joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485d00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc428
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4efc64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jbe 0x485da1
push esi
call fcn.0049605d
mov edi, eax
add esp, 4
test edi, edi
je 0x485da1
mov edx, dword [ebp + 8]
push edi
push esi
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x485d98
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485d85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call fcn.00496068
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x485dc7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4860a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebx + 0x3c]
movzx ecx, word [eax + ebx + 0x14]
add eax, ebx
push esi
push edi
movzx edi, word [eax + 6]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov dword [ebp - 4], edx
test edi, edi
jle 0x4860e8
lea eax, [edx + 8]
mov edx, dword [eax]
mov esi, edx
test edx, edx
jne 0x4860cf
mov esi, dword [eax + 8]
mov edx, dword [eax + 4]
cmp dword [ebp + 8], edx
jb 0x4860e0
add esi, edx
mov edx, dword [ebp + 8]
cmp edx, esi
jb 0x4860f0
inc ecx
add eax, 0x28
cmp ecx, edi
jl 0x4860c4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ecx + ecx*4]
mov ecx, dword [ebp - 4]
lea ecx, [ecx + eax*8]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop edi
add eax, ebx
add eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x486c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
push 0x4cac94
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.OLEAUT32.dll_OleCreateFontIndirect]
cmp eax, ebx
jl 0x486d0d
push edi
lea eax, [ebp + 8]
push eax
push 1
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 8]
push 1
mov dword [ebp - 0xc], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
mov edi, eax
cmp edi, ebx
jl 0x486cf4
mov edx, dword [ebp + 8]
push esi
lea ecx, [ebp - 8]
push ecx
push edx
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 0xc]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
jne 0x486ccb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x486cc7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x486ce9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push ebx
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bfa8a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4efc64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x4de75c
xor esi, esi
push eax
mov dword [ebp - 0x18], esi
call fcn.004a8c4a
mov ebx, eax
add esp, 8
cmp ebx, esi
jne 0x488fb8
mov ecx, dword [0x4f4c90]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp ecx, esi
je 0x488fa6
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push esi
push ebx
call fcn.004a91ea
add esp, 0xc
push ebx
call fcn.004a90bb
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], esi
cmp edi, esi
jne 0x489009
push ebx
call fcn.004a92e6
mov edx, dword [0x4f4c90]
mov eax, dword [ebp + 8]
mov ecx, edx
add esp, 4
mov dword [eax], edx
cmp ecx, esi
je 0x489129
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push esi
push ebx
call fcn.004a91ea
lea eax, [edi + 4]
add esp, 0xc
push eax
call fcn.004a5492
add esp, 4
push ebx
push edi
mov esi, eax
push 1
push esi
call fcn.004a8f01
push ebx
mov edi, eax
call fcn.004a92e6
add esp, 0x14
push 0
push edi
push esi
mov byte [esi + edi], 0
mov byte [esi + edi + 1], 0
mov byte [esi + edi + 2], 0
mov byte [esi + edi + 3], 0
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test al, al
jne 0x48909b
cmp byte [esi], 0xef
mov eax, 2
jne 0x489076
cmp byte [esi + 1], 0xbb
jne 0x489076
cmp byte [esi + 2], 0xbf
jne 0x489076
lea ecx, [eax + 1]
lea eax, [ecx - 2]
jmp 0x489079
mov ecx, dword [ebp - 0x10]
push eax
lea ebx, [esi + ecx]
call fcn.004876e0
add esp, 4
push esi
mov edi, eax
call fcn.004a5375
add esp, 4
mov esi, edi
mov dword [ebp - 0x10], 0
jmp 0x4890bf
mov al, byte [esi]
cmp al, 0xef
jne 0x4890ae
cmp byte [esi + 1], 0xff
jne 0x4890ae
mov dword [ebp - 0x10], 2
cmp al, 0xff
jne 0x4890bf
cmp byte [esi + 1], 0xfe
jne 0x4890bf
mov dword [ebp - 0x10], 2
test esi, esi
jne 0x4890e7
mov ecx, dword [0x4f4c90]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x489129
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0
lea ecx, [esi + edx]
push eax
call fcn.00488d70
push esi
call fcn.004a5375
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x489110
inc dword [eax + 0x30]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x18], 1
call fcn.004897c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ccc0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf9f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4efc64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0xc]
cmp eax, edi
jne 0x48cd30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cd1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x84000000
push edi
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push eax
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
push eax
push str.CHttpRemoteFile::SetLocation:_InternetOpenUrl__s__d
push edx
call fcn.00462050
add esp, 0x10
call fcn.0048cc50
mov esi, dword [esi + 0x10]
add esp, 4
cmp esi, edi
je 0x48cda0
push edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x20000013
push esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x48cddb
cmp eax, 0xc8
jne 0x48cddb
mov edi, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48cdc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push str.CHttpRemoteFile::SetLocation:_return_code:__d
push ecx
call fcn.00462050
add esp, 0xc
call fcn.0048cc50
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48cd0f

Function at 0x48ce20
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push 0
lea edx, [ebp - 4]
push edx
push eax
mov dword [eax], 0
mov eax, dword [ecx + 0x10]
push 0x20000005
push eax
mov dword [ebp - 4], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x48ce59
mov eax, 1
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x48cf10
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0x4000
mov ebx, ecx
mov dword [ebp - 4], edi
call fcn.004a5492
mov ecx, dword [ebx + 0x10]
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x4000
push esi
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48cf9e
mov eax, dword [ebp - 4]
add edi, eax
cmp eax, 0x4000
jne 0x48cf8e
lea edx, [edi + 0x4000]
push edx
push esi
call fcn.004a5600
mov edx, dword [ebx + 0x10]
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x4000
lea ecx, [esi + edi]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x48cf45
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48d420
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbe28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4efc64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x48d49b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d487
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.00423f4c
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004656f0
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test eax, eax
mov eax, dword [ebp + 8]
jne 0x48d511
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d487
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d52a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x48d540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf9a1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4efc64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, ebx
call fcn.0048caf0
lea esi, [ebx + 0x18]
mov dword [ebp - 4], 0
call fcn.004306f7
mov byte [ebp - 4], 1
call fcn.0049673f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d59f
push 0x80004005
call fcn.00421000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx + 0x98], eax
mov byte [ebp - 4], 2
call fcn.0048d690
push ecx
mov dword [ebx + 0x94], 0
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x48]
mov ecx, esp
mov dword [ebp - 0x10], esp
push edx
mov edx, dword [edi + 0x44]
push eax
mov eax, dword [edi + 0x30]
push edx
push eax
push str.CVirtAutoUpdate:_AutoUpdate_s__BaseDirName_s__CarrierExe_s__CloudPkgId_s
push ecx
call fcn.00462050
add esp, 0x18
call fcn.0048cc50
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x490f60
Capabilities:
Encode data using xor

Disassembly:
or edx, 0xffffffff
cmp dword [0x4f4898], 0
jne 0x490f71
call fcn.00490ec0
xor eax, eax
test esi, esi
jle 0x490f9b
jmp 0x490f80
movzx ecx, byte [eax + edi]
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x4f4440]
inc eax
cmp eax, esi
jl 0x490f80
mov eax, edx
ret
Function at 0x492d60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4efc64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.004a5560
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x492db2
cmp dword [ebp - 0x114], 6
lea eax, [esi + 1]
jae 0x492db4
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a4491
mov esp, ebp
pop ebp
ret
Function at 0x4951f0
Capabilities:
Write clipboard data

Disassembly:
push ebx
push esi
xor ebx, ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x495200
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x495257
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x495257
mov edx, eax
mov ecx, edi
sub edx, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x495233
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ebx, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4980bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4980e1
cmp dword [edi + 0x54], 0
jne 0x4980e1
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00498ab4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0049807e
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x49e295
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x49e2dc
call fcn.00498ab4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49e2dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x49e2f8
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0049de0d
mov esi, eax
test edi, edi
je 0x49e2f6
test ebx, ebx
je 0x49e2f6
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4a4491
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4efc64]
jne 0x4a449b
repz ret
jmp fcn.004ab5ad
Function at 0x4b4cf9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004aaf11
and dword [ebp - 4], 0
cmp dword [0x4f4350], 0
mov ebx, eax
jne 0x4b4daa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4b4e5b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4c9b28
push edi
call esi
test eax, eax
je 0x4b4e5b
push eax
call fcn.004aae9f
mov dword [esp], 0x4c9b18
push edi
mov dword [0x4f4350], eax
call esi
push eax
call fcn.004aae9f
mov dword [esp], 0x4c9b04
push edi
mov dword [0x4f4354], eax
call esi
push eax
call fcn.004aae9f
mov dword [esp], 0x4c9ae8
push edi
mov dword [0x4f4358], eax
call esi
push eax
call fcn.004aae9f
pop ecx
mov dword [0x4f4360], eax
test eax, eax
je 0x4b4daa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004aae9f
pop ecx
mov dword [0x4f435c], eax
mov eax, dword [0x4f435c]
cmp eax, ebx
je 0x4b4e02
cmp dword [0x4f4360], ebx
je 0x4b4e02
push eax
call fcn.004aaf1a
push dword [0x4f4360]
mov esi, eax
call fcn.004aaf1a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4b4e02
test edi, edi
je 0x4b4e02
call esi
test eax, eax
je 0x4b4df9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b4df9
test byte [ebp - 0xc], 1
jne 0x4b4e02
or dword [ebp + 0x10], 0x200000
jmp 0x4b4e3b
mov eax, dword [0x4f4354]
cmp eax, ebx
je 0x4b4e3b
push eax
call fcn.004aaf1a
pop ecx
test eax, eax
je 0x4b4e3b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4b4e3b
mov eax, dword [0x4f4358]
cmp eax, ebx
je 0x4b4e3b
push eax
call fcn.004aaf1a
pop ecx
test eax, eax
je 0x4b4e3b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f4350]
call fcn.004aaf1a
pop ecx
test eax, eax
je 0x4b4e5b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b4e5d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420004]
jne 0x40100a
repz ret
jmp fcn.004012fe

Function at 0x4046cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a60
and dword [ebp - 0x14], 0
cmp dword [0x422a38], 0
mov dword [ebp - 0x18], eax
jne 0x40477e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404826
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404826
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x422a38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x422a3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x422a40], eax
call edi
push eax
call esi
mov dword [0x422a48], eax
test eax, eax
je 0x40477e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x422a44], eax
mov eax, dword [0x422a44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4047d7
cmp dword [0x422a48], ecx
je 0x4047d7
push eax
call esi
push dword [0x422a48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4047d7
test ebx, ebx
je 0x4047d7
call edi
test eax, eax
je 0x4047ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4047ce
test byte [ebp - 8], 1
jne 0x4047d7
or dword [ebp + 0x10], 0x200000
jmp 0x40480a
mov eax, dword [0x422a3c]
cmp eax, dword [ebp - 0x18]
je 0x40480a
push eax
call esi
test eax, eax
je 0x40480a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40480a
mov eax, dword [0x422a40]
cmp eax, dword [ebp - 0x18]
je 0x40480a
push eax
call esi
test eax, eax
je 0x40480a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x422a38]
call esi
test eax, eax
je 0x404826
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404828
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x40283e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x402879

Function at 0x402cc4
Capabilities:
Inspect section memory permissions

Disassembly:
inc esi
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
jp 0x402c80
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
ja 0x402c8c
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jp 0x402c98
inc ebp
invalid

Function at 0x402cd0
Capabilities:
Inspect section memory permissions

Disassembly:
inc esi
inc ebp
adc byte [ecx - 0x3a], 0x45
xor dword [ebx - 0x3a], 0xc6628245
inc ebp
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
jp 0x402c80
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
ja 0x402c8c
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jp 0x402c98
inc ebp
invalid