [esi]
jne 0x496a57
lock inc dword [eax]
jmp 0x496a85
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x496af1
mov eax, dword [edi]
mov dword [esi + 4], eax
mov eax, dword [edi]
inc eax
push eax
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.0048a000
add esp, 0x10
mov edi, dword [esi + 4]
add esi, 0x10
mov dword [ebp + 0x14], esi
test edi, edi
js 0x496af6
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x496aaf
push edi
lea ecx, [ebp + 0x14]
call fcn.004834d0
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push ecx
push dword [eax]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
sete bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x496ae5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
xor al, al
pop ebx
pop ebp
ret
call fcn.00483610
push 0x80070057
call fcn.00483200
int3
Function at 0x49f800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x53ac84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x49f870
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x49f870
call fcn.00486080
mov esi, eax
jmp 0x49f95c
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x49f893
call fcn.00486080
jmp 0x49f94f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x49f8ab
call fcn.00486080
jmp 0x49f94f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x49f8c6
mov esi, 0x8007000e
jmp 0x49f951
mov ecx, 2
mul ecx
test edx, edx
ja 0x49f98a
jb 0x49f8e0
cmp eax, 0xffffffff
ja 0x49f98a
cmp eax, 0x400
jbe 0x49f903
push eax
lea ecx, [ebp - 0x408]
call fcn.0049ec70
cmp dword [ebp - 0x408], 0
jne 0x49f90f
mov esi, 0x8007000e
jmp 0x49f951
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], eax
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x49f92f
call fcn.00486080
jmp 0x49f94f
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.0049f660
mov esi, eax
test edi, edi
je 0x49f95c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x49f975
lea ecx, [ebp - 0x408]
call fcn.0049ef80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c1fe9
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00483200
int3
Function at 0x4a1ab0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
test eax, eax
jne 0x4a1ad1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4a1c36
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4a1b53
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4a1b53
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a1b4c
lea eax, [ebp + 0xc]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
setns bl
jmp 0x4a1b53
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4a1c36
mov edi, dword [ebp + 0xc]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x4a1b94
lea eax, [ebp - 4]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x4a1b96
xor esi, esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push esi
mov dword [ebp - 8], 0
call fcn.00420bb0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4a1bfc
mov eax, dword [ecx + 8]
mov dword [ecx + 8], 0
test eax, eax
jne 0x4a1bfc
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [esi], ecx
lea ecx, [ebp - 0xc]
mov dword [esi + 4], eax
call fcn.0041a920
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4a1c53
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov dword [esi], 0
mov dword [esi + 4], 0
test edi, edi
je 0x4a1be6
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4a1be6
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x4a1be6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
jmp 0x4a1be6
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
test ecx, ecx
je 0x4a1c53
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret