joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab229
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ab281
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x547498
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4ab274
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4ab283
xor eax, eax
pop esi
leave
ret 4

Function at 0x4abbb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov dword [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
mov dword [esp + 8], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
pop edi
jge 0x4abbf5
xor eax, eax
add esp, 0x10c
ret
mov edx, dword [esp + 0x114]
lea ecx, [esp + 4]
and edx, 0xffff
push ecx
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x4abc1d
xor eax, eax
add esp, 0x10c
ret
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
mov eax, dword [esp]
jne 0x4abc53
mov ecx, dword [esp + 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
add esp, 0x10c
ret
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x110]
lea edx, [esp + 8]
push edx
call fcn.004daf9b
mov eax, 1
add esp, 0x10c
ret

Function at 0x4abcf0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4abd32
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.004db3f6
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0xc
call fcn.004db3f6
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [eax + 4], ecx
lea ecx, [esp + 8]
mov dword [eax], ebx
push ecx
push 0
push eax
push 0x4abd70
push 0
push 0
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebx
ret

Function at 0x4abe90
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4b37e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515f98
push 0x4c5e1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004c45c0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b3c60
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4b3d31
push 0x94
mov ebx, 1
call fcn.004c5b89
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3da6
mov ecx, 0x25
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x4b3cc4
push esi
mov ebx, 5
call fcn.004c4a1e
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x4b3d9d
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x4b3ce8
push esi
mov ebx, 6
call fcn.004c4a1e
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x4b3d9d
cmp dword [esi + 8], ebx
jne 0x4b3d0a
push esi
mov ebx, 7
call fcn.004c4a1e
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 5
jne 0x4b3d9d
cmp dword [esi + 8], 2
jne 0x4b3d9d
push esi
mov ebx, 8
call fcn.004c4a1e
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp al, 4
jae 0x4b3d3b
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x94
mov ebx, 2
call fcn.004c5b89
mov esi, eax
add esp, 4
test esi, esi
je 0x4b3da6
mov ecx, 0x25
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
jne 0x4b3d9d
cmp dword [esi + 8], 0xa
jne 0x4b3d8d
push esi
mov ebx, 3
call fcn.004c4a1e
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp eax, 4
jne 0x4b3d9d
cmp dword [esi + 8], 0x5a
jne 0x4b3d9d
mov ebx, 4
push esi
call fcn.004c4a1e
add esp, 4
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4b3f00
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, esi
call fcn.004dad9d
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x10]
shr ecx, 0x14
push ecx
push 0x539b1c
push esi
call fcn.004d261f
add esp, 0xc
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x4b5e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
push eax
mov eax, dword [esp + 8]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
ret 0xc

Function at 0x4b5e50
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 0x10
Function at 0x4b6270
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x504bdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x542d10]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x30]
mov eax, 0x55555556
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x20], 1
lea ecx, [ebx + 2]
imul ecx
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [esp + 0x10]
shl edx, 2
push edx
call fcn.004db242
cmp ebx, 2
mov esi, eax
jle 0x4b6360
mov eax, 0xaaaaaaab
mul ebx
mov ebx, edx
mov eax, dword [esp + 0x30]
shr ebx, 1
lea edx, [ebx*4]
sub edx, ebx
neg edx
add eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [edi]
xor ecx, ecx
mov cl, byte [ebp]
shr ecx, 2
push ecx
mov ecx, edi
call dword [eax + 0x10]
mov byte [esi], al
mov al, byte [ebp]
mov edx, dword [edi]
xor ecx, ecx
mov cl, byte [ebp + 1]
and eax, 3
shl eax, 4
shr ecx, 4
add eax, ecx
mov ecx, edi
push eax
inc esi
call dword [edx + 0x10]
xor ecx, ecx
mov byte [esi], al
mov al, byte [ebp + 1]
mov cl, byte [ebp + 2]
mov edx, dword [edi]
and eax, 0xf
shr ecx, 6
inc esi
lea eax, [ecx + eax*4]
mov ecx, edi
push eax
call dword [edx + 0x10]
mov byte [esi], al
mov al, byte [ebp + 2]
mov edx, dword [edi]
and eax, 0x3f
push eax
mov ecx, edi
inc esi
call dword [edx + 0x10]
mov byte [esi], al
inc esi
add ebp, 3
dec ebx
jne 0x4b62f8
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x4b63df
mov edx, dword [edi]
xor eax, eax
mov al, byte [ebp]
mov ecx, edi
shr eax, 2
push eax
call dword [edx + 0x10]
mov byte [esi], al
inc esi
cmp ebx, 1
jle 0x4b63b7
mov al, byte [ebp]
mov edx, dword [edi]
xor ecx, ecx
and eax, 3
mov cl, byte [ebp + 1]
shl eax, 4
shr ecx, 4
add eax, ecx
mov ecx, edi
push eax
call dword [edx + 0x10]
mov byte [esi], al
mov al, byte [ebp + 1]
mov edx, dword [edi]
and eax, 0xf
shl eax, 2
push eax
mov ecx, edi
inc esi
call dword [edx + 0x10]
mov byte [esi], al
mov edx, dword [edi]
mov ecx, edi
inc esi
call dword [edx + 0x18]
jmp 0x4b63dc
mov cl, byte [ebp]
mov eax, dword [edi]
and ecx, 3
shl ecx, 4
push ecx
mov ecx, edi
call dword [eax + 0x10]
mov byte [esi], al
mov edx, dword [edi]
mov ecx, edi
inc esi
call dword [edx + 0x18]
mov byte [esi], al
mov eax, dword [edi]
mov ecx, edi
inc esi
call dword [eax + 0x18]
mov byte [esi], al
inc esi
push 0
lea ecx, [esp + 0x14]
call fcn.004db242
sub esi, eax
lea ecx, [esp + 0x10]
push esi
call fcn.004db291
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004dab87
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.004dae12
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x4b7290
Capabilities:
Get file size
Read file via mapping

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push 0x80
push 3
mov eax, dword [edi]
push 0
push 1
push 0xc0000000
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x4b72c2
pop edi
xor eax, eax
pop esi
ret 4
push 0
push 0
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4b72df
pop edi
pop esi
ret 4
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
lea ecx, [esi + 0x10]
mov dword [esi + 4], eax
call fcn.004daf4b
mov eax, dword [esi + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x4b7990
Capabilities:
Get disk information

Disassembly:
sub esp, 0x84
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov dword [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x4b7a3f
mov cl, byte [esp + 8]
test cl, cl
je 0x4b7a3f
push ebx
push ebp
push esi
lea esi, [eax - 3]
xor edi, edi
test esi, esi
jl 0x4b7a30
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov al, byte [esp + esi + 0x14]
lea ebp, [esp + esi + 0x14]
test al, al
je 0x4b79f4
test esi, esi
jne 0x4b7a04
jmp 0x4b79f8
test esi, esi
jne 0x4b79fc
lea edi, [esp + 0x14]
push edi
call ebx
cmp eax, 3
je 0x4b7a18
dec esi
mov edi, ebp
jns 0x4b79e2
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x84
ret
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x84
ret
mov eax, dword [esp + 4]
pop edi
add esp, 0x84
ret
Function at 0x4b7cc0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebx, ecx
push esi
xor ebp, ebp
push str.ntdll.dll
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
mov dword [ebx], eax
jne 0x4b7ce9
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwOpenSection
push eax
call esi
cmp eax, ebp
mov dword [ebx + 0x14], eax
jne 0x4b7d07
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov eax, dword [ebx]
push str.ZwMapViewOfSection
push eax
call esi
cmp eax, ebp
mov dword [ebx + 0x18], eax
jne 0x4b7d21
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov ecx, dword [ebx]
push str.ZwUnmapViewOfSection
push ecx
call esi
cmp eax, ebp
mov dword [ebx + 0x1c], eax
jne 0x4b7d3b
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov edx, dword [ebx]
push str.RtlInitUnicodeString
push edx
call esi
cmp eax, ebp
mov dword [ebx + 0x20], eax
jne 0x4b7d55
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
lea eax, [ebx + 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 0xb
mov esi, str.DevicePhysicalMemory
lea edi, [esp + 0x30]
lea edx, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push ecx
push edx
movsw word es:[edi], word [esi]
call dword [ebx + 0x20]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], eax
push ecx
lea eax, [ebx + 4]
push 4
push eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
call dword [ebx + 0x14]
xor edx, edx
test eax, eax
pop edi
pop esi
setge dl
pop ebp
mov eax, edx
pop ebx
add esp, 0x50
ret

Function at 0x4b7f30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x12]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 4], 0x100000
jae 0x4b7fa3
sgdt [ebp - 0xc]
sldt word [ebp - 4]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xa]
and ecx, 0xffff
xor eax, eax
add ecx, edi
xor edx, edx
mov al, byte [ecx + 7]
mov dl, byte [ecx + 4]
shl eax, 8
add eax, edx
xor edx, edx
mov dx, word [ecx + 2]
xor ecx, ecx
shl eax, 0x10
add eax, edx
mov word [esi + 0xc], cx
mov dword [esi + 0xe], ecx
mov ecx, 7
add eax, 0x38
mov dl, 0x80
mov bl, byte [eax + 0xd]
add eax, 8
inc ecx
test dl, bl
je 0x4b7fac
cmp cx, 0x7ff
jbe 0x4b7f91
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, eax
xor edx, edx
lea ecx, [ecx*8 + 7]
mov dword [edi], edx
mov dword [edi + 4], edx
mov dx, word [esi + 4]
mov word [eax + 2], dx
mov word [eax], 0xffff
mov edx, dword [esi + 4]
pop edi
shr edx, 0x10
mov byte [eax + 4], dl
mov edx, dword [esi + 4]
shr edx, 0x18
mov byte [eax + 7], dl
mov dl, byte [eax + 6]
or dl, 0x1f
mov byte [eax + 5], 0xf2
mov byte [eax + 6], dl
mov word [esi + 0xc], cx
mov dword [esi + 0xe], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c24d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c24f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004c7165
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4c2513
test byte [esp + 8], 2
je 0x4c2513
call fcn.004c71d8
mov dword [eax], 0xd
call fcn.004c71e1
mov dword [eax], 5
jmp 0x4c24ec
xor eax, eax
ret

Function at 0x4ce8f7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x546f68
cmp edx, dword [eax]
je 0x4ce919
add eax, 8
inc ecx
cmp eax, 0x546ff8
jl 0x4ce90a
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x546f68]
jne 0x4cea47
mov eax, dword [0x54c894]
cmp eax, 1
je 0x4cea21
test eax, eax
jne 0x4ce94a
cmp dword [0x544288], 1
je 0x4cea21
cmp edx, 0xfc
je 0x4cea47
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ce981
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c23e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c2130
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ce9c4
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c2130
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x53f82c
push edi
call fcn.004c2f80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c23e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c23f0
lea eax, [ebp - 0xa0]
push 0x51c7f4
push eax
call fcn.004c23f0
push dword [esi + 0x546f6c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c23f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004d0c3d
add esp, 0x2c
pop edi
jmp 0x4cea47
lea eax, [ebp + 8]
lea esi, [esi + 0x546f6c]
push 0
push eax
push dword [esi]
call fcn.004c2130
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x4d65a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4d65c7
cmp dword [edi + 0x3c], 0
jne 0x4d65c7
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004f02b8
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004d65f4
pop edi
pop esi
pop ebx
ret 8
Function at 0x4d6642
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004f02b8
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d6673
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004d6686
pop edi
pop esi
pop ebx
ret 8

Function at 0x4d7c7b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d7cb3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004db2b9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004db291
jmp 0x4d7cbf
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d7cc3
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x54c090
mov ecx, edi
call fcn.004daf9b
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x4d7d16
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4d7d29
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004db2b9
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004db291
jmp 0x4d7d29
mov ecx, esi
call fcn.004da20d
test eax, eax
je 0x4d7d29
push edi
mov ecx, eax
call fcn.004d7c7b
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x4d9945
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d9987
call fcn.004f02b8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d9987
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d997e
xor eax, eax
jmp 0x4d998f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d9995
pop edi
pop esi
pop ebx
ret 4
Function at 0x4ee938
Capabilities:
Create http request

Disassembly:
mov eax, 0x505b80
call fcn.004c13fc
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4ee970
call fcn.004f02b8
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4ee995
push eax
push dword [esi + 4]
call fcn.004ef6e5
jmp 0x4ee9a1
push esi
push eax
mov ecx, 0x54c3e8
call fcn.004ee9b2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x4eeb12
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x505bbb
call fcn.004c13fc
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004dd867
mov eax, dword [0x542d10]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x54c3e8
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.004ee9b2
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.004daf9b
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004ba02e
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004daf4b
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.004dae12
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x4f0fd5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.004f02b8
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4f1012
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4f1012
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4f1016
xor eax, eax
jmp 0x4f1094
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004db3f6
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x4f104e
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x4f1038
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004f1185
push ebx
mov edi, eax
call fcn.004db41f
test edi, edi
pop ecx
je 0x4f1090
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004f0f4e
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004f1099
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x4f220e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f223c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f225a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f2174
jmp 0x4f225a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f225a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f2174
test edi, edi
mov eax, edi
jne 0x4f2244
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8