joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526b5b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
lea edi, [esi + 0x50]
push edi
mov dword [ebp - 4], ebx
call fcn.00481170
mov dword [esi + method.CefWebViewHost.virtual_0], vtable.CefWebViewHost.0
mov dword [esi + 0x19c], 4
mov dword [esi + method.IFontIconCBSimpleImpl_class_CEditionDlg_.virtual_0], vtable.IFontIconCBSimpleImpl_class_CEditionDlg_.0
mov dword [esi], vtable.CEditionDlg.0
mov dword [esi + 0x2c], vtable.CEditionDlg.1.0
mov dword [edi], vtable.CEditionDlg.2.0
mov dword [esi + method.CEditionDlg.3.virtual_0], vtable.CEditionDlg.3.0
mov dword [esi + method.IFontIconCBSimpleImpl_class_CEditionDlg_.virtual_0], vtable.CEditionDlg.4.0
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], ebx
mov byte [esi + 0x1b4], bl
mov dword [esi + 0x1b8], ebx
mov edx, dword [0x570fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x570fac
call eax
add eax, 0x10
mov dword [esi + 0x1bc], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b0150
Capabilities:
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5273d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x30]
push 0x64
push eax
mov byte [edi + 0x1b4], 1
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [edi + 0x1b0], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x34], al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
xor ecx, ecx
cmp dword [ebp + 8], eax
mov dword [ebp - 4], eax
mov edx, dword [edi + 0x198]
mov edx, dword [edx + 4]
setne cl
lea eax, [ebp - 0x44]
push eax
lea ecx, [ecx + ecx + 2]
mov dword [ebp - 0x3c], ecx
lea ecx, [edi + 0x198]
call edx
mov eax, 2
call fcn.004b09b0
cmp dword [ebp - 0x20], 0x10
jb 0x4b01f2
mov eax, dword [ebp - 0x34]
push eax
call fcn.004f3984
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f398f
mov esp, ebp
pop ebp
ret 4
Function at 0x4b04b0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a4b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx - 0x168]
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor edi, edi
push edi
push edi
mov dword [ebx + 0x18], edi
mov ecx, dword [0x5742b4]
push 0x41b
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x4b065c
cmp byte [ebx + 0x1c], 0
jne 0x4b065c
push edi
lea edx, [ebp + 8]
push edx
mov dword [ebp + 8], edi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x4b0535
cmp dword [ebx + 0x20], 2
je 0x4b06d3
cmp dword [ebx + 0x20], 3
je 0x4b06d3
mov eax, dword [esi + 0x20]
mov byte [ebp + 0xb], 1
cmp eax, edi
je 0x4b05fb
mov edi, 4
cmp eax, edi
jbe 0x4b0653
cmp dword [esi + 0x24], 0x10
jb 0x4b0566
mov esi, dword [esi + 0x10]
jmp 0x4b0569
add esi, 0x10
test esi, esi
jne 0x4b0577
push 0x80070057
call fcn.0042c060
mov eax, dword [0x570fac]
mov edx, dword [eax]
push 1
push edi
mov ecx, 0x570fac
call edx
test eax, eax
jne 0x4b0591
call fcn.0042bdd0
add eax, 0x10
cmp dword [eax - 8], edi
mov dword [ebp - 0x10], eax
jge 0x4b05a6
push 0x80070057
call fcn.0042c060
push edi
push esi
push edi
mov dword [eax - 0xc], edi
push eax
mov byte [eax + 4], 0
call fcn.004f4154
add esp, 0x10
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.004b0ef0
mov eax, dword [ebp - 0x10]
push str.http
push eax
call fcn.004fa619
add esp, 8
test eax, eax
setne al
test al, al
je 0x4b05e6
mov byte [ebp + 0xb], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00441c30
cmp byte [ebp + 0xb], 0
je 0x4b0653
lea edi, [ebx - 0x198]
mov eax, 3
call fcn.004b09b0
mov ecx, dword [ebx - 0x168]
push 0x185
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push str.Main.Menu.Business
push str.main_menu
push 0x540748
mov esi, 5
call fcn.00452970
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
mov esi, 9
jmp 0x4b06ac
mov edx, dword [ebx + 0x20]
cmp edx, 2
je 0x4b06d3
mov ecx, 9
cmp eax, 2
jne 0x4b0673
lea ecx, [eax + 9]
jmp 0x4b0685
cmp eax, 3
jne 0x4b067d
lea ecx, [eax + 9]
jmp 0x4b0685
cmp eax, 4
jne 0x4b0685
lea ecx, [eax - 1]
push edi
cmp edx, 3
jne 0x4b06aa
lea edx, [ebp + 8]
push edx
mov dword [ebp + 8], edi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4b06c3
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x4b06d3
cmp eax, 0xfffffffd
je 0x4b06d3
jmp 0x4b06c3
mov esi, ecx
push str.Main.Menu.Business
push str.main_menu
push 0x540748
call fcn.00452970
add esp, 0x10
mov eax, 2
lea edi, [ebx - 0x198]
call fcn.004b09b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1160
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x20]
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
sub eax, ecx
sub eax, dword [ebp - 0x20]
mov edi, dword [ebp - 4]
add eax, edx
sub edi, dword [ebp - 0xc]
mov esi, ecx
sub esi, edx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
sar ecx, 1
sub eax, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x1c]
add ecx, esi
mov dword [ebp - 0xc], eax
add eax, edi
lea esi, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
call fcn.00489d50
cmp byte [ebp + 0xc], 0
jne 0x4b1206
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push 5
push 0
push 0
push edx
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push 0
push ecx
push edx
push 0xffffffffffffffff
push ebx
call esi
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0
push 0
push eax
push ecx
push 0xfffffffffffffffe
push ebx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b3340
Capabilities:
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527238
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x30]
push 0x64
push eax
mov byte [edi + 0x1b4], 1
call dword [sym.imp.USER32.dll_KillTimer]
xor ebx, ebx
mov dword [edi + 0x1b0], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
xor ecx, ecx
cmp esi, ebx
setne cl
mov dword [ebp - 4], ebx
mov edx, dword [edi + 0x198]
mov edx, dword [edx + 4]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ecx + ecx + 2]
mov dword [ebp - 0x38], ecx
lea ecx, [edi + 0x198]
call edx
cmp esi, ebx
sete al
movzx ecx, al
push ecx
lea eax, [ebx + 2]
call fcn.004b49c0
cmp dword [ebp - 0x1c], 0x10
jb 0x4b33e9
mov edx, dword [ebp - 0x30]
push edx
call fcn.004f3984
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f398f
mov esp, ebp
pop ebp
ret
Function at 0x4b62d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527170
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], eax
lea eax, [edi + 0x50]
push eax
mov dword [ebp - 4], ebx
call fcn.00481170
mov dword [edi + method.CefWebViewHost.virtual_0], vtable.CefWebViewHost.0
mov dword [edi + 0x19c], 4
lea esi, [edi + 0x1a0]
mov byte [ebp - 4], 2
call fcn.004a6eb0
mov dword [edi], vtable.CIAPExitPromoDlg.0
mov dword [edi + 0x2c], vtable.CIAPExitPromoDlg.1.0
mov dword [edi + 0x50], vtable.CIAPExitPromoDlg.2.0
mov dword [edi + method.CIAPExitPromoDlg.3.virtual_0], vtable.CIAPExitPromoDlg.3.0
mov dword [esi], vtable.CIAPExitPromoDlg.4.0
mov byte [edi + 0x27c], bl
xor ecx, ecx
mov dword [edi + 0x298], 7
mov dword [edi + 0x294], ebx
mov word [edi + 0x284], cx
lea edx, [edi + 0x2a0]
mov byte [ebp - 4], 4
push edx
mov dword [edi + 0x29c], ebx
call fcn.004706b0
lea eax, [edi + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 1
test byte [0x5758b4], al
jne 0x4b63ea
or dword [0x5758b4], eax
mov eax, 0x60
mov dword [0x5758b8], 0x64
mov dword [0x5758bc], eax
mov dword [0x5758c0], eax
mov byte [0x5758c4], bl
call fcn.00405f90
test al, al
jne 0x4b63ea
call fcn.00453200
cmp byte [0x5758c4], bl
je 0x4b640c
mov eax, dword [0x5758b8]
cmp eax, 0x64
je 0x4b640c
push 0x64
push eax
push 0x29a
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x4b6411
mov eax, 0x29a
mov dword [edi + 0x464], eax
mov dword [edi + 0x468], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b7800
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520b0b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x570fac
mov dword [ebp - 0x10], 0x575918
mov byte [0x575918], bl
mov byte [0x575919], bl
call edx
add eax, 0x10
mov dword [0x57591c], eax
mov dword [ebp - 4], ebx
mov dword [0x575920], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004b7880
mov eax, 0x575918
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7a10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51f848
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x569638]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x570fac
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x3c], 0
mov eax, esp
mov dword [esp + 0x18], esp
push eax
mov ecx, str.InstallDate
lea esi, [esp + 0x18]
xor edi, edi
call fcn.0042bf40
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, str.SOFTWARE360TotalSecurityUserProfile
mov byte [esp + 0x44], 1
call fcn.0042bf40
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [esp + 0x28]
push edx
mov ecx, edi
mov byte [esp + 0x48], 0
call fcn.0042a8f0
push eax
mov byte [esp + 0x3c], 2
call fcn.0042aa40
add esp, 4
test eax, eax
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x24]
sete byte [esp + 0xf]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b7ad8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b7af8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0xf], 0
jne 0x4b7b6c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004fa0fa
push 0
mov edi, eax
mov esi, edx
call fcn.004f504e
add esp, 8
cmp edx, esi
jl 0x4b7b6c
jg 0x4b7b21
cmp eax, edi
jbe 0x4b7b6c
sub eax, edi
sbb edx, esi
test edx, edx
jg 0x4b7b6c
jl 0x4b7b30
cmp eax, 0x78
ja 0x4b7b6c
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b7b58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b7b94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b7c70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
test byte [0x575e04], 1
jne 0x4b7cc1
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
or dword [0x575e04], 1
mov ecx, 0x570fac
call edx
add eax, 0x10
push 0x52de60
mov dword [0x575e00], eax
call fcn.004f3ac5
add esp, 4
mov eax, dword [0x575e00]
cmp dword [eax - 0xc], 0
jne 0x4b7d77
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.004fb000
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push 1
mov dword [ebp - 0x214], 0x104
call edi
test eax, eax
jne 0x4b7d30
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push eax
mov dword [ebp - 0x214], 0x104
call edi
mov eax, dword [ebp - 0x214]
pop edi
cmp eax, 0x105
jae 0x4b7d72
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b7d51
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x210]
push edx
push 0x575e00
call fcn.0042be60
mov eax, dword [0x575e00]
add eax, 0xfffffff0
call fcn.0042b8e0
mov ecx, dword [ebp - 4]
add eax, 0x10
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
call fcn.004f398f
mov esp, ebp
pop ebp
ret
Function at 0x4bc840
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526f20
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], eax
lea eax, [edi + 0x54]
mov dword [ebp - 4], ebx
push eax
mov dword [edi + 0x50], vtable.WTL::CMessageFilter.0
call fcn.00481170
mov dword [edi + method.CefWebViewHost.virtual_0], vtable.CefWebViewHost.0
mov dword [edi + 0x1a0], 4
lea esi, [edi + 0x1a4]
mov byte [ebp - 4], 2
call fcn.004a6eb0
mov dword [edi], vtable.CPromoDlg.0
mov dword [edi + 0x2c], vtable.CPromoDlg.1.0
mov dword [edi + 0x50], vtable.CPromoDlg.2.0
mov dword [edi + 0x54], vtable.CPromoDlg.3.0
mov dword [edi + method.CPromoDlg.4.virtual_0], vtable.CPromoDlg.4.0
mov dword [esi], vtable.CPromoDlg.5.0
mov dword [edi + 0x280], ebx
mov dword [edi + 0x284], ebx
xor ecx, ecx
mov dword [edi + 0x2a0], 7
mov dword [edi + 0x29c], ebx
mov word [edi + 0x28c], cx
lea edx, [edi + 0x2ac]
mov byte [ebp - 4], 4
push edx
mov byte [edi + 0x2a4], bl
mov dword [edi + 0x2a8], ebx
call fcn.004706b0
lea eax, [edi + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 1
test byte [0x5758b4], al
jne 0x4bc974
or dword [0x5758b4], eax
mov eax, 0x60
mov dword [0x5758b8], 0x64
mov dword [0x5758bc], eax
mov dword [0x5758c0], eax
mov byte [0x5758c4], bl
call fcn.00405f90
test al, al
jne 0x4bc974
call fcn.00453200
cmp byte [0x5758c4], bl
je 0x4bc996
mov eax, dword [0x5758b8]
cmp eax, 0x64
je 0x4bc996
push 0x64
push eax
push 0x29a
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x4bc99b
mov eax, 0x29a
mov dword [edi + 0x470], eax
mov dword [edi + 0x474], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bdbb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526b5b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
lea ebx, [esi + 0x50]
push ebx
mov dword [ebp - 4], edi
call fcn.00481170
mov dword [esi + method.CefWebViewHost.virtual_0], vtable.CefWebViewHost.0
mov dword [esi + 0x19c], 2
mov dword [esi], vtable.CPromoPopup.0
mov dword [esi + 0x2c], vtable.CPromoPopup.1.0
mov dword [ebx], vtable.CPromoPopup.2.0
mov dword [esi + method.CPromoPopup.3.virtual_0], vtable.CPromoPopup.3.0
mov dword [esi + 0x1a8], edi
mov dword [esi + 0x1ac], edi
mov dword [esi + 0x1b0], edi
mov dword [esi + 0x1b4], edi
mov edx, dword [0x570fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x570fac
call eax
add eax, 0x10
mov dword [esi + 0x1b8], eax
mov dword [esi + 0x1c0], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c6370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x4c6383
lea eax, [esi + 0xd]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
xor edi, edi
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4c6390
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x4c68b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [ebp - 0x218]
push esi
xor edi, edi
or eax, 0x2001f
push eax
push edi
push edx
push ecx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x214]
mov esi, eax
cmp esi, edi
jne 0x4c6931
xor eax, eax
cmp ecx, edi
je 0x4c6919
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x210], edi
mov esi, eax
mov dword [ebp - 0x214], ecx
cmp eax, edi
je 0x4c693f
cmp ecx, edi
je 0x4c6a00
push ecx
jmp 0x4c69fa
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x20c]
push eax
push edi
push ecx
mov dword [ebp - 0x21c], 0x100
call esi
test eax, eax
jne 0x4c69c0
nop
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x214]
call fcn.004c68b0
mov dword [ebp - 0x218], eax
cmp eax, edi
jne 0x4c6a15
lea edx, [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x214]
push edi
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push edi
push edx
mov dword [ebp - 0x21c], 0x100
call esi
test eax, eax
je 0x4c6970
mov eax, dword [ebp - 0x214]
cmp eax, edi
je 0x4c69d7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], edi
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebx]
push eax
push ecx
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x214]
cmp eax, edi
je 0x4c6a00
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f398f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x214]
cmp ecx, edi
je 0x4c6a02
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f398f
mov esp, ebp
pop ebp
ret 4
Function at 0x4c7520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c386
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x420], edi
cmp edi, ebx
jne 0x4c75a0
call fcn.00427560
mov esi, eax
jmp 0x4c76ac
mov eax, dword [ebp - 0x41c]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x4c75bf
call fcn.00427560
jmp 0x4c76a3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, ebx
jne 0x4c75db
call fcn.00427560
jmp 0x4c76a3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x41c], eax
cmp ecx, eax
jae 0x4c761e
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], ecx
je 0x4c7609
lea eax, [ebp - 0x418]
call fcn.004c5ca0
lea esi, [ebp - 0x424]
call fcn.004c63c0
mov eax, 0x8007000e
jmp 0x4c76d2
mov eax, ecx
lea esi, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004c5ce0
mov dword [ebp - 4], 1
jmp 0x4c764d
mov ecx, dword [ebp - 0x418]
cmp ecx, ebx
jne 0x4c765e
mov esi, 0x8007000e
jmp 0x4c76a5
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x428]
push eax
push ecx
push eax
push edx
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x4c7682
call fcn.00427560
jmp 0x4c76a3
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x418]
push eax
lea edx, [ebp - 0x430]
call fcn.004c73d0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], ecx
je 0x4c76d0
lea eax, [ebp - 0x418]
call fcn.004c5ca0
jmp 0x4c76d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f398f
mov esp, ebp
pop ebp
ret 0xc