joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5ba980]
sub esp, 0x1c
mov eax, dword [ecx + 0x614]
push esi
push edi
push 4
mov dword [ecx + 0x618], eax
call fcn.004b30d0
push 0x58bdf0
call fcn.004b3060
movzx eax, word [ebp + 8]
add esp, 8
push 0x592048
push eax
call fcn.004ab0b0
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x46f7cf
push esi
call fcn.004ab0b0
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x46f7cf
push esi
call fcn.004ab0b0
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
test esi, esi
je 0x46f7cf
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
push dword [ebp + 8]
lea ecx, [eax + esi]
push ecx
mov ecx, dword [0x5ba980]
push eax
push dword [ecx + 0x618]
add ecx, 0x614
call fcn.004077f0
mov ecx, dword [0x5ba980]
mov eax, dword [ecx + 0x618]
sub eax, dword [ecx + 0x614]
je 0x46f7cf
push 9
push str.1Nc:P3n_.
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.00406610
mov esi, dword [0x5ba980]
lea ecx, [ebp - 0x1c]
lea edx, [esi + 0x614]
call fcn.00413400
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x46f7b5
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46f7a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46f7d7
push edx
push ecx
call fcn.00497d51
mov esi, dword [0x5ba980]
add esp, 8
mov ecx, dword [esi + 0x614]
mov eax, dword [esi + 0x618]
push 0
sub eax, ecx
push eax
push ecx
call fcn.004b30e0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00524a29
int3
Function at 0x472c10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push 0x58f530
call fcn.004a31d0
test eax, eax
je 0x472c46
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x477ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a6050
push 0x5207b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5b0514]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], edx
mov edx, ecx
mov dword [ebp - 0x2c], edx
xor esi, esi
test edx, edx
jne 0x477f25
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [edx + 0x3c]
mov ebx, dword [eax + edx + 0x78]
add ebx, edx
mov eax, dword [ebx + 0x1c]
add eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebx + 0x20]
add ecx, edx
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebx + 0x24]
add edi, edx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x20]
test eax, 0xffff0000
jne 0x477f71
movzx eax, ax
sub eax, dword [ebx + 0x10]
mov esi, dword [ebp - 0x24]
mov esi, dword [esi + eax*4]
add esi, edx
jmp 0x477fde
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x34], ebx
mov eax, ebx
dec ebx
mov dword [ebp - 0x34], ebx
test eax, eax
je 0x477fe1
mov eax, dword [ecx]
add eax, edx
mov ecx, dword [ebp - 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x477fa8
test dl, dl
je 0x477fa4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x477fa8
add eax, 2
add ecx, 2
test dl, dl
jne 0x477f88
xor eax, eax
jmp 0x477fad
sbb eax, eax
or eax, 1
test eax, eax
jne 0x477fbf
movzx eax, word [edi]
mov esi, dword [ebp - 0x24]
mov esi, dword [esi + eax*4]
add esi, dword [ebp - 0x2c]
jmp 0x477fde
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
add edi, 2
mov dword [ebp - 0x28], edi
mov edx, dword [ebp - 0x2c]
jmp 0x477f77
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x478000
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [edx + 0x3c]
add esi, edx
push edi
mov edi, ecx
movzx eax, word [esi + 0x14]
add eax, 0x18
add eax, esi
mov dword [ebp - 4], eax
cmp edi, dword [eax + 0x14]
jae 0x478028
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
movzx ebx, word [esi + 6]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 8], ebx
cmp ax, bx
jae 0x478067
nop dword [eax]
mov esi, dword [ebp - 4]
movzx edx, cx
lea eax, [edx + edx*4]
mov esi, dword [esi + eax*8 + 0xc]
cmp edi, esi
jb 0x478061
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + eax*8 + 0x10]
mov ebx, dword [ebp - 8]
add eax, esi
cmp edi, eax
jb 0x478070
inc ecx
cmp cx, bx
jb 0x478040
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
lea eax, [edx + edx*4]
pop ebx
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x10b
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x3c]
cmp word [ecx + edi + 0x18], ax
jne 0x478109
mov ecx, dword [ecx + edi + 0x78]
mov edx, edi
call fcn.00478000
mov ecx, dword [edi + eax + 0x20]
mov edx, edi
lea ebx, [edi + eax]
mov dword [ebp - 8], ebx
call fcn.00478000
mov ecx, dword [ebx + 0x24]
mov edx, edi
lea esi, [edi + eax]
call fcn.00478000
mov ebx, dword [ebx + 0x18]
lea ecx, [edi + eax]
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x478109
mov ecx, dword [esi]
mov edx, edi
dec ebx
call fcn.00478000
add eax, edi
push str.RefLoader
push eax
call fcn.00520cf0
add esp, 8
test eax, eax
jne 0x478112
add dword [ebp - 4], 2
add esi, 4
test ebx, ebx
jne 0x4780e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov edx, edi
mov ecx, dword [ecx + 0x1c]
call fcn.00478000
mov ecx, dword [ebp - 4]
add eax, edi
mov edx, edi
movzx ecx, word [ecx]
mov ecx, dword [eax + ecx*4]
call fcn.00478000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x478140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a6070
push 0x5207b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b0514]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
test esi, esi
je 0x478208
test edi, edi
je 0x478208
mov dword [ebp - 4], 0
call fcn.00478090
test eax, eax
je 0x4781e8
add eax, esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
je 0x4781e8
call dword [ebp - 0x2c]
test eax, eax
je 0x4781d9
lea ecx, [ebp - 0x28]
push ecx
push 6
push 0
call eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x47820a
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00497d40
mov esp, ebp
pop ebp
ret
Function at 0x47a060
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566c60
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004499d0
test eax, eax
je 0x47a140
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00449b90
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47a0ef
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
mov dword [esi + 0x750], ebx
mov dword [esi + 0x754], 0
cmp edx, 8
jb 0x47a140
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a136
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a1d7
push edx
push ecx
call fcn.00497d51
add esp, 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0047aa60
mov edx, eax
mov dword [ebp - 4], 1
mov ecx, dword [0x5ba9ac]
cmp dword [0x5ba9b0], ecx
je 0x47a188
mov dword [ecx], 0
cmp ecx, edx
je 0x47a17b
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], 0
mov byte [ecx + 4], 1
add dword [0x5ba9ac], 8
jmp 0x47a18f
push edx
push ecx
call fcn.00435bd0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x47a1bb
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x47a1bb
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x47a1b5
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x47a1b9
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497d40
mov esp, ebp
pop ebp
ret
call fcn.00524a29
int3
Function at 0x47a820
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565578
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
cmp eax, 0x5ff
je 0x47a978
cmp eax, 0x81f4
jne case.default.0x47a87a
mov eax, dword [ebp + 0xc]
add eax, 0xffff7e0b
cmp eax, 3
ja case.default.0x47a87a
jmp dword [eax*4 + 0x47aa44]
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x740]
push eax
mov dword [esi + 0xc04], eax
call fcn.00467a70
jmp case.default.0x47a87a
lea ecx, [esi + 0x770]
call fcn.0042e370
push eax
push dword [esi + 0xc04]
lea ecx, [esi + 0x740]
push dword [esi + 0x95c]
push dword [esi + 0x958]
call fcn.004685c0
jmp case.default.0x47a87a
lea eax, [esi + 0x8b0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x47a916
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a916
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.localfilepath
push str.Software
call fcn.0043bc70
push 1
lea ecx, [esi + 0x740]
call fcn.00468200
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb case.default.0x47a87a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a957
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47aa3e
push edx
push ecx
call fcn.00497d51
add esp, 8
jmp case.default.0x47a87a
push 1
lea ecx, [esi + 0x740]
call fcn.00467c70
jmp case.default.0x47a87a
mov eax, dword [ebp + 0x10]
cmp eax, 0x203
jne 0x47aa06
mov edi, dword [0x5ba980]
cmp dword [edi + 0x640], 0
je 0x47a9b8
lea eax, [edi + 0x644]
mov dword [edi + 0x658], 0
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [edi + 0x640], 0
mov ecx, esi
call fcn.004a1190
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x56cab0
push 1
push 0
push 0x56cad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x47a9f9
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x2c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x47a87a
cmp eax, 0x205
jne case.default.0x47a87a
call fcn.004a1190
push eax
call fcn.0043c2e0
mov dword [ebx], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497d40
mov esp, ebp
pop ebp
ret 0x10
call fcn.00524a29
nop
sub dword [eax - 0x5764ffb9], 0xa8c90047
inc edi
add byte [esi - 0x57], ah
inc edi
add ah, cl
int3
Function at 0x47dca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565578
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
cmp eax, 0x5ff
je 0x47de0a
cmp eax, 0x81f4
jne case.default.0x47dcfa
mov eax, dword [ebp + 0xc]
add eax, 0xffff7e0b
cmp eax, 3
ja case.default.0x47dcfa
jmp dword [eax*4 + 0x47ded8]
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x740]
push eax
mov dword [esi + 0xc04], eax
call fcn.00467a70
jmp case.default.0x47dcfa
lea ecx, [esi + 0x770]
call fcn.0042e370
push eax
push dword [esi + 0xc04]
lea ecx, [esi + 0x740]
push dword [esi + 0x95c]
push dword [esi + 0x958]
call fcn.004685c0
jmp case.default.0x47dcfa
lea eax, [esi + 0x8b0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x47dd96
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47dd96
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.localfilepath
push str.Software
call fcn.0043bc70
push 1
lea ecx, [esi + 0x740]
call fcn.00468200
push 3
mov ecx, esi
call fcn.004320c0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb case.default.0x47dcfa
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47dde0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47ded0
push edx
push ecx
call fcn.00497d51
add esp, 8
jmp case.default.0x47dcfa
push 1
lea ecx, [esi + 0x740]
call fcn.00467c70
push 3
mov ecx, esi
call fcn.004320c0
jmp case.default.0x47dcfa
mov eax, dword [ebp + 0x10]
cmp eax, 0x203
jne 0x47de98
mov edi, dword [0x5ba980]
cmp dword [edi + 0x640], 0
je 0x47de4a
lea eax, [edi + 0x644]
mov dword [edi + 0x658], 0
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [edi + 0x640], 0
mov ecx, esi
call fcn.004a1190
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x56cab0
push 1
push 0
push 0x56cad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x47de8b
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x2c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x47dcfa
cmp eax, 0x205
jne case.default.0x47dcfa
call fcn.004a1190
push eax
call fcn.0043c2e0
mov dword [ebx], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497d40
mov esp, ebp
pop ebp
ret 0x10
call fcn.00524a29
nop dword [eax]
add ebp, ebx
inc edi
add byte [ebx], bl
fld qword [edi]
dec ecx
fld qword [edi]
out dx, eax
fld qword [edi]
int3
Function at 0x485058
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x48509d
call fcn.00482c1d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x48509d
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x4850b9
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00480b5c
mov ebx, eax
test edi, edi
je 0x4850b7
test esi, esi
je 0x4850b7
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4857bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x48587b
cmp dword [esi + 0x20], 0
je 0x48587b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48587b
cmp dword [ebp + 8], 0
je 0x48587b
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00482c1d
push 0x56dd70
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x48584c
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x48587b
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0048fb9f
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x48586c
test edi, edi
je 0x48586c
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
test ebx, ebx
je 0x485877
mov ecx, esi
call fcn.0048559b
mov eax, ebx
jmp 0x48587d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x490d33
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x490d86
push esi
push dword [ebp + 8]
call fcn.00490f1c
mov edi, eax
test edi, edi
je 0x490d81
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x490d81
mov eax, dword [ebp - 8]
jmp 0x490d98
mov eax, dword [ebp + 0x10]
jmp 0x490d98
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x4ab850
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x4ab871
mov ecx, dword [ebp - 4]
or ecx, 8
mov dword [ebp - 4], ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x4ab889
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x4ab8a1
mov edx, dword [ebp - 4]
or edx, 2
mov dword [ebp - 4], edx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x4ab8b7
mov ecx, dword [ebp - 4]
or ecx, 4
mov dword [ebp - 4], ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x4ab8cf
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4b2890
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0xa8]
je 0x4b28ce
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x108]
je 0x4b28ce
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xa8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x108]
jne 0x4b28e1
jmp 0x4b2a3d
mov edx, dword [ebp - 4]
cmp dword [edx + 0x108], 0
je 0x4b2967
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x28], 0x17
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x108]
mov edx, dword [eax + 0x134]
call edx
push 0
push 0
push 0
push str.killfocus
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004b22f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x108], 0
cmp dword [ebp + 8], 0
jne 0x4b2972
jmp 0x4b2a3d
cmp dword [ebp + 8], 0
je 0x4b2a3d
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, dword [ebp - 4]
jne 0x4b2a3d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xf4]
call eax
movzx ecx, al
test ecx, ecx
je 0x4b2a3d
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x100]
call edx
movzx eax, al
test eax, eax
je 0x4b2a3d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x108], edx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x48], 0x18
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x108]
mov edx, dword [eax + 0x134]
call edx
push 0
push 0
push 0
push str.setfocus
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x108]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004b22f0
mov esp, ebp
pop ebp
ret 4