joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477ae3
Capabilities:
Get common file path

Disassembly:
push 0x86c
mov eax, 0x4a224c
call fcn.0049fa2f
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x878], esi
push 0x802
xor ebx, ebx
mov dword [ebp - 0x878], esi
lea eax, [ebp - 0x814]
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x477c46
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x844]
call fcn.00464fbb
mov edx, edi
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x85c]
call fcn.0046ef25
push eax
mov edx, str.AdobeHeadlightsCCHLLog_
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x874]
call fcn.00464fbb
mov byte [ebp - 4], 5
mov ecx, eax
mov dword [esp], 0x4b9560
call fcn.00464fbb
push eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x818], ebx
call fcn.00464fbb
mov byte [ebp - 4], 6
lea eax, [ebp - 0x82c]
cmp dword [ebp - 0x818], 8
lea ecx, [ebp - 0x844]
push dword [ebp - 0x81c]
cmovae eax, dword [ebp - 0x82c]
push eax
call fcn.00472323
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
lea ecx, [ebp - 0x874]
call fcn.0046d98d
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], bl
call fcn.0046d98d
lea edx, [ebp - 0x844]
lea ecx, [ebp - 0x85c]
call fcn.004711e9
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004708e3
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0046d98d
test bl, bl
je 0x477c37
lea edx, [ebp - 0x844]
mov ecx, esi
call fcn.0046ee68
lea ecx, [ebp - 0x844]
call fcn.0046d98d
jmp 0x477c52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call fcn.0046d98d
push 0x4adacc
mov ecx, esi
call fcn.00464fbb
mov eax, esi
call fcn.0049f9de
ret

Function at 0x477c5a
Capabilities:
Get common file path

Disassembly:
push 0x83c
mov eax, 0x4a229b
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x848], esi
push 0x802
xor ebx, ebx
mov dword [ebp - 0x848], esi
lea eax, [ebp - 0x814]
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x477d2d
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00464fbb
push 0x20
push str.AdobeRTTransferRTDebugLog.txt
lea ecx, [ebp - 0x82c]
mov dword [ebp - 4], ebx
call fcn.00472323
lea edx, [ebp - 0x82c]
lea ecx, [ebp - 0x844]
call fcn.004711e9
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004708e3
lea ecx, [ebp - 0x844]
mov byte [ebp - 4], 0
mov bl, al
call fcn.0046d98d
test bl, bl
je 0x477d1e
lea edx, [ebp - 0x82c]
mov ecx, esi
call fcn.0046ee68
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
jmp 0x477d39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.0046d98d
push 0x4adacc
mov ecx, esi
call fcn.00464fbb
mov eax, esi
call fcn.0049f9de
ret
Function at 0x47f3f2
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a3862
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb43c
mov ecx, dword [eax]
mov eax, dword [0x4cb438]
cmp eax, dword [ecx + 4]
jle 0x47f46f
push 0x4cb438
call fcn.00464fbb
cmp dword [0x4cb438], 0xffffffff
pop ecx
jne 0x47f46f
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00464fbb
push 0x4a6690
call fcn.00464fbb
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb438
call fcn.00464fbb
pop ecx
cmp dword [0x4cb44c], 0
jne 0x47f590
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.00464fbb
test al, al
je 0x47f563
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.00464fbb
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.00464fbb
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.00464fbb
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb43c
cmp esi, edi
je 0x47f550
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.00464fbb
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x47f590
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.00464fbb
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret

Function at 0x47f7a8
Capabilities:
Get session user name

Disassembly:
push 0x254
mov eax, 0x4a38b6
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x260], esi
xor eax, eax
mov dword [ebp - 0x260], esi
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x260], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00464fbb
and dword [ebp - 4], 0
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x22c]
call fcn.0046ee68
push str.AdobeHeadlights
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.00464fbb
mov byte [ebp - 4], 2
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0x10
lea ecx, [ebp - 0x244]
push dword [ebp - 0x21c]
cmovae eax, dword [ebp - 0x22c]
push eax
call fcn.0046a372
push eax
mov ecx, esi
call fcn.00469e2b
lea ecx, [ebp - 0x244]
call fcn.0046a23d
lea ecx, [ebp - 0x22c]
call fcn.0046a23d
lea ecx, [ebp - 0x25c]
call fcn.0046d98d
mov eax, esi
call fcn.0049f9de
ret
Function at 0x47fe6f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xf4
mov eax, 0x4a39c0
call fcn.0049fa2f
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], eax
cmp dword [ecx], ebx
jne 0x47fe97
xor al, al
jmp 0x47ff75
push 0x802
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x4c], 0x400
call fcn.00464fbb
mov dword [esp], 0x802
mov edi, eax
push ebx
push edi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47fec9
mov eax, dword [esi]
lea ecx, [ebp - 0x4c]
push ecx
push edi
lea ecx, [ebp - 0x44]
push ecx
push ebx
push eax
mov eax, dword [ebp - 0x50]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdq
cmp eax, ebx
jne 0x47ff55
cmp edx, ebx
jne 0x47ff55
cmp dword [ebp - 0x44], 4
jne 0x47ff48
mov esi, dword [edi]
push ecx
lea ecx, [ebp - 0x100]
call fcn.0048014f
push esi
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047276e
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x28]
push eax
call fcn.00464fbb
lea ecx, [ebp - 0x28]
call fcn.0046d98d
lea ecx, [ebp - 0x98]
call fcn.0048011f
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
jmp 0x47ff51
mov ecx, dword [ebp - 0x48]
push edi
call fcn.00464fbb
mov bl, 1
jmp 0x47ff6c
push esi
mov edx, str.Query_registry_value_with_key:
lea ecx, [ebp - 0x40]
call fcn.00464fbb
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0046d98d
push edi
call fcn.0048844b
pop ecx
mov al, bl
call fcn.0049f9de
ret 8

Function at 0x48ab60
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push esi
xor esi, esi
cmp ecx, edx
je 0x48ab95
nop
movsx eax, byte [ecx]
inc ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp ecx, edx
jne 0x48ab70
mov eax, 3
mov ecx, esi
mul esi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
imul ecx, ecx, 0x7fffffff
sub esi, ecx
or esi, 0x40000000
mov eax, esi
pop esi
ret
Function at 0x409130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40913f
pop dword [ebp - 0x1c]
mov eax, 0xe0fdb0bb
add eax, 0x1f42e084
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd80524f0
add dword [ebp - 0x2c], 0x764d205b
mov dword [ebp - 0x28], 0x6b922121
add dword [ebp - 0x28], 0xc6a12b24
mov dword [ebp - 0x24], 0x924ad280
add dword [ebp - 0x24], 0xba0171ae
mov dword [ebp - 0x20], 0x136e9679
add dword [ebp - 0x20], 0xec916987
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xc39f866c
sub eax, 0xc35f745c
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x74b03fff
sub dword [ebp - 0x2c], 0x3dd6a9
mov dword [ebp - 0x28], 0x95abdbce
sub dword [ebp - 0x28], 0x543f7a59
mov dword [ebp - 0x24], 0x9bd454b3
add dword [ebp - 0x24], 0xc79b17b9
mov dword [ebp - 0x20], 0xfdd8198b
sub dword [ebp - 0x20], 0xfdd8198b
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x4bab4bf
add eax, 0xfb855cbd
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bb0d
push 0
call eax
mov ecx, 0x153911ac
sub ecx, 0x1538cee7
mov ebx, eax
mov esi, 0x92e05c84
add esi, 0x6d61ef7c
add esi, dword [ebp - 0x1c]
mov edx, 0x137400cc
sub edx, 0xd2b3ba01
xor dword [ebp - 0x10], ecx
mov edi, dword [esi]
add dword [ebp - 0x14], 0x5ecbdc8a
add edi, edx
add dword [ebp - 0x18], eax
mov dword [ebx], edi
sub dword [ebp - 0xc], edx
add ebx, 0x2fc5f21
sub ebx, 0x2fc5f1d
add esi, 0x2f5349f7
add esi, 0xd0acb60d
loop 0x409261
add eax, 0xb1b23c6
add eax, 0xf4e5da21
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3ca2628e
add ecx, 0xc39d9d72
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x1008723
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x100c5d0
call fcn.01008748
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100d894
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1008538
cmp eax, esi
jne 0x100852b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100853b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1008512
xor esi, esi
inc esi
mov eax, dword [0x100d890]
cmp eax, esi
jne 0x100854e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1008589
mov eax, dword [0x100d890]
test eax, eax
jne 0x1008583
mov dword [0x100d890], esi
push 0x1001178
push 0x100116c
call fcn.0100848f
pop ecx
pop ecx
test eax, eax
je 0x1008589
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1008653
mov dword [0x100d53c], esi
mov eax, dword [0x100d890]
cmp eax, esi
jne 0x10085ad
push 0x1001168
push 0x1001160
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100d890], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10085ba
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100d89c], ebx
je 0x10085db
push 0x100d89c
call fcn.01008db9
pop ecx
test eax, eax
je 0x10085db
push ebx
push 2
push ebx
call dword [0x100d89c]
push dword [0x100d524]
push dword [0x100d528]
push dword [0x100d520]
call fcn.0100535b
add esp, 0xc
mov dword [0x100d538], eax
cmp dword [0x100d52c], ebx
jne 0x1008639
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100d53c], ebx
jne 0x1008647
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100d538]
call fcn.0100878d
ret
call fcn.01008f06
jmp 0x10084f0
Function at 0x401dc0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5f38
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x648ff4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00481efe
push 0
call fcn.004830b7
push 0xc
call fcn.004811d1
add esp, 8
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401e49
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00483f59
mov esi, eax
jmp 0x401e4b
xor esi, esi
push 0x5f79fc
mov dword [ebp - 4], 0xffffffff
call fcn.0048c8a8
push 0x62aa38
mov ecx, edi
call fcn.00490078
push 0xd8
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.005cb920
add esp, 0xc
lea ecx, [ebp - 0xf0]
push 0
push 0x66
call fcn.00497697
mov dword [ebp - 4], 1
mov dword [ebp - 0xf0], 0x62ad7c
call fcn.00497f7c
call fcn.00497f7c
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.004908a8
test esi, esi
je 0x401ede
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.00491897
lea ecx, [ebp - 0x30]
call fcn.0049593c
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], vtable.CBrush.0
call fcn.00402c30
lea ecx, [ebp - 0xf0]
call fcn.00490351
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9ac0
mov esp, ebp
pop ebp
ret

Function at 0x4020d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x4020f9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40210f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402106
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402142
nop
cmp esi, ecx
jae 0x402106
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402130
cmp esi, ecx
jae 0x402106
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4021f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00494167
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x4022f1
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4022f1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4022f1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4022f1
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402278
cmp esi, ecx
jae 0x4022f1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402262
cmp esi, ecx
jae 0x4022f1
movzx eax, word [esi]
test ax, ax
je 0x4022f1
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x4022ab
push edi
mov ecx, ebx
call fcn.00402980
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x4022ae
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.005cffca
add esp, 0x10
cmp eax, 0x50
ja case.0x4022cc.1
movzx eax, byte [eax + 0x402320]
jmp dword [eax*4 + 0x402310]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402301
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00493ad9
push 0x80070057
call fcn.00402a30
call fcn.00493abf
shl dword [edx], cl
inc eax
add ah, bh
and al, byte [eax]
or esp, dword [ebx]
inc eax
add byte [ebx], cl
and eax, dword [eax]
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3

Function at 0x402d90
Capabilities:
Block operations on executable memory pages using arbitrary code guard

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x648ff4]
xor eax, ebp
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c9ac0
mov esp, ebp
pop ebp
ret
Function at 0x4811a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00490535

Function at 0x48370e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x483753
call fcn.00497f7c
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x483750
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48379a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x483776
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5f69ac]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x483797
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x5f69ac]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x48fcf2
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x48fd45
push esi
push dword [ebp + 8]
call fcn.0048fedb
mov edi, eax
test edi, edi
je 0x48fd40
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x48fd40
mov eax, dword [ebp - 8]
jmp 0x48fd57
mov eax, dword [ebp + 0x10]
jmp 0x48fd57
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x49058d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00497f7c
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4905c0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.004905d3
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x49aaee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x49ab2d
call fcn.00497f7c
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49ab2d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49ab35
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0051a924
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x49b52c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x49b5b8
cmp dword [esi + 0x20], 0
je 0x49b5b8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49b5b8
cmp dword [ebp + 8], 0
je 0x49b5b8
xor edi, edi
mov ebx, edi
call fcn.00497f7c
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x49b59c
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49b5b8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0053bab5
mov edi, eax
add esp, 0xc
test edi, edi
je 0x49b5b4
mov ecx, esi
call fcn.0049b2ca
mov eax, edi
jmp 0x49b5ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x49fefb
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5e61eb
call fcn.005c9f67
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x49ff21
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x49ff7b
lea ecx, [ebp - 0x10]
call fcn.00402070
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5f69ac]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005d1014
push eax
call fcn.00402160
add esp, 0x14
test esi, esi
je 0x49ff6e
push esi
call fcn.005d027b
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402890
mov eax, ebx
call fcn.005c9f35
ret 8