joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476360
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6057b6
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x6a3000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x46c], edi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x470], edi
mov esi, dword [edx]
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4763ce
movzx eax, word [esi + ecx]
test ax, ax
je 0x4763ce
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4763b0
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x104
lea eax, [ebp - 0x218]
cmp word [eax], 0
je 0x4763f4
add eax, 2
sub ecx, 1
jne 0x4763e6
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x476448
lea ecx, [ebp - 0x218]
lea ecx, [ecx + esi*2]
sub edx, esi
je 0x47643b
mov ebx, str..exe
mov eax, SysReAllocString
sub ebx, ecx
test eax, eax
je 0x47643b
movzx esi, word [ebx + ecx]
test si, si
je 0x47643b
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x476422
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4764b5
mov dword [ebp - 4], 0
call fcn.00483151
mov ecx, eax
mov dword [ebp - 4], esi
test ecx, ecx
je 0x4765ac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 1
mov eax, 0x66d1c4
mov ecx, edi
test eax, 0xffff0000
jne 0x4764a9
movzx eax, ax
push eax
call fcn.004100f0
jmp 0x47658e
push 0
push 0x66d1c4
jmp 0x476589
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [eax + eax]
test byte [ebp - 0x468], 0x10
je 0x476517
lea eax, [ebp - 0x468]
push eax
push esi
call ebx
test eax, eax
jne 0x4764c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 4
call fcn.00483151
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x4765ac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 5
jmp 0x47648d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 2
call fcn.00483151
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x4765ac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x43c]
mov dword [ebp - 4], 3
test eax, 0xffff0000
jne 0x476562
movzx eax, ax
mov ecx, edi
push eax
call fcn.004100f0
jmp 0x47658e
lea ecx, [ebp - 0x43c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x476570
sub ecx, edx
lea eax, [ebp - 0x43c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00412520
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca888
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040c5c0
int3
Function at 0x476b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6058ce
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6a3000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov bl, byte [ebp + 8]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [esi], 0
mov dword [ebp - 4], 2
call fcn.00483151
mov ecx, eax
mov byte [ebp - 4], 1
test ecx, ecx
je 0x476c07
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
movzx eax, bl
xor eax, 1
mov dword [ebp - 0x18], 1
dec eax
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x476bda
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x476bbb
xor eax, eax
mov ecx, esi
push eax
push edx
call fcn.00412520
jmp 0x476be0
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x476bc0
sub eax, edi
mov ecx, esi
sar eax, 1
push eax
push edx
call fcn.00412520
jmp 0x476be0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca888
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040c5c0
int3
Function at 0x47b500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x47b531
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x47b520
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x47bed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6064fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6a3000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
jbe 0x47bf0e
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x47bf32
nop word [eax + eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x47bf20
push edi
push edx
lea eax, [ebp - 0x1c]
mov ecx, 0x6b3040
push eax
call fcn.0046b7f0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x47bf65
mov dword [ebx], eax
mov eax, ebx
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x6b3048], 0x4924924
je 0x47c0d1
mov dword [ebp - 0x24], 0x6b3044
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x20], 0
call fcn.00482e20
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x10]
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x28], esi
call fcn.00410020
mov eax, dword [ebp - 0x10]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.00410020
mov dword [ebp - 4], 2
mov ecx, dword [0x6b3048]
mov esi, dword [0x6b305c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, esi
addsd xmm0, qword [eax*8 + 0x6763d0]
cvtdq2pd xmm1, xmm1
mov eax, esi
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6763d0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x6b3040]
comiss xmm2, xmm1
jbe 0x47c06d
divss xmm0, xmm1
call fcn.0040c790
call fcn.005caf30
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x47c045
cmp esi, 0x200
jae 0x47c043
shl esi, 3
cmp esi, ecx
jae 0x47c045
mov esi, ecx
push esi
mov ecx, 0x6b3040
call fcn.0046b4a0
push edi
lea eax, [ebx + 8]
mov ecx, 0x6b3040
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0046b7f0
mov ecx, dword [0x6b3048]
mov edx, dword [eax]
jmp 0x47c070
mov edx, dword [ebp - 0x1c]
mov esi, dword [edx + 4]
inc ecx
mov dword [0x6b3048], ecx
mov dword [ebx], edx
mov dword [ebx + 4], esi
mov dword [esi], ebx
mov dword [edx + 4], ebx
mov eax, dword [0x6b3058]
mov ecx, dword [0x6b304c]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x6b3044]
jne 0x47c0a1
mov dword [ecx + eax*8], ebx
jmp 0x47c0b0
cmp edi, edx
jne 0x47c0aa
mov dword [ecx + eax*8], ebx
jmp 0x47c0b4
cmp dword [ecx + eax*8 + 4], esi
jne 0x47c0b4
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005cc5d9
int3
Function at 0x48802d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x48806c
call fcn.004a4868
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48806c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x488074
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0048f548
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x488a98
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x488b24
cmp dword [esi + 0x20], 0
je 0x488b24
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x488b24
cmp dword [ebp + 8], 0
je 0x488b24
xor edi, edi
mov ebx, edi
call fcn.004a4868
push 0x619680
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x488b08
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x488b24
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.004a979b
mov edi, eax
add esp, 0xc
test edi, edi
je 0x488b20
mov ecx, esi
call fcn.00488841
mov eax, edi
jmp 0x488b26
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x48d9cd
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x606ae2
call fcn.005cadb4
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x48d9f3
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x48da4d
lea ecx, [ebp - 0x10]
call fcn.00410470
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x617acc]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005e3659
push eax
call fcn.0040c500
add esp, 0x14
test esi, esi
je 0x48da40
push esi
call fcn.005ddf98
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040c6c0
mov eax, ebx
call fcn.005cad82
ret 8
Function at 0x48e202
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x48e24a
call fcn.004a4868
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48e24a
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x48e257
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x48e293
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x48e276
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x48e27f
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x48e291
test di, di
jne 0x48e291
test dx, dx
je 0x48e293
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48e298
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x48e2c3
cmp dword [esi + 0x80], 0
jne 0x48e2c3
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.004a4868
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48e2f3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48e2f3
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.0048e55f
jmp 0x48e2f5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x48e2fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.004a4868
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48e33c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48e33c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0048e344
jmp 0x48e33e
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x48e634
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x606fec
call fcn.005cae1d
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.004a4868
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x48e693
call fcn.004a4868
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48e6a7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x48e6a3
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x48e6af
or eax, 0xffffffff
jmp 0x48e801
mov ecx, edi
call fcn.0048ec3e
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.00486d48
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x48e73b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x48e73b
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x48e73b
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.00483f10
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x48e738
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x617acc]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x48e738
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0048db0d
test eax, eax
je 0x48e738
push 0
mov ecx, esi
call fcn.0048d412
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.004869d1
push ebx
call fcn.0048809a
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0048e5d7
test eax, eax
jne 0x48e784
cmp dword [edi + 0x9c], eax
jne 0x48e784
call fcn.004a4868
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0048809a
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0048e5d7
and dword [edi + 0x9c], 0
jmp 0x48e7af
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x48e7c3
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0048d412
test esi, esi
je 0x48e7d0
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x48e7e6
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x48e7e6
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x617acc]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0048ebf5
mov eax, dword [edi + 0x68]
call fcn.005cad82
ret
Function at 0x49d033
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x607b3b
call fcn.005cadb4
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x49d0db
push dword [ebp + 8]
call fcn.0049d353
mov dword [ebp - 0x10], eax
test eax, eax
je 0x49d161
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x49d0c4
push ecx
call fcn.004a44ac
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49d0c4
xor edi, edi
inc edi
jmp 0x49d0ce
push dword [ebx]
call fcn.00482e1b
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.0049cefa
jmp 0x49d15f
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x617acc]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x49d157
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.004a44ac
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x49d151
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0049ced6
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.0049ced6
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x49d11f
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.0040c6c0
mov eax, edi
call fcn.005cad82
ret 0x10

Function at 0x49d169
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x49d1bc
push esi
push dword [ebp + 8]
call fcn.0049d353
mov edi, eax
test edi, edi
je 0x49d1b7
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x49d1b7
mov eax, dword [ebp - 8]
jmp 0x49d1ce
mov eax, dword [ebp + 0x10]
jmp 0x49d1ce
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x49d1d4
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607b68
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.005cb1d0
mov eax, dword [0x6a3000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], edx
cmp dword [ecx + 0x58], eax
je 0x49d305
push eax
push esi
call fcn.0049d353
mov esi, eax
test esi, esi
jne 0x49d23c
push ebx
jmp 0x49d32e
lea ecx, [ebp - 0x2014]
call fcn.00410470
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push esi
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x49d2c4
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.004118f0
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.00436fa0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x49d2f2
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.004123f0
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.0040c6c0
jmp 0x49d335
push ebx
mov ecx, edi
call fcn.00422dc0
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x49d2eb
push dword [ecx + 0x6c]
lea eax, [ebp - 0x2010]
test ebx, ebx
push 0x1000
push eax
mov eax, 0x66d1c4
cmovne eax, ebx
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.00422dc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ca888
leave
ret 0x10
Function at 0x49d4f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x58], esi
je 0x49d545
push esi
push dword [ebp + 8]
call fcn.0049d353
mov edi, eax
test edi, edi
je 0x49d5c9
push dword [ebp + 0x14]
push ebx
push 3
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x49d5c9
mov eax, dword [ebp + 0x14]
push 2
pop ecx
push 0xffffffffffffffff
lea eax, [eax*2 + 1]
mul ecx
pop ecx
cmovb eax, ecx
push eax
call fcn.004a44ac
mov edx, dword [ebp + 0x14]
pop ecx
mov ecx, eax
mov dword [ebp - 8], ecx
test edx, edx
je 0x49d59b
mov dword [ebp - 4], 0x41
mov al, byte [ebx + esi]
and al, 0xf
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4], ax
mov al, byte [ebx + esi]
shr al, 4
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4 + 2], ax
inc esi
cmp esi, edx
jb 0x49d574
xor eax, eax
mov word [ecx + esi*4], ax
mov eax, dword [edi]
push ecx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x617acc]
mov ecx, edi
call esi
push dword [ebp - 8]
mov esi, eax
call fcn.00482e1b
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x49ec6b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x49ecb0
call fcn.004a4868
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49ecad
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49ecf7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x49ecd3
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x617acc]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x49ecf4
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x617acc]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x4a4e73
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4a4e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4a4ea3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.0040f6a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0054221c
int3