joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb2eb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
mov edi, ecx
push 0x40d
push dword [edi + 4]
call ebx
xor esi, esi
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x40e
push dword [edi + 4]
lea ecx, [ebp - 0x28]
call fcn.0041f436
cmp dword [ebp - 0x1c], esi
je 0x4cb3c1
push 0x122
lea eax, [ebp - 0x18]
push 0x52ccb4
push eax
call fcn.00424092
push esi
push 3
push dword [eax]
push dword [0x577c88]
push dword [ebp - 0x28]
call fcn.0042067a
mov ecx, dword [ebp - 0x18]
add esp, 0x20
lea ecx, [ecx - 0x10]
call fcn.004042e9
push 0xa
lea ecx, [ebp - 0x28]
call fcn.004b3e6a
push 0xa
pop eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call fcn.004b3e43
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push str.safemon_skin_browserfix_search_failed_tab2.png
push dword [0x577c88]
push eax
call fcn.0041bbfe
mov ecx, dword [esi]
add esp, 0xc
push dword [eax]
push dword [0x577c88]
push esi
call dword [ecx + 0x14]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
xor esi, esi
push 0x545a50
push 0x40e
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x40e
push dword [edi + 4]
call ebx
push 0x40
push 0x4f
push 0xd6
push pe_nt_image_headers32
push 0x7d
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x618
push dword [edi + 4]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x616
push dword [edi + 4]
lea ecx, [ebp - 0x38]
call fcn.0041f436
cmp dword [ebp - 0x2c], 0
je 0x4cb4b0
push 0x122
lea eax, [ebp - 0x18]
push 0x52ccb4
push eax
call fcn.00424092
push esi
push 3
push dword [eax]
push dword [0x577c88]
push dword [ebp - 0x38]
call fcn.0042067a
mov ecx, dword [ebp - 0x18]
add esp, 0x20
lea ecx, [ecx - 0x10]
call fcn.004042e9
push 0xa
lea ecx, [ebp - 0x38]
call fcn.004b3e6a
push 0xa
pop eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call fcn.004b3e43
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
push str.safemon_skin_browserfix_search_failed_tab4.png
push dword [0x577c88]
push eax
call fcn.0041bbfe
mov ecx, dword [esi]
add esp, 0xc
push dword [eax]
push dword [0x577c88]
push esi
call dword [ecx + 0x14]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
xor esi, esi
push 0x545b68
push 0x616
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x616
push dword [edi + 4]
call ebx
push 0x40
push 0x4f
push 0xd6
push pe_nt_image_headers32
push 0x16d
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x61c
push dword [edi + 4]
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x4cc0b3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2004]
push 0x2000
push 0
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2004]
push 0x1000
push eax
push 0x408
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4cc142
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
lea ecx, [esi + 0x114]
call fcn.00404550
mov ecx, dword [esi + 0x114]
sub ecx, 0x10
push ecx
call fcn.00402f5d
add eax, 0x10
pop ecx
mov dword [edi], eax
jmp 0x4cc14e
push 0x527fb4
mov ecx, edi
call fcn.00402af5
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret 4

Function at 0x4ccc6d
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 4], ebx
lea esi, [edi + 0x20]
mov dword [edi + 0x14], ebx
mov ecx, esi
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
call fcn.004b51f4
lea ecx, [edi + 0x2c]
mov dword [esi], vtable.CCoolUIPageImpl_class_CSearchResultPage__class_CPageBase_.0
call fcn.0049e215
mov dword [esi], vtable.CSearchResultPage.1.0
lea esi, [edi + 0x428]
mov dword [edi], vtable.CSearchResultPage.0
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0041b790
mov dword [esi], eax
lea ecx, [edi + 0x43c]
mov dword [edi + 0x430], ebx
mov dword [edi + 0x434], ebx
mov dword [edi + 0x438], ebx
call fcn.004b4059
lea esi, [edi + 0x444]
call fcn.00403a64
push eax
mov ecx, esi
call fcn.00402a6b
lea ecx, [edi + 0x454]
call fcn.004cce4b
lea ecx, [edi + 0x474]
call fcn.004b4002
mov dword [edi + 0x4f4], ebx
lea ecx, [edi + 0x568]
mov dword [edi + 0x4f8], ebx
mov dword [edi + 0x4fc], ebx
mov dword [edi + 0x500], ebx
mov dword [edi + 0x504], ebx
mov dword [edi + 0x508], ebx
mov dword [edi + 0x50c], ebx
mov dword [edi + 0x510], ebx
mov dword [edi + 0x514], ebx
mov dword [edi + 0x518], ebx
mov dword [edi + 0x51c], ebx
mov dword [edi + 0x520], ebx
mov dword [edi + 0x524], ebx
mov dword [edi + 0x528], ebx
mov dword [edi + 0x52c], ebx
mov dword [edi + 0x53c], ebx
mov dword [edi + 0x540], ebx
mov dword [edi + 0x54c], 1
mov dword [edi + 0x550], ebx
mov dword [edi + 0x554], ebx
mov dword [edi + 0x558], ebx
mov dword [edi + 0x55c], ebx
mov dword [edi + 0x560], ebx
mov dword [edi + 0x564], ebx
call fcn.004cc024
mov dword [edi + 0x694], ebx
mov dword [edi + 0x420], ebx
mov dword [edi + 0x424], ebx
mov ebx, 0x527fb4
push ebx
mov dword [edi + 0x24], 0x51
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00404550
xor eax, eax
mov dword [edi + 0x44c], eax
mov dword [edi + 0x450], eax
mov dword [edi + 0x470], eax
mov dword [edi + 0x530], eax
mov dword [edi + 0x30], eax
push eax
push eax
push edi
push 0x4cfafa
push eax
push eax
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4cd1d5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x4cd1ee
xor eax, eax
jmp 0x4cd401
push 0xb4
push dword [edi - 0x1c]
lea ecx, [edi + 0xc]
call fcn.0049eb76
lea ecx, [edi + 0x34]
call fcn.0046ff28
xor ebx, ebx
lea ecx, [edi - 0x20]
push ebx
call fcn.004cf088
push 2
pop eax
mov dword [edi + 0x448], ebx
push 0x7f00
mov dword [0x576d6c], 0x51
mov dword [0x576d70], eax
mov dword [0x576d74], eax
push ebx
mov dword [edi + 0x450], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push esi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea ebx, [edi + 0x3d0]
push esi
mov ecx, ebx
call fcn.00410dd4
lea ecx, [edi + 0x410]
call fcn.004b51cf
lea esi, [edi + 0x14]
test esi, esi
je 0x4cd276
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [edi + 0x4e0]
call fcn.00443f96
lea ecx, [edi + 0x4ec]
call fcn.00443f96
lea ecx, [edi + 0x4f8]
call fcn.00443f96
lea ecx, [edi + 0x504]
call fcn.00443f96
lea ecx, [edi + 0x530]
call fcn.00443f96
lea ecx, [edi + 0x53c]
call fcn.004b51cf
push 0
push 0
push ecx
mov ecx, esp
push dword [ebp + 8]
call fcn.00402af5
lea ecx, [ebp - 0x14]
call fcn.004cce07
push eax
lea ecx, [edi + 0x434]
call fcn.004cd022
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004042e9
test esi, esi
je 0x4cd2f1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebx + 0x14], 8
mov dword [ebp + 8], ebx
jb 0x4cd2ff
mov eax, dword [ebx]
mov dword [ebp + 8], eax
push 0x408
push dword [edi - 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
mov ecx, 0x576ca4
call fcn.004286b9
lea ecx, [edi + 0xc]
mov dword [0x576d80], 2
call fcn.0049eafa
mov eax, dword [edi + 0x42c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4cd34e
push eax
call ebx
and dword [edi + 0x42c], 0
test esi, esi
je 0x4cd359
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x518]
xor ecx, ecx
push eax
push ecx
lea eax, [edi - 0x20]
push eax
push 0x4cf97b
push ecx
push ecx
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [edi + 0x42c], eax
test esi, esi
je 0x4cd392
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4cd392
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
lea eax, [edi + 0x51c]
push eax
push ecx
lea eax, [edi - 0x20]
mov dword [edi + 0x514], ecx
push eax
push 0x4cf749
push ecx
push ecx
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
push eax
call ebx
test esi, esi
je 0x4cd3c3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 0x3f0]
test ecx, ecx
je 0x4cd3d2
call fcn.004d095c
xor ecx, ecx
lea eax, [edi - 0x20]
push ecx
push ecx
push eax
push 0x4cf80e
xor esi, esi
mov dword [edi + 0x674], ecx
push ecx
inc esi
push ecx
mov dword [edi + 0x52c], esi
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
test eax, eax
je 0x4cd3ff
push eax
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ce336
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2000
lea eax, [ebp - 0x2004]
mov esi, ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x408
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x1000
lea ecx, [ebp - 0x2004]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2004]
push eax
lea ecx, [ebp - 0x2008]
call fcn.00402af5
lea ecx, [ebp - 0x2008]
call fcn.004046aa
push 0x527fb4
push dword [eax]
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4ce3db
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esi + 0x28]
lea eax, [ebp - 0x2004]
push 0
push eax
push 0x1dcf
mov eax, dword [ecx]
call dword [eax]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x2008]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret
Function at 0x4cecf5
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x470], ebx
je 0x4ced62
cmp dword [esi + 0x44c], ebx
jne 0x4ced62
push dword [esi + 0x408]
lea ecx, [esi + 0x54]
call fcn.00470283
test eax, eax
jne 0x4ced62
cmp dword [esi + 0x54c], ebx
je 0x4ced62
push ecx
mov ecx, esp
push 0x542070
call fcn.00402af5
mov ecx, esi
call fcn.004cdebe
push 0xffffffffffffffe2
lea ecx, [esi + 0x54]
call fcn.0047148f
lea eax, [esi + 0x538]
push eax
push ebx
push esi
push 0x4cf97b
push ebx
push ebx
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi + 0x44c], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x4cf088
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
jne 0x4cf0c4
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x60f
push dword [ebx + 4]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
push 0x610
push dword [ebx + 4]
call esi
xor esi, esi
push esi
push eax
call edi
jmp 0x4cf102
cmp esi, 1
jne 0x4cf116
cmp dword [ebx + 0x548], 0
jne 0x4cf17c
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x60f
push dword [ebx + 4]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
push 0x610
push dword [ebx + 4]
call esi
push 5
push eax
call edi
xor esi, esi
push esi
push dword [ebx + 0x58]
call edi
push esi
push dword [ebx + 0x1fc]
call edi
mov esi, dword [ebp + 8]
jmp 0x4cf17c
cmp esi, 2
jne 0x4cf17c
push 0x60f
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
push 0x610
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call edi
push 5
push dword [ebx + 0x58]
call edi
lea ecx, [ebx + 0x1f8]
call fcn.004702c8
test eax, eax
je 0x4cf167
push 5
push dword [ebx + 0x1fc]
call edi
push 0x5d4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov dword [ebx + 0x548], esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4cf220
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2004]
push esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x408
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x1000
lea ecx, [ebp - 0x2004]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2004]
push eax
lea ecx, [ebp - 0x2008]
call fcn.00402af5
lea ecx, [ebp - 0x2008]
call fcn.004046aa
push 0x527fb4
push dword [eax]
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4cf2c7
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x28]
lea eax, [ebp - 0x2004]
push esi
push eax
push 0x1dcf
mov eax, dword [ecx]
call dword [eax]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
inc esi
mov ecx, dword [ebp - 0x2008]
add ecx, 0xfffffff0
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret

Function at 0x4d095c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x40d
push dword [ebx + 4]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
call edi
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0x61b
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x40e
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x61f
push dword [ebx + 4]
call edi
push 0
push eax
call esi
xor esi, esi
mov ecx, ebx
inc esi
push esi
push 0x40d
call fcn.004d0ee6
push esi
push 0x61b
mov ecx, ebx
call fcn.004d0ee6
push esi
push 0x40e
mov ecx, ebx
call fcn.004d0ee6
push esi
push 0x61f
mov ecx, ebx
call fcn.004d0ee6
pop edi
pop esi
pop ebx
ret

Function at 0x4d1474
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x576d7c]
push dword [edi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x30]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044479f
mov ecx, dword [0x576d7c]
mov eax, dword [ebp - 8]
push 0
mov edx, dword [ecx]
push dword [eax + 0x14]
push 0x51
call dword [edx + 0xc]
pop edi
leave
ret 0xc
Function at 0x4d14da
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
mov edi, ecx
lea ecx, [ebp - 0x30]
push 0
push 1
push dword [edi + 4]
call fcn.00419f27
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x4d1552
push 0x546110
push dword [0x577c88]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x2f
push eax
mov dword [ebp - 0x10], 0x3b
mov dword [ebp - 0xc], 0x5e
mov dword [ebp - 8], 0x76
call fcn.0041bbfe
mov ecx, dword [esi]
lea edx, [ebp - 0x14]
add esp, 0xc
push edx
push 7
push dword [eax]
push esi
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004042e9
push 0x7fbc
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0
push dword [edi + 4]
call esi
mov ecx, edi
call fcn.004d1f5f
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004042e9
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.00522d04
leave
ret 8

Function at 0x4d17bf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4d17e2
mov eax, dword [ebp + 0xc]
xor edx, edx
push 0x41
push edx
push edx
push dword [eax + 4]
push dword [eax]
push edx
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4d17ed
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 8
Function at 0x4d2564
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 0xc], esi
cmp dword [esi + 8], 0
je 0x4d2666
push ebx
push 1
push dword [esi + 0x10]
push 0x30
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, word [esi]
push 5
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov dword [ebp - 0x10], ebx
call fcn.004d2684
and dword [ebp - 4], 0
push ebx
mov dword [ebp - 8], eax
call fcn.004d2669
pop ecx
pop ecx
xor ecx, ecx
cmp cx, word [eax]
jae 0x4d2647
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
mov ecx, dword [ebp - 4]
push edi
mov edi, dword [ebp - 0x14]
test ecx, ecx
jne 0x4d25e7
push 5
push dword [esi + 8]
jmp 0x4d25ea
push 2
push edi
call ebx
mov edi, eax
test edi, edi
je 0x4d2646
mov esi, dword [ebp - 8]
push edi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp eax, dword [esi + 0x14]
je 0x4d260c
push 2
push edi
call ebx
mov edi, eax
test edi, edi
jne 0x4d25f5
mov esi, dword [ebp - 0xc]
test edi, edi
je 0x4d2646
push 1
push dword [esi + 0x10]
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [ebp - 8]
call fcn.004d271a
push dword [ebp - 0x10]
inc dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.004d2669
mov ecx, dword [ebp - 4]
add esp, 0xc
movzx eax, word [eax]
cmp ecx, eax
jl 0x4d25dc
pop edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [esi + 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
pop ebx
pop esi
leave
ret

Function at 0x4d2b5b
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 8]
mov edi, ecx
push eax
lea eax, [ebp - 4]
xor ecx, ecx
push eax
push 5
push dword [edi]
mov dword [ebp - 4], ecx
push ecx
mov dword [ebp - 8], ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4d2baf
mov eax, dword [ebp - 8]
push esi
shr eax, 1
push eax
push dword [ebp - 4]
call fcn.00512b20
mov esi, dword [ebp - 4]
push esi
call sub.msvcrt.dll_wcslen
add esp, 0xc
lea ecx, [edi + 0x20]
push eax
push esi
call fcn.00410dd4
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
pop esi
pop edi
leave
ret
Function at 0x4d2d7a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x12c
xor ebx, ebx
push ebx
push str.IEFrame
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4d2dd9
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], ebx
jbe 0x4d2dd9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 4]
je 0x4d2dd9
push dword [ebp - 4]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub edi, 1
jne 0x4d2d88
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d2dfe
Capabilities:
Acquire debug privileges

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push 1
push str.SeIncreaseQuotaPrivilege
mov edi, ecx
call esi
push eax
mov ecx, edi
call fcn.004d2d00
push 1
push str.SeDebugPrivilege
call esi
push eax
mov ecx, edi
call fcn.004d2d00
push 1
push str.SeSecurityPrivilege
call esi
push eax
mov ecx, edi
call fcn.004d2d00
push 1
push str.SeShutdownPrivilege
call esi
push eax
mov ecx, edi
call fcn.004d2d00
pop edi
pop esi
ret

Function at 0x4d2e88
Capabilities:
Enumerate processes on remote desktop session host
Terminate process

Disassembly:
push esi
mov esi, ecx
call fcn.004d2e4f
cmp dword [esi + 0x44], 0
mov ecx, esi
je 0x4d2e9e
pop esi
jmp fcn.004d2eaf
call fcn.004d36ca
mov ecx, esi
pop esi
test al, al
jne 0x4d2e99
jmp fcn.004d30dd

Function at 0x4d3226
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x468], esi
lea edi, [ebp - 0x424]
mov dword [ebp - 0x43c], 1
stosd dword es:[edi], eax
mov esi, 0x208
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push esi
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
push str.__sexplorer.exe_
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.00523653
add esp, 0x10
lea eax, [ebp - 0x424]
mov ecx, 0x576d98
push eax
lea eax, [ebp - 0x468]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.004db9e4
test eax, eax
je 0x4d3320
push 0x3e8
push dword [ebp - 0x424]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
mov al, 1
jmp 0x4d3322
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x4d3331
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x414]
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
push str.__sexplorer.exe_
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.00523653
push 0x44
pop edi
push edi
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x10
lea eax, [ebp - 0x424]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x28
mov dword [ebp - 0x468], edi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push ebx
push ebx
push 0x10
lea eax, [ebp - 0x414]
push eax
push ebx
push 1
push dword [esi + 0x40]
call dword [esi + 0x44]
test eax, eax
je 0x4d3416
push 0x3e8
push dword [ebp - 0x424]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x420]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x424]
call esi
jmp 0x4d343a
cmp byte [ebp + 8], bl
jne 0x4d343a
mov ecx, esi
call fcn.004d3226
test al, al
jne 0x4d343a
mov ecx, esi
call fcn.004d3609
test al, al
je 0x4d343a
push 1
mov ecx, esi
call fcn.004d3331
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 4