joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466df0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c4
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c4], ecx
lea eax, [ebp - 0x3b8]
push eax
push 0x65
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0x64
jle 0x466e31
mov dword [ebp - 0x3c0], 0x64
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 4], 0
jmp 0x466e57
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x3c0]
jge 0x467068
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x3b8]
and ecx, 0xffff
cmp ecx, 0x412
je 0x466e96
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x3b8]
and eax, 0xffff
cmp eax, 0x411
je 0x466e96
jmp 0x466e4e
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x3b8]
push eax
call sub.IMM32.dll_ImmGetIMEFileNameW
lea ecx, [ebp - 0x218]
push ecx
call fcn.00504c07
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x466ecc
jmp 0x466e4e
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x3b8]
and eax, 0xffff
cmp eax, 0x804
jne 0x466f43
movzx ecx, word [0x57c308]
test ecx, ecx
jne 0x466f03
lea edx, [ebp - 0x218]
push edx
push 0x57c308
call fcn.00504ae3
add esp, 8
jmp 0x466f2f
push str.ugbimel2.IME
lea eax, [ebp - 0x218]
push eax
call fcn.00507b80
add esp, 8
test eax, eax
jne 0x466f2f
lea ecx, [ebp - 0x218]
push ecx
push 0x57c308
call fcn.00504ae3
add esp, 8
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
jmp 0x467063
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x3b8]
and ecx, 0xffff
cmp ecx, 0x404
jne 0x466fbc
movzx edx, word [0x57c268]
test edx, edx
jne 0x466f7c
lea eax, [ebp - 0x218]
push eax
push 0x57c268
call fcn.00504ae3
add esp, 8
jmp 0x466fa8
push str.B5IMEL2.IME
lea ecx, [ebp - 0x218]
push ecx
call fcn.00507b80
add esp, 8
test eax, eax
jne 0x466fa8
lea edx, [ebp - 0x218]
push edx
push 0x57c268
call fcn.00504ae3
add esp, 8
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
jmp 0x467063
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x3b8]
and edx, 0xffff
cmp edx, 0x411
jne 0x467063
push 5
lea eax, [ebp - 0x218]
push eax
push str.GBIMEV5.IME
call fcn.005079c9
add esp, 0xc
test eax, eax
jne 0x466ff7
jmp 0x466e4e
push 5
lea ecx, [ebp - 0x218]
push ecx
push str.KSIMEV4.IME
call fcn.005079c9
add esp, 0xc
test eax, eax
jne 0x467016
jmp 0x466e4e
movzx edx, word [0x57c3a8]
test edx, edx
jne 0x467054
movzx eax, byte [0x57c864]
test eax, eax
je 0x467040
push 0x548f68
push 0x57c3a8
call fcn.00504ae3
add esp, 8
jmp 0x467054
lea ecx, [ebp - 0x218]
push ecx
push 0x57c3a8
call fcn.00504ae3
add esp, 8
mov edx, dword [ebp - 0x3bc]
add edx, 1
mov dword [ebp - 0x3bc], edx
jmp 0x466e4e
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret
Function at 0x46ec60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b64b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x578750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
call fcn.0047d8f0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x5a0]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00473850
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x5d0], 0
jne 0x46ee78
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x5d0], 1
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x5c0]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + eax*4 + 0x64]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.0047e0a0
mov ecx, dword [ebp - 0x20]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46ed27
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x5c0]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ecx*4 + 0x64]
imul eax, eax, 0x5c
add eax, 0x585988
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.IMM32.dll_ImmSetCompositionFontW
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmReleaseContext
push 0
push 0xe801
mov ecx, dword [0x584fc0]
call fcn.0041cdf0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [0x584fc0]
mov ecx, dword [edx + 0x12c]
call fcn.0041e270
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x64], 0
je 0x46ed70
push 1
push 0x54a9c0
push 3
mov ecx, dword [ebp - 0x18]
call fcn.004f6ba7
jmp 0x46ed81
push 1
push 0x54a9cc
push 3
mov ecx, dword [ebp - 0x18]
call fcn.004f6ba7
cmp dword [0x584f48], 0
je 0x46ed9c
mov dword [0x584f48], 0
mov ecx, dword [ebp - 0x20]
call fcn.00489b90
movzx ecx, byte [0x57a27c]
test ecx, ecx
je 0x46edb6
mov byte [0x57a27c], 0
mov ecx, dword [ebp - 0x20]
call fcn.00480600
cmp dword [0x584f4c], 1
jne 0x46edc9
mov dword [0x584f4c], 2
lea ecx, [ebp - 0x14]
call fcn.00401b80
mov dword [ebp - 4], 0
push str.AutoChk
push str.SOFTWAREKodenshajBeijing7AppUpdate
push reloc.TranslateMemoryCJ.dll_Ordinal_2
lea edx, [ebp - 0x1c]
push edx
call fcn.00465760
add esp, 0x10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00413820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004d61e0
push 0x54aa34
lea edx, [ebp - 0x14]
push edx
call fcn.00467920
add esp, 8
movzx eax, al
test eax, eax
je 0x46ee69
push 0x57d3e0
lea ecx, [ebp - 0x14]
call fcn.00402b30
push str.AppUpdate.exe
lea ecx, [ebp - 0x14]
call fcn.00401520
push 5
push 0
push str._updchk
lea ecx, [ebp - 0x14]
call fcn.004d6200
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004d61e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4794c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x608], 0
jl 0x4794dd
mov ecx, dword [ebp - 8]
call fcn.0047a310
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x4794f6
mov ecx, dword [ebp - 8]
call fcn.00481d30
jmp 0x47953c
mov ecx, dword [ebp - 8]
call fcn.0047d8f0
mov ecx, dword [ebp - 8]
call fcn.004a1680
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x5bc]
add eax, 1
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 0x64]
jge 0x47953c
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x5c0]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x5bc]
add edx, 1
push edx
mov ecx, dword [ebp - 8]
call fcn.00479980
mov esp, ebp
pop ebp
ret
Function at 0x47e3c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00504c07
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
call fcn.004137d0
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47e405
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0x30
push 0x54aec4
call fcn.004e20db
xor eax, eax
jmp 0x47e480
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x47e429
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0x30
push 0x54aef8
call fcn.004e20db
xor eax, eax
jmp 0x47e480
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + ecx + 2]
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00505560
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x47e490
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x1c]
call fcn.004137d0
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x47e4d0
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0x30
push 0x54af2c
call fcn.004e20db
xor eax, eax
jmp 0x47e5a3
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47e551
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00504c07
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 4
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d7c35
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00505560
add esp, 0xc
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x5c0]
push eax
call fcn.004671a0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x47e59a
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x5c0]
push eax
call fcn.00467080
add esp, 4
mov dword [ebp - 0x14], eax
xor ecx, ecx
cmp dword [ebp - 0x14], 0x3b6
sete cl
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, 0x57a100
call fcn.00418bc0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4974c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x1c]
call fcn.004137d0
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4974f1
xor eax, eax
jmp 0x4975d3
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x497572
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00504c07
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 4
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d7c35
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00505560
add esp, 0xc
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 8], 0
je 0x4975b0
mov edx, dword [ebp - 8]
movzx eax, word [edx]
test eax, eax
je 0x4975b0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x5c0]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + edx*4 + 0x64], 1
jne 0x4975b0
mov ecx, dword [0x57ac10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, 0x57a100
call fcn.00418bc0
cmp dword [ebp - 8], 0
jne 0x4975d0
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0x30
push 0x54b88c
call fcn.004e20db
xor eax, eax
jmp 0x4975d3
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x49c820
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00509530
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [0x585960], 0
mov dword [ebp - 4], 0
jmp 0x49c853
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f4
jge 0x49c88d
mov ecx, 0x584fa0
call fcn.004f065d
mov ecx, dword [eax + 0x20]
push ecx
push 0x49c7a0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x585960], 0
je 0x49c880
jmp 0x49c88d
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x49c84a
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x52
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x52
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x100c], 0
jmp 0x49c8eb
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 0x100c], 4
jge 0x49c912
push 0
push 0
push 0
push 9
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 9
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x49c8dc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049c570
add esp, 4
push 0
push 0
push 0
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x56
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x56
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
push 0x200
lea ecx, [ebp - 0xc08]
push ecx
push 0x80b6
mov edx, dword [0x584fe4]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [ebp + 8], 0x3a4
jne 0x49c99c
mov dword [ebp - 0x1010], 0x80bc
jmp 0x49c9d7
cmp dword [ebp + 8], 0x3a8
jne 0x49c9b1
mov dword [ebp - 0x1014], 0x80b8
jmp 0x49c9cb
mov eax, dword [ebp + 8]
sub eax, 0x3b6
neg eax
sbb eax, eax
and eax, 3
add eax, 0x80ba
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 0x1014]
mov dword [ebp - 0x1010], ecx
push 0x200
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 0x1010]
push eax
mov ecx, dword [0x584fe4]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x54be98
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x200
lea eax, [ebp - 0x808]
push eax
push 0x80d3
mov ecx, dword [0x584fe4]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x30
push 0x54be9c
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [0x585960]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret
Function at 0x49cae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push str.MAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
push str.MAPISendMail
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push 0x30
push 0
lea ecx, [ebp - 0x54]
push ecx
call fcn.00504b10
add esp, 0xc
mov dword [ebp - 0x4c], 0x54ac97
mov dword [ebp - 0x50], 0x54bedc
lea edx, [ebp - 0x24]
push edx
push 0
call fcn.004db74a
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call fcn.004137d0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
call fcn.0044db70
push 0
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
or ecx, 4
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3c], ecx
push 8
call fcn.004d7c06
add esp, 4
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00507fc0
add esp, 4
add eax, 1
push eax
call fcn.004d7c35
add esp, 4
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x5c]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call fcn.00508050
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x49ca90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 9
lea edx, [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x3c]
and eax, 0xfffffffb
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x3c], eax
push 1
mov ecx, dword [ebp - 0xc]
call fcn.004df146
push 0
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [ebp - 0xc]
call fcn.004a1c60
mov ecx, dword [ebp - 0xc]
call fcn.004df16d
cmp dword [ebp - 0x24], 0
je 0x49cc34
push 1
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov esp, ebp
pop ebp
ret
Function at 0x4a2e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
and ecx, 0xff
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 1]
and eax, 0xff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], 0x81
jb 0x4a2e9b
cmp dword [ebp - 8], 0x9f
jbe 0x4a2e92
cmp dword [ebp - 8], 0xe0
jb 0x4a2e9b
cmp dword [ebp - 8], 0xfc
jbe 0x4a2ead
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0x81
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0xac
jmp 0x4a2fb6
cmp dword [ebp - 0x18], 0x40
jae 0x4a2ec5
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x81
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 1], 0xac
jmp 0x4a2fb6
cmp dword [ebp - 8], 0x87
jae 0x4a2ee4
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp - 0x18]
mov byte [ecx + 1], dl
jmp 0x4a2fb6
cmp dword [ebp - 8], 0xf0
jb 0x4a2f1e
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.004a3010
cmp dword [ebp - 8], 0x81
jne 0x4a2f1e
cmp dword [ebp - 0x18], 0x40
jne 0x4a2f1e
mov edx, dword [ebp + 0xc]
mov byte [edx], 0x81
mov eax, dword [ebp + 0xc]
mov byte [eax + 1], 0xac
jmp 0x4a2fb6
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
sub eax, 0x87
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0xe0
jb 0x4a2f4a
mov ecx, dword [ebp - 0xc]
sub ecx, 0x40
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x40
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
shr eax, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
shl ecx, 4
mov edx, dword [ebp - 0x1c]
sub edx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x19e
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x22
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 6]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov al, byte [eax + edx*2]
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x22
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 6]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov al, byte [eax + edx*2 + 1]
mov byte [ecx + 1], al
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
call fcn.0044ce60
mov esp, ebp
pop ebp
ret 8
Function at 0x4b7f30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 4], 0
je 0x4b7f97
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.004b79e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b7f65
xor eax, eax
jmp 0x4b7fc6
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
jmp 0x4b7fc6
mov eax, dword [ebp + 0x10]
push eax
push 0x553358
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4b7fe0
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 4], 0
je 0x4b80cb
cmp dword [ebp + 0xc], 0
jne 0x4b8034
mov ecx, dword [ebp - 0x14]
call fcn.004b78e0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b8014
xor eax, eax
jmp 0x4b80e4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b80be
cmp dword [ebp + 0x10], 0
jne 0x4b8073
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004b79e0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b8056
xor eax, eax
jmp 0x4b80e4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b80be
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.004b79e0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4b808c
xor eax, eax
jmp 0x4b80e4
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
jmp 0x4b80e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esp, ebp
pop ebp
ret 0xc