joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48648e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x14
mov eax, 0x517f5f
call fcn.004f81c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x124]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4865a4
cmp dword [ebp + 0x14], 1
jl 0x4865a4
cmp dword [ebp + 0xc], ebx
je 0x4865a4
cmp dword [ebp + 0x10], ebx
je 0x4865a4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov esi, 0xff
push esi
call fcn.004d0c86
mov edi, eax
push esi
mov eax, dword [ebp + 8]
add eax, 0x24
push eax
push esi
push edi
call fcn.004f2b71
add esp, 0x14
and dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x14]
jge 0x486557
lea eax, [ebx + 1]
cdq
mov ecx, esi
idiv ecx
mov dword [ebp - 0x20], edx
mov cl, byte [edi + edx]
movzx eax, cl
add eax, dword [ebp - 0x1c]
cdq
mov ebx, esi
idiv ebx
mov dword [ebp - 0x1c], edx
lea eax, [edi + edx]
mov dl, byte [eax]
mov ebx, dword [ebp - 0x20]
mov byte [edi + ebx], dl
mov byte [eax], cl
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov al, byte [edx + eax]
mov byte [ebp - 0x11], al
movzx eax, byte [edi + ebx]
movzx ecx, cl
add eax, ecx
cdq
mov ecx, esi
idiv ecx
movzx eax, byte [edx + edi]
movzx ecx, byte [ebp - 0x11]
xor eax, ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov byte [edx + ecx], al
inc dword [ebp - 0x18]
jmp 0x4864f4
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x4865a6
xor eax, eax
call fcn.004f826c
ret 0x10
Function at 0x48674e
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x514c7d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5937d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x53b12c
xor esi, esi
push 1
push esi
push 0x53b10c
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x48687e
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x10]
push edx
push 0x53b11c
push eax
call dword [ecx + 0xc]
cmp eax, esi
jne 0x48687e
mov dword [esp + 8], esi
jmp 0x486864
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x53a974
push esi
push esi
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x48685a
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x20]
push edx
push 0x55bbac
push eax
call dword [ecx + 0xc]
cmp eax, esi
jge 0x48681f
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x20]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
cmp eax, esi
jl 0x486850
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004868b3
mov dword [esp + 0x38], esi
mov eax, dword [edi + 8]
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, edi
call fcn.004d921c
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00401898
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0xc]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x4867c8
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x48688c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x48689a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp dword [edi + 8], esi
setg al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48800c
Capabilities:
Read .ini file

Disassembly:
push 0x18
mov eax, 0x51c1c2
call fcn.004f8194
mov edi, dword [ebp + 8]
mov ebx, ecx
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
push ecx
lea esi, [ebx + 0x34]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.0040184e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.0041560d
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x53b9e7
call fcn.00401769
mov byte [ebp - 4], 4
push 0x104
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Path
call fcn.00401769
mov byte [ebp - 4], 5
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.0040184e
mov byte [ebp - 4], 6
push edi
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.0041564c
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x18], 1
je 0x48817e
push edi
call fcn.00442d9b
push dword [esi]
push 0
push str.IsRelative
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x48817e
push edi
lea ecx, [ebp - 0x10]
call fcn.0040184e
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.MozillaFirefox
call fcn.00401769
mov byte [ebp - 4], 8
push ecx
add ebx, 0x38
mov ecx, esp
mov dword [ebp - 0x24], esp
push ebx
call fcn.0040184e
mov byte [ebp - 4], 9
mov byte [ebp - 4], 7
lea esi, [ebp - 0x1c]
call fcn.004138e4
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
push eax
mov ecx, edi
call fcn.004044be
mov byte [ebp - 4], 7
mov ecx, esi
call fcn.00401898
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.0040184e
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
call fcn.0040184e
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
lea esi, [ebp - 0x1c]
call fcn.004138e4
pop ecx
pop ecx
mov byte [ebp - 4], 0xd
push eax
mov ecx, edi
call fcn.004044be
mov byte [ebp - 4], 7
mov ecx, esi
call fcn.00401898
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.00401898
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
call fcn.0041e6d2
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401898
mov eax, edi
call fcn.004f826c
ret 8
Function at 0x4905f9
Capabilities:
Extract http body

Disassembly:
push 0x18
mov eax, 0x52053b
call fcn.004f81c7
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [edi]
call dword [eax + 0x10]
test eax, eax
jne 0x490631
push 0x53b9e7
mov ecx, dword [ebp + 8]
call fcn.00401769
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
jmp 0x49075f
mov dword [ebp - 4], 1
lea esi, [edi + 0x2c]
cmp dword [esi], ebx
jne 0x49066b
mov edi, dword [edi + 0x28]
mov eax, dword [edi]
lea ecx, [ebp - 0x1c]
push ecx
push edi
call dword [eax + 0x48]
cmp eax, ebx
jne 0x490667
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push 0x53aa34
push eax
call dword [ecx]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
je 0x4906e9
push 0x53b9e7
lea ecx, [ebp - 0x1c]
call fcn.00401769
mov byte [ebp - 4], 2
mov esi, dword [esi]
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push esi
call dword [eax + 0x24]
cmp eax, ebx
jne 0x4906c8
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0xf0]
cmp eax, ebx
jne 0x4906b2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
call fcn.0040e008
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040184e
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401898
jmp 0x49075f
mov dword [ebp - 4], ebx
jmp 0x49074b
push 0x53b9e7
mov ecx, dword [ebp + 8]
call fcn.00401769
mov dword [ebp - 4], ebx
or dword [ebp - 0x14], 1
mov eax, dword [ebp + 8]
call fcn.004f826c
ret 4
Function at 0x491064
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52dc6e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5937d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebx + 0xc], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jle 0x49126a
test esi, esi
jl 0x49124f
cmp esi, dword [ebx + 0xc]
jge 0x49124f
mov eax, dword [ebx + 8]
mov ecx, esi
shl ecx, 3
xor edi, edi
add eax, ecx
inc edi
cmp dword [eax], edi
jne 0x491127
cmp esi, dword [ebx + 0xc]
jge 0x49124f
mov eax, dword [ebx + 8]
add eax, ecx
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040184e
and dword [esp + 0x3c], 0
lea eax, [esp + 0x24]
push eax
or dword [esp + 0x40], 0xffffffff
call fcn.00491280
mov dword [esp + 0x38], edi
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
setne byte [esp + 0x13]
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00401898
cmp byte [esp + 0x13], 0
je 0x49123f
mov dword [esp + 0x18], edi
jmp 0x49126a
cmp esi, dword [ebx + 0xc]
jge 0x49124f
mov eax, dword [ebx + 8]
add eax, ecx
cmp dword [eax], 2
jne 0x49121b
cmp esi, dword [ebx + 0xc]
jge 0x49124f
mov eax, dword [ebx + 8]
add eax, ecx
add eax, 4
push eax
lea ecx, [esp + 0x18]
call fcn.0040184e
mov dword [esp + 0x38], 2
push edi
lea edi, [esp + 0x18]
call fcn.0041da15
xor ecx, ecx
mov esi, edi
mov dword [esp], str._firefoxprofiles_
call fcn.00414c6c
test eax, eax
jl 0x4911bd
push ecx
mov eax, edi
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0040184e
mov byte [esp + 0x3c], 3
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x40], 2
call fcn.00491404
mov byte [esp + 0x38], 4
push eax
mov ecx, edi
call fcn.004044be
mov byte [esp + 0x38], 2
lea ecx, [esp + 0x24]
call fcn.00401898
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0040184e
mov byte [esp + 0x3c], 5
mov byte [esp + 0x3c], 2
call fcn.00412566
pop ecx
test eax, eax
jne 0x491254
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0040184e
mov byte [esp + 0x3c], 6
mov byte [esp + 0x3c], 2
call fcn.0041260e
pop ecx
test eax, eax
jne 0x491254
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00401898
mov esi, dword [esp + 0x1c]
jmp 0x49123f
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Unknown_uninstall_key_type_encountered__skipping_lookup
call fcn.00401769
mov dword [esp + 0x3c], 7
push edi
or dword [esp + 0x40], 0xffffffff
call fcn.0041474e
inc esi
cmp esi, dword [ebx + 0xc]
mov dword [esp + 0x1c], esi
jl 0x4910a2
jmp 0x49126a
call fcn.004d1015
mov dword [esp + 0x18], 1
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00401898
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x494665
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x5937d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x138], 0
jne 0x494711
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x494711
xor ebx, ebx
inc ebx
cmp eax, 0x101
jbe 0x4946aa
add eax, 0xfffffefc
cmp eax, ebx
ja 0x494711
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x494711
mov ecx, dword [esi + 8]
lea eax, [ecx - 0x70]
cmp eax, 0xb
jbe 0x49470d
cmp ecx, 0x2f
je 0x49470d
mov al, byte [ebp - 0xf3]
and al, 0x80
je 0x4946da
cmp ecx, 0x4e
je 0x49470d
test al, al
je 0x4946f5
cmp ecx, 0x50
je 0x49470d
test al, al
je 0x4946f5
cmp ecx, 0x44
je 0x49470d
test al, al
je 0x4946f5
cmp ecx, 0x46
je 0x49470d
mov al, byte [ebp - 0xf2]
and al, 0x80
je 0x494704
cmp ecx, 0x25
je 0x49470d
test al, al
je 0x494711
cmp ecx, 0x27
jne 0x494711
mov eax, ebx
jmp 0x494719
push esi
mov ecx, edi
call fcn.004d1754
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f2b62
leave
ret 4
Function at 0x4ca140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x514a33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5937d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], 0
mov byte [esi + 8], 0
lea eax, [esi + 0x30]
push eax
mov dword [esp + 0x18], 0
call fcn.004cbce0
lea ecx, [esi + 0x48]
push ecx
mov byte [esp + 0x18], 1
call fcn.004c7504
mov byte [esp + 0x14], 2
mov dword [esi], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x4ca3f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x514a33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5937d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi + 0x1c], 0xf
mov dword [esi + 0x18], eax
mov byte [esi + 8], al
mov dword [esp + 0x14], eax
lea eax, [esi + 0x30]
push eax
call fcn.004cbce0
lea ecx, [esi + 0x48]
push ecx
mov byte [esp + 0x18], 1
call fcn.004c7504
fld qword [esp + 0x20]
mov byte [esp + 0x14], 2
fstp qword [esi + 0x28]
mov dword [esi], 3
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc

Function at 0x4ca530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51499d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5937d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [edi + 0x1c], 0xf
mov dword [edi + 0x18], eax
mov byte [edi + 8], al
lea eax, [edi + 0x30]
push eax
mov byte [esp + 0x18], 1
call fcn.004cbce0
lea esi, [edi + 0x48]
push esi
mov byte [esp + 0x18], 2
call fcn.004c7504
lea ecx, [esp + 0x20]
mov byte [esp + 0x14], 3
push ecx
mov dword [edi], 5
call fcn.004c7690
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x18], 0xffffffff
call fcn.004c6dfe
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x24
Function at 0x4d1f61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4d1f85
cmp dword [edi + 0x54], 0
jne 0x4d1f85
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004dc474
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004d1f22
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4d76d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4d771f
call fcn.004dc474
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d771f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4d773b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004d7252
mov esi, eax
test edi, edi
je 0x4d7739
test ebx, ebx
je 0x4d7739
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4d7f34
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x50f392
call fcn.004f8194
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4d7f59
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4d7f9f
lea ecx, [ebp - 0x10]
call fcn.00404402
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d0cea
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401874
mov eax, esi
call fcn.004f826c
ret 8
Function at 0x4eebef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4eec37
call fcn.004dc474
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4eec37
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4eec7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4eec63
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4eec63
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4eec77
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4f2b62
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5937d0]
jne 0x4f2b6c
repz ret
jmp fcn.004fb12c
Function at 0x508965
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004fe4d7
and dword [ebp - 4], 0
cmp dword [0x59a970], 0
mov ebx, eax
jne 0x508a16
push 0x53a744
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x508ac7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x53a738
push edi
call esi
test eax, eax
je 0x508ac7
push eax
call fcn.004fe465
mov dword [esp], 0x53a728
push edi
mov dword [0x59a970], eax
call esi
push eax
call fcn.004fe465
mov dword [esp], 0x53a714
push edi
mov dword [0x59a974], eax
call esi
push eax
call fcn.004fe465
mov dword [esp], 0x53a6f8
push edi
mov dword [0x59a978], eax
call esi
push eax
call fcn.004fe465
pop ecx
mov dword [0x59a980], eax
test eax, eax
je 0x508a16
push 0x53a6e0
push edi
call esi
push eax
call fcn.004fe465
pop ecx
mov dword [0x59a97c], eax
mov eax, dword [0x59a97c]
cmp eax, ebx
je 0x508a6e
cmp dword [0x59a980], ebx
je 0x508a6e
push eax
call fcn.004fe4e0
push dword [0x59a980]
mov esi, eax
call fcn.004fe4e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x508a6e
test edi, edi
je 0x508a6e
call esi
test eax, eax
je 0x508a65
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x508a65
test byte [ebp - 0xc], 1
jne 0x508a6e
or dword [ebp + 0x10], 0x200000
jmp 0x508aa7
mov eax, dword [0x59a974]
cmp eax, ebx
je 0x508aa7
push eax
call fcn.004fe4e0
pop ecx
test eax, eax
je 0x508aa7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x508aa7
mov eax, dword [0x59a978]
cmp eax, ebx
je 0x508aa7
push eax
call fcn.004fe4e0
pop ecx
test eax, eax
je 0x508aa7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x59a970]
call fcn.004fe4e0
pop ecx
test eax, eax
je 0x508ac7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x508ac9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4254c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e50f
and dword [ebp - 4], 0
cmp dword [0x44f1f0], 0
mov ebx, eax
jne 0x425576
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425627
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425627
push eax
call fcn.0041e49d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f1f0], eax
call esi
push eax
call fcn.0041e49d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f1f4], eax
call esi
push eax
call fcn.0041e49d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f1f8], eax
call esi
push eax
call fcn.0041e49d
pop ecx
mov dword [0x44f200], eax
test eax, eax
je 0x425576
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e49d
pop ecx
mov dword [0x44f1fc], eax
mov eax, dword [0x44f1fc]
cmp eax, ebx
je 0x4255ce
cmp dword [0x44f200], ebx
je 0x4255ce
push eax
call fcn.0041e518
push dword [0x44f200]
mov esi, eax
call fcn.0041e518
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4255ce
test edi, edi
je 0x4255ce
call esi
test eax, eax
je 0x4255c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4255c5
test byte [ebp - 0xc], 1
jne 0x4255ce
or dword [ebp + 0x10], 0x200000
jmp 0x425607
mov eax, dword [0x44f1f4]
cmp eax, ebx
je 0x425607
push eax
call fcn.0041e518
pop ecx
test eax, eax
je 0x425607
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425607
mov eax, dword [0x44f1f8]
cmp eax, ebx
je 0x425607
push eax
call fcn.0041e518
pop ecx
test eax, eax
je 0x425607
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f1f0]
call fcn.0041e518
pop ecx
test eax, eax
je 0x425627
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425629
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x65b00265
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x58cd33ed
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219