joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c320
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4c42e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov esi, dword [esp + 0x34]
push edi
push eax
lea eax, [esp + 0x1c]
mov edx, dword [esi]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push 0xffffff
push 1
push 2
lea ecx, [esp + 0x1c]
call fcn.004b8238
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
push ecx
mov ecx, esi
call fcn.004b77d9
mov edx, dword [esi]
push 5
mov ecx, esi
mov edi, eax
call dword [edx + 0x24]
push 7
mov ecx, esi
mov ebx, eax
call fcn.004b7911
push 1
mov ecx, esi
mov ebp, eax
call fcn.004b78b5
mov eax, dword [esp + 0x3c]
push eax
push esi
call fcn.0046d1c0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 8
push eax
lea eax, [esp + 0x24]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push ebp
mov ecx, esi
call fcn.004b7911
push edi
mov ecx, esi
call fcn.004b77d9
push ebx
mov ecx, esi
call fcn.004b77d9
mov dword [esp + 0x10], 0x4fdecc
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.004b8222
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x47c450
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4c4320
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [eax + 0x10]
push edi
mov edi, dword [eax + 0xc]
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0047b9f0
mov ecx, eax
lea edx, [esp + 0x18]
mov eax, dword [ecx]
sub eax, edi
mov ecx, dword [ecx + 4]
sub ecx, esi
mov esi, dword [esp + 0x38]
push ecx
push eax
push edx
mov ecx, esi
call fcn.004b7b06
push 0xffffff
push 1
push 2
lea ecx, [esp + 0x1c]
call fcn.004b8238
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov dword [esp + 0x34], 0
call fcn.004b77d9
mov edx, dword [esi]
push 5
mov ecx, esi
mov edi, eax
call dword [edx + 0x24]
push 7
mov ecx, esi
mov ebx, eax
call fcn.004b7911
push 1
mov ecx, esi
mov ebp, eax
call fcn.004b78b5
mov eax, dword [esp + 0x40]
push eax
push esi
call fcn.0046d1c0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 8
lea eax, [esp + 0x20]
push ecx
push edx
push eax
mov ecx, esi
call fcn.004b7b06
push ebp
mov ecx, esi
call fcn.004b7911
push edi
mov ecx, esi
call fcn.004b77d9
push ebx
mov ecx, esi
call fcn.004b77d9
mov dword [esp + 0x10], 0x4fdecc
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.004b8222
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x47df60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c43d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
push 0xffffff
push 1
push 2
lea ecx, [esp + 0x28]
call fcn.004b8238
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x1c]
xor edi, edi
push eax
mov ecx, esi
mov dword [esp + 0x40], edi
call fcn.004b77d9
mov edx, dword [esi]
push 5
mov ecx, esi
mov dword [esp + 0x10], eax
call dword [edx + 0x24]
push 7
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.004b7911
mov ecx, dword [esi + 8]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetViewportOrgEx]
push 1
mov ecx, esi
call fcn.004b78b5
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 8]
dec ebx
js 0x47e053
push ebp
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov edx, dword [ebp]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi*4]
mov ecx, dword [eax + 0xc]
sub edx, ecx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x10]
sub ecx, edx
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
call fcn.004b7e51
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
sub eax, edx
mov edx, dword [esp + 0x18]
sub ecx, edx
mov edx, dword [esi]
push eax
lea eax, [esp + 0x34]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 4]
mov eax, dword [edx + edi*4]
push eax
push esi
call fcn.0046d1c0
add esp, 8
inc edi
cmp edi, ebx
jle 0x47dfe8
pop ebp
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esi]
push ecx
lea ecx, [esp + 0x30]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x38]
mov edx, dword [esp + 0x44]
mov ecx, esi
push edx
call fcn.004b7911
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b77d9
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004b77d9
mov dword [esp + 0x1c], 0x4fdecc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 1
call fcn.004b8222
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x14
Function at 0x4929e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x492a3a
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x492a3a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, eax
je 0x492a4f
mov eax, dword [esp]
test eax, eax
je 0x492a49
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x492a5e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x492a70
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x492ac9
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x492ade
mov eax, dword [esp]
test eax, eax
je 0x492ad8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x492aed
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x492b00
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x492b6b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x492b6b
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x492b34
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x492b5c
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x492b72
mov eax, dword [esp + 4]
test eax, eax
je 0x492b6b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x492b81
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x492b90
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x492d1b
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x492d1b
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x492d1b
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x492d1b
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x492cdc
cmp dword [esp + 0xc], 0x378
jne 0x492cdc
lea eax, [esp + 0x28]
push eax
push edi
call fcn.004a49a0
add esp, 8
test eax, eax
je 0x492cfc
cmp dword [esp + 0x154], 1
jne 0x492cfc
cmp dword [esp + 0x178], 2
jne 0x492cfc
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x52fe00
push edx
call fcn.0049e43e
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
push eax
push ecx
push edx
mov ecx, esi
call fcn.00492a70
test eax, eax
je 0x492cdc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x492cef
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x492ce6
push eax
call esi
jmp 0x492ce2
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x492cfc
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x492d0b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x492d30
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x492e9c
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x492e9c
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x492e9c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x492e9c
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x492e80
cmp dword [esp + 0x10], 0x378
jne 0x492e80
cmp dword [esp + 0x158], 1
jne 0x492ea9
cmp dword [esp + 0x17c], 2
jne 0x492ea9
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x52fe00
push ecx
call fcn.0049e43e
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x492e80
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00492ee0
test eax, eax
je 0x492e80
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.004929e0
test eax, eax
je 0x492e80
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x492ea9
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x492e91
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x492e9c
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x492eba
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x492ec5
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x492ee0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x492fa1
mov eax, dword [esp + 0x488]
test eax, eax
je 0x492fa1
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x492fa1
cmp dword [esp], 0x378
jne 0x492fa1
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x492fa1
lea edx, [esp + 4]
push edx
call fcn.00492970
add esp, 4
test eax, eax
je 0x492fa1
cmp dword [esp + 0x234], 1
jne 0x492f93
cmp dword [esp + 0x258], 2
jne 0x492f93
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x492fa1
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x492fa1
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x492fb0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x49300f
push esi
call fcn.00492970
add esp, 4
test eax, eax
je 0x49300f
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x49300f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x49300f
push 0x52fe24
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x4930a0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x4930d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00492fb0
test eax, eax
jne 0x4930ed
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00493020
cmp eax, 1
je 0x49327a
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x493126
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x4931a2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x493222
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00492ee0
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x493239
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x493142
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4931f0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00492b90
test eax, eax
je 0x493222
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x4931be
cmp dword [esp + 0x18], 1
jb 0x493222
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00492a70
cmp eax, 1
je 0x49326b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x493249
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x493222
push ebp
mov ecx, ebx
call fcn.00493290
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x49327a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x493290
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x4932c2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00493020
test eax, eax
jne 0x4932df
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x493306
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x493354
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00492d30
test eax, eax
jne 0x49333d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x493323
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.00492b00
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x493377
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x4b36cf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b3707
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b1732
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b170a
jmp 0x4b3713
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b4e14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b4e56
call fcn.004bb3cc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b4e56
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b4e4d
xor eax, eax
jmp 0x4b4e5e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b4e64
pop edi
pop esi
pop ebx
ret 4
Function at 0x4bb8fc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bb92a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bb948
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bb862
jmp 0x4bb948
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bb948
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bb862
test edi, edi
mov eax, edi
jne 0x4bb932
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x48c200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.004a3060
xor eax, eax
nop
mov cl, byte [eax + 0x4a2238]
mov dl, byte [eax + 0x4a2230]
mov byte [ebp + eax - 0x20], cl
mov byte [ebp + eax - 0x18], dl
inc eax
cmp eax, 8
jl 0x48c210
lea eax, [ebp - 8]
push 0x497ca4
push eax
call fcn.004902b0
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0048f020
add esp, 0x14
push ebx
push esi
mov dword [ebp - 0xc], 0
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [ebp - 0x10020]
push 1
push edx
call fcn.00491964
add esp, 0x10
cmp eax, 0x18
jl 0x48c2d1
mov edi, eax
lea esi, [edi - 0x14]
test esi, esi
jle 0x48c2a0
xor edx, edx
xor ecx, ecx
mov bl, byte [ebp + ecx - 0x20]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x10020]
je 0x48c2be
cmp ecx, 0x14
je 0x4a6b20
inc edx
cmp edx, esi
jl 0x48c280
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea edx, [ecx + edi - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [ebp - 0xc], edx
call fcn.00491d31
add esp, 0xc
jmp 0x48c254
mov bl, byte [ebp + ecx - 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001f]
je 0x48c2df
inc ecx
jmp 0x48c292
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, byte [ebp + ecx - 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001e]
je 0x48c2f4
add ecx, 2
jmp 0x48c292
mov bl, byte [ebp + ecx - 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001d]
jne 0x4a6b18
mov bl, byte [ebp + ecx - 0x1c]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001c]
je 0x4a6b07
add ecx, 4
jmp 0x48c292
add ecx, 5
cmp ecx, 0x14
jl 0x48c282
jmp 0x48c292
add ecx, 3
jmp 0x48c292
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
lea ecx, [eax + edx + 0x14]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.00491d31
mov eax, dword [esi]
push eax
push 4
lea ecx, [ebp - 8]
push 1
push ecx
call fcn.00491964
lea edx, [ebp - 8]
push 0x497c94
push edx
mov byte [ebp - 4], 0
call fcn.00491990
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x48c2d6
Function at 0x48c3a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
or ecx, 0xffffffff
mov ebx, 0x4946c4
call fcn.0048c330
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.004902b0
push esi
call fcn.0048dab6
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0048c460
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0048c490
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x48c3f4
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x497c84
push eax
call fcn.00491622
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x4a8a5b
push edi
call fcn.0048c200
cmp eax, ebx
je 0x4a8a65
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.004916a6
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x48c453
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00491964
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call 0x4cbc08
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x4a8a91
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00491c42
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x48c453

Function at 0x48c460
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.0048f400
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret