joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov al, byte [esi + 0x44]
push ebx
xor ebx, ebx
push edi
mov dword [esp + 8], ebx
test al, al
jl 0x4c3105
je 0x4c3175
mov eax, dword [esi + 0x74]
mov eax, dword [eax + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4c3087
mov ecx, eax
call fcn.004b8a90
jmp 0x4c308c
call fcn.004b4a10
or ebx, 0xffffffff
add byte [esi + 0x44], bl
je 0x4c30fa
movsx ecx, byte [esi + 0x44]
mov edx, dword [esi + ecx*4 + 0x78]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4c30f0
mov ecx, dword [eax + 0x14]
add dword [ecx + 0x78], ebx
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.0058da40
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
or ebx, 0xffffffff
jmp 0x4c30f5
call fcn.004b4a10
add byte [esi + 0x44], bl
jne 0x4c3094
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x74], ecx
jmp 0x4c3191
cmp dword [esi + 0x40], ebx
jne 0x4c3118
mov byte [esi], 1
mov eax, 0x10
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x4c313d
cmp al, 4
jne 0x4c312b
mov eax, dword [esi + 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10]
push edx
call fcn.004ab490
add esp, 4
mov dword [esi + 0x10], ebx
mov byte [esi], 1
movzx eax, byte [esi + 2]
mov ecx, dword [esi + 8]
push eax
mov eax, dword [esi + 0x40]
push ebx
mov ebx, dword [ecx + 4]
lea edi, [esi + 0x74]
push edi
call fcn.004c0270
add esp, 0xc
mov dword [esp + 8], eax
test eax, eax
je 0x4c3169
mov byte [esi], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x4c320c
movzx edx, byte [eax + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, edx
jne 0x4c320c
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov eax, dword [esi + 0x74]
xor ecx, ecx
mov word [esi + 0x32], cx
cmp word [eax + 0x16], cx
jbe 0x4c31b6
mov byte [esi], cl
mov eax, dword [esp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 8], 0
jne 0x4c31f7
cmp dword [eax + 4], 1
je 0x4c31d2
mov eax, 0x108b8
call fcn.005283d0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, byte [eax + 9]
mov eax, dword [eax + 0x38]
mov eax, dword [edx + eax + 8]
bswap eax
push eax
mov eax, esi
mov byte [esi], 0
call fcn.004c2f80
add esp, 4
mov dword [esp + 8], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 8], 0x10
mov eax, dword [esp + 8]
mov byte [esi], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5fcecc
push 0x108ab
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.004ad9d0
add esp, 0x14
pop edi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov al, byte [esi]
push edi
test al, al
je 0x4c3a75
cmp al, 3
jb 0x4c3a55
mov eax, esi
call fcn.004bed80
test eax, eax
jne 0x4c3b97
cmp byte [esi], 1
je 0x4c3b89
mov eax, dword [esi + 4]
test eax, eax
je 0x4c3a75
mov byte [esi], 0
mov dword [esi + 4], 0
jl 0x4c3b95
mov eax, dword [esi + 0x74]
cmp byte [eax + 8], 0
jne 0x4c3abd
mov edx, dword [eax + 0x40]
movzx ecx, word [esi + 0x46]
mov cx, word [edx + ecx*2]
mov dh, cl
mov dl, ch
movzx ecx, dx
movzx edx, word [eax + 0x18]
mov eax, dword [eax + 0x38]
and ecx, edx
mov eax, dword [ecx + eax]
bswap eax
push eax
mov eax, esi
call fcn.004c2f80
add esp, 4
test eax, eax
jne 0x4c3b97
call fcn.004c3280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x46], 0
jne 0x4c3b5c
mov al, byte [esi + 0x44]
test al, al
je 0x4c3b86
and byte [esi + 1], 0xf9
movsx edx, al
xor ecx, ecx
mov word [esi + 0x32], cx
mov cx, word [esi + edx*2 + 0x46]
dec al
movsx edx, al
mov word [esi + 0x46], cx
mov ecx, dword [esi + 0x74]
mov byte [esi + 0x44], al
mov eax, dword [esi + edx*4 + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4c3b4c
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.0058da40
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4c3b51
call fcn.004b4a10
cmp word [esi + 0x46], 0
je 0x4c3ac8
mov eax, dword [esi + 0x74]
mov ecx, 0xffff
add word [esi + 0x46], cx
cmp byte [eax + 2], 0
je 0x4c3b95
cmp byte [eax + 8], 0
jne 0x4c3b95
push 0
push esi
call fcn.004c3ba0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
mov eax, 0x65
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.004c3050
cmp eax, 0x10
jne 0x4c7ee1
mov dword [edi], 0
mov dword [edi + 4], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4c800e
mov ecx, dword [esi + 0x74]
cmp byte [ecx + 8], 0
jne 0x4c7ef8
cmp byte [ecx + 2], 0
jne 0x4c7f05
movzx eax, word [ecx + 0x16]
cdq
add dword [esp + 0x10], eax
adc dword [esp + 0x14], edx
cmp byte [ecx + 8], 0
je 0x4c7faa
mov al, byte [esi + 0x44]
test al, al
je 0x4c7ff9
and byte [esi + 1], 0xf9
xor edx, edx
mov word [esi + 0x32], dx
movsx edx, al
mov dx, word [esi + edx*2 + 0x46]
dec al
mov byte [esi + 0x44], al
movsx eax, al
mov word [esi + 0x46], dx
mov edx, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], edx
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4c7f90
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.0058da40
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4c7f95
call fcn.004b4a10
mov ecx, dword [esi + 0x74]
mov dx, word [esi + 0x46]
cmp dx, word [ecx + 0x16]
jae 0x4c7f0f
inc word [esi + 0x46]
movzx eax, word [esi + 0x46]
movzx edx, word [ecx + 0x16]
cmp eax, edx
jne 0x4c7fc3
movzx eax, byte [ecx + 9]
mov ecx, dword [ecx + 0x38]
mov eax, dword [eax + ecx + 8]
jmp 0x4c7fdd
mov edx, dword [ecx + 0x40]
mov ax, word [edx + eax*2]
mov dh, al
mov dl, ah
movzx eax, dx
movzx edx, word [ecx + 0x18]
mov ecx, dword [ecx + 0x38]
and eax, edx
mov eax, dword [eax + ecx]
bswap eax
push eax
mov eax, esi
call fcn.004c2f80
add esp, 4
test eax, eax
je 0x4c7ee9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [eax], edx
mov dword [eax + 4], ecx
call fcn.004c3050
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e1360
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp edi, eax
je 0x4e150c
mov ebx, dword [ebp + 8]
push 0
push 0x4c
mov eax, ebx
call fcn.004ab890
mov esi, eax
add esp, 8
test esi, esi
je 0x4e1508
mov edx, dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push eax
push ebx
call fcn.004e1000
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [esi], eax
mov edx, dword [edi + 0x20]
push ecx
push edx
push ebx
call fcn.004e1140
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
add esp, 0xc
test eax, eax
je 0x4e13e3
mov ecx, dword [ebp + 0x10]
push 0
push ecx
push eax
push ebx
call fcn.004e0c80
add esp, 0x10
jmp 0x4e13e5
xor eax, eax
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
push edx
push eax
push ebx
call fcn.004e1000
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
add esp, 0xc
test eax, eax
je 0x4e1415
mov ecx, dword [ebp + 0x10]
push 0
push ecx
push eax
push ebx
call fcn.004e0c80
add esp, 0x10
jmp 0x4e1417
xor eax, eax
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
push edx
push eax
push ebx
call fcn.004e1000
mov edx, dword [esp + 0x24]
mov dword [esi + 0x30], eax
mov cl, byte [edi + 4]
mov byte [esi + 4], cl
mov dword [esi + 0x38], edx
mov dword [esi + 0x34], 0
mov eax, dword [edi + 0x3c]
add esp, 0xc
test eax, eax
je 0x4e145b
mov ecx, dword [ebp + 0x10]
push 0
push ecx
push eax
push ebx
call fcn.004e0c80
add esp, 0x10
jmp 0x4e145d
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov edx, dword [edi + 8]
or eax, 0xffffffff
and edx, 0xffffffdf
mov dword [esi + 8], edx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ax, word [edi + 6]
mov word [esi + 6], ax
mov ecx, dword [edi + 0x40]
push ecx
push ebx
call fcn.004e0f20
xor ecx, ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
mov eax, dword [edi + 0x48]
add esp, 8
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
cmp eax, ecx
je 0x4e14df
jmp 0x4e14b4
mov eax, dword [esp + 0xc]
push 0
push ebx
call fcn.005209f0
mov ecx, dword [esp + 0x1c]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x4e14df
mov edx, dword [esp + 0xc]
add eax, 0x18
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4e14b0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x48], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov dword [edx], esi
mov edi, dword [edi + 0x34]
lea eax, [esi + 0x34]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
test edi, edi
jne 0x4e138c
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6b40
Capabilities:
Reference sql statements

Disassembly:
push ebx
push edi
push esi
push str.sqlite_master
push esi
mov ebx, eax
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
call fcn.004eb8e0
add esp, 0x14
test edi, edi
jne 0x4e6b6f
push esi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
call fcn.004eb8e0
add esp, 0xc
pop ebx
ret

Function at 0x4eb9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
lea ebx, [ebx]
xor edi, edi
cmp dword [ebp + 0x14], edi
jle 0x4eb9f9
cmp edi, 2
mov esi, edi
jge 0x4eb9c1
xor esi, 1
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4eb9dd
mov edx, dword [ebp + 0x10]
mov eax, esi
shl eax, 4
mov eax, dword [eax + edx]
call fcn.004ae7e0
test eax, eax
jne 0x4eb9f3
mov eax, dword [ebp + 0x10]
shl esi, 4
mov eax, dword [esi + eax + 0xc]
add eax, 8
call fcn.004afeb0
test eax, eax
jne 0x4eba37
inc edi
cmp edi, dword [ebp + 0x14]
jl 0x4eb9b7
mov al, byte [ebx]
movzx edx, al
movzx edx, byte [edx + 0x5e3e00]
sub edx, 0x73
mov ecx, ebx
jne 0x4eba35
mov edx, str.sqlite_master
sub edx, ebx
test al, al
je 0x4eba3c
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x5e3e00]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x5e3e00]
sub edi, esi
je 0x4eba13
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x4eba50
neg eax
sbb eax, eax
jmp 0x4eba59
test eax, eax
je 0x4eba35
call fcn.004ae7e0
test eax, eax
jne 0x4eba35
mov ebx, str.sqlite_temp_master
jmp 0x4eb9b0
Function at 0x52aac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c4338
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62f570]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x52ab2a
cmp dword [edi + 0x18], eax
je 0x52ab2a
push ebx
push eax
call fcn.004039c0
test al, al
je 0x52ab2a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x52ab23
mov eax, dword [edi + 4]
jmp 0x52ab26
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x52acfe
jmp 0x52ab46
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x52acfe
cmp al, 0x5c
jne 0x52ac48
cmp esi, ecx
je 0x52ac63
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x52ab87.35
movzx eax, byte [eax + 0x52ad40]
jmp dword [eax*4 + 0x52ad18]
push 0x22
jmp 0x52ac4d
push 0x2f
jmp 0x52ac4d
push 0x5c
jmp 0x52ac4d
push 8
jmp 0x52ac4d
push 0xc
jmp 0x52ac4d
push 0xa
jmp 0x52ac4d
push 0xd
jmp 0x52ac4d
push 9
jmp 0x52ac4d
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.0052ada0
test al, al
je 0x52aca0
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x40]
call fcn.00528e80
push 0
push eax
or eax, 0xffffffff
mov esi, edi
mov dword [esp + 0x88], ebx
call fcn.0042ded0
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x58], 0x10
jb 0x52ac2a
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0053a859
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jmp 0x52ac54
mov edx, dword [esp + 0x20]
push edx
mov eax, ebx
call fcn.0041b670
cmp esi, dword [esp + 0x18]
jne 0x52ab42
jmp 0x52acfe
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x60]
call fcn.004028f0
mov eax, dword [esp + 0x88]
push ebp
push eax
mov edx, esi
lea ecx, [esp + 0x64]
mov dword [esp + 0x88], 0
call fcn.0052b050
cmp dword [esp + 0x74], 0x10
mov bl, al
jb 0x52acfe
mov ecx, dword [esp + 0x60]
push ecx
jmp 0x52acf6
xor al, al
jmp 0x52ad00
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.00403830
mov edx, dword [esp + 0x88]
push ebp
push edx
mov edx, esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], 2
call fcn.0052b050
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x52acfe
mov eax, dword [esp + 0x28]
push eax
call fcn.0053a859
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x537440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c4038
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x62f570]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esp + 0x14], ebx
push eax
mov dword [esi], vtable.Json::StyledWriter.0
call fcn.005325c0
mov dword [esi + 0x30], ebx
mov eax, 0xf
mov dword [esi + 0x34], eax
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x54], 0x4a
mov dword [esi + 0x58], 3
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x546607
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x54664e
call fcn.00553a48
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x54664e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x54666a
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0054617f
mov esi, eax
test edi, edi
je 0x546668
test ebx, ebx
je 0x546668
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x547179
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5ba790
call fcn.00589ddf
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x54719e
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x5471e4
lea ecx, [ebp - 0x10]
call fcn.00401680
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0053b726
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401640
mov eax, esi
call fcn.00589eb7
ret 8

Function at 0x54bd30
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x54bd5b
call fcn.00553a48
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x54bd7e
push eax
push dword [esi + 4]
call fcn.0054bcb6
push esi
push eax
mov ecx, 0x636f08
call fcn.0054b709
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x554080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x5540c8
call fcn.00553a48
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5540c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x55410b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x5540f4
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x5540f4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x554108
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x556b10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x5bbc2e
call fcn.00589ddf
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004065a0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x556b72
call fcn.00552e93
cmp eax, 1
jne 0x556b72
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.005562db
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405d50
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401640
mov dword [ebp + 8], reloc.Languages.dll_Ordinal_1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401640
mov eax, esi
call fcn.00589eb7
ret 0x10

Function at 0x556b9b
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x5bbc59
call fcn.00589ddf
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004065a0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x556bfd
call fcn.00552e93
cmp eax, 1
jne 0x556bfd
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.005562db
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405d50
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401640
mov dword [ebp + 8], reloc.Languages.dll_Ordinal_1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401640
mov eax, esi
call fcn.00589eb7
ret 0x14
Function at 0x556c29
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x5bbc84
call fcn.00589ddf
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004065a0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x556c8b
call fcn.00552e93
cmp eax, 1
jne 0x556c8b
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.005562db
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405d50
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401640
mov dword [ebp + 8], reloc.Languages.dll_Ordinal_1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401640
mov eax, esi
call fcn.00589eb7
ret 8

Function at 0x565d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x565d24
cmp dword [edi + 0x54], 0
jne 0x565d24
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00553a48
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00565cc1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8