joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011c0
Capabilities:
Terminate thread

Disassembly:
push str.LocaliPLRESEXIT
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x4c7d1c]
push 0x5dc
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4011ff
mov ecx, dword [0x4c7d1c]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret

Function at 0x4019e0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push edi
push 1
push 0x23
lea eax, [ebp - 0x800]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401a3b
lea edi, [ebp - 0x800]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401a10
push esi
mov ecx, 7
mov esi, 0x4aa2c4
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [ebp - 0x800]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
pop esi
mov edi, dword [ebp + 8]
lea edx, [ebp - 0x800]
push edx
push str._spl_es_recovery_safety
call fcn.004020e0
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x401a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4c41fc]
mov edx, dword [eax + 0xc]
push esi
push edi
mov ecx, 0x4c41fc
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.004019e0
mov edi, dword [ebp - 0x10]
push 0
push 0x82
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401b6e
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 8]
push ecx
push 0x10
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401b38
cmp dword [ebp + 8], 0x10
jne 0x401b38
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401b01
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401b24
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401b55
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x401b85
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401b91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x401bb0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e658
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4c41fc]
mov edx, dword [eax + 0xc]
push esi
mov ecx, 0x4c41fc
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.004019e0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
lea eax, [esi - 0x10]
mov dword [ebp - 4], ecx
lea edx, [eax + 0xc]
je 0x401c2d
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401c1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401c40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x401c60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4c41fc]
mov edx, dword [eax + 0xc]
push esi
push edi
mov ecx, 0x4c41fc
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.004019e0
mov edi, dword [ebp - 0x10]
push 0
push 0x82
push 3
push 0
push 0
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401d6e
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 8]
push ecx
push 0x10
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401d38
cmp dword [ebp + 8], 0x10
jne 0x401d38
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401d01
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d24
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x401d55
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x401d85
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x401db0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x4c41fc]
mov edx, dword [eax + 0xc]
push ebx
push esi
mov ecx, 0x4c41fc
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
call fcn.004019e0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea eax, [esi - 0x10]
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401e22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x402300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402318
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40234a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x402346
cmp esi, eax
jae 0x40234a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402338
cmp esi, eax
jb 0x402350
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x402550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4025a5
mov edx, dword [ebp + 8]
push 0x10
push edx
push 3
push eax
mov eax, dword [ebp - 4]
push str.FailsafeApp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4025ad
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4025c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40261a
mov edx, dword [ebp - 4]
push str.FailsafeApp
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x402610
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x402720
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40277f
push 4
lea edx, [ebp - 8]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push str.PLCPRN
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x402786
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
cmp dword [eax - 4], 1
jle 0x4027a2
mov eax, dword [eax - 0xc]
push eax
push esi
call fcn.00401ff0
mov esi, dword [esi]
push str.PLCPPWRGUID
push SysReAllocString
mov edx, str.SoftwareProcessLasso
call fcn.00426830
cmp edi, 0xffffffff
je 0x4027ec
cmp ebx, 0xffffffff
je 0x4027ec
push edi
push str.PLACR
push SysReAllocString
mov edx, str.SoftwareProcessLasso
call fcn.004266e0
push ebx
push str.PLDCR
push SysReAllocString
mov edx, str.SoftwareProcessLasso
call fcn.004266e0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402800
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40285b
mov edx, dword [ebp - 4]
push str.PLCPRN
push edx
call ebx
test eax, eax
je 0x402855
mov eax, dword [ebp - 4]
push eax
jmp 0x402859
mov ecx, dword [ebp - 4]
push ecx
call edi
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
call esi
test eax, eax
jne 0x40289b
mov ecx, dword [ebp - 4]
push str.PLCPPWRGUID
push ecx
call ebx
test eax, eax
je 0x402895
mov edx, dword [ebp - 4]
push edx
jmp 0x402899
mov eax, dword [ebp - 4]
push eax
call edi
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
call esi
test eax, eax
jne 0x4028db
mov eax, dword [ebp - 4]
push str.PLACR
push eax
call ebx
test eax, eax
je 0x4028d5
mov ecx, dword [ebp - 4]
push ecx
jmp 0x4028d9
mov edx, dword [ebp - 4]
push edx
call edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x102
push 0
push 0
push 0
push str.SoftwareProcessLasso
push SysReAllocString
call esi
test eax, eax
jne 0x402922
mov edx, dword [ebp - 4]
push str.PLDCR
push edx
call ebx
test eax, eax
je 0x40291c
mov eax, dword [ebp - 4]
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a16f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x830
push ebx
push esi
push edi
lea ebx, [ebp - 0x38]
call fcn.00426c10
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push SysReAllocString
mov edi, str.PLCPRN
mov esi, str.SoftwareProcessLasso
mov dword [ebp - 0x1c], ebx
call fcn.00426750
test al, al
jne 0x4029e5
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x4c7d8c]
cmp eax, ebx
je 0x402994
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
push 0x101
push ebx
push str.SoftwareProcessLasso
xor ecx, ecx
push SysReAllocString
mov word [ebp - 0x838], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402af1
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x838]
push ecx
lea edx, [ebp - 0x18]
push edx
push ebx
push str.PLCPPWRGUID
push eax
mov dword [ebp - 0x14], 0x7fe
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402a50
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402af1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x838], bx
jne 0x402a83
call fcn.00402800
lea esi, [ebp - 0x38]
call fcn.00426e10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push SysReAllocString
mov edi, str.PLACR
mov esi, str.SoftwareProcessLasso
call fcn.00426750
test al, al
je 0x402af1
lea ecx, [ebp - 0x14]
push ecx
push SysReAllocString
mov edi, str.PLDCR
call fcn.00426750
test al, al
je 0x402af1
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x838]
call fcn.00402ba0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00427ba0
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x10]
call fcn.00427c70
lea eax, [ebp - 0x10]
call fcn.00401ea0
call fcn.00402800
lea esi, [ebp - 0x38]
call fcn.00426e10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404280
Capabilities:
Hash data using fnv

Disassembly:
push esi
push edi
mov edi, dword [ebx + 0x10]
mov eax, 0xcccccccd
mul edi
shr edx, 3
xor ecx, ecx
inc edx
mov esi, 0x811c9dc5
test edi, edi
je 0x4042be
jmp 0x4042a0
cmp dword [ebx + 0x14], 0x10
jb 0x4042aa
mov eax, dword [ebx]
jmp 0x4042ac
mov eax, ebx
movsx eax, byte [eax + ecx]
imul esi, esi, 0x1000193
add ecx, edx
xor esi, eax
cmp ecx, edi
jb 0x4042a0
pop edi
mov eax, esi
pop esi
ret

Function at 0x4044f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 1
mov edi, eax
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404531
push edi
push str.Error_opening__s
call fcn.004261a0
add esp, 8
or eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
test eax, eax
jne 0x40456b
push edi
push str.No_file_size__s
call fcn.004261a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ebx, [eax + 2]
push ebx
call fcn.0047125f
add esp, 4
push ebx
mov edi, eax
push 0
push edi
call fcn.00479dd0
mov ecx, dword [ebp - 8]
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edi
push edx
call fcn.004045c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x404793
push esi
push str.ERROR:_Could_not_load__s
call fcn.004261a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
push 0xa
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4047c4
mov eax, dword [ebp + 0xc]
push eax
push edi
push str.ERROR:_Could_not_find_resource__s_from__s
call fcn.004261a0
add esp, 0xc
lea eax, [esi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x4047f3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ecx
push edx
push str.ERROR:_Zero_size_resource__s_from__s
call fcn.004261a0
add esp, 0xc
lea eax, [edi - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404829
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Error_0x_x_Could_not_load_resource__s_from__s
call fcn.004261a0
add esp, 0x10
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40485a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push edx
push eax
push str.ERROR:_Could_not_lock_resource__s_from__s
call fcn.004261a0
add esp, 0xc
mov eax, 0xfffffffb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edi + 4]
push eax
call fcn.0047125f
mov esi, eax
add esp, 4
lea eax, [edi + 4]
push eax
push 0
push esi
call fcn.00479dd0
mov ecx, dword [ebp - 4]
add esp, 0xc
push edi
push ecx
push esi
call fcn.00476580
mov edx, dword [ebp + 0x10]
add esp, 0xc
push edi
push edx
push str.Loaded_resource__s_of_size__u
call fcn.004261a0
mov eax, dword [ebp + 8]
add esp, 0xc
push esi
push eax
call fcn.004045c0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49f7e8
push eax
mov eax, 0x1008
mov dword fs:[0], esp
call fcn.004929f0
mov eax, dword [0x4c41fc]
mov edx, dword [eax + 0xc]
push ebx
mov ebx, ecx
push edi
mov ecx, 0x4c41fc
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
mov edi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
je 0x407d6d
cmp dword [eax + 0xc], 0
lea edx, [eax + 0xc]
jge 0x407d49
cmp dword [ecx - 8], 0
jge 0x407d39
push 0x80070057
call fcn.004018d0
mov dword [ecx - 0xc], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
jmp 0x407d6d
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407d5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
add eax, 0x10
mov dword [ebx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
push str._s._s
lea edi, [ebp - 0x10]
call fcn.004020e0
add esp, 0xc
lea ecx, [ebp + 0xc]
push ecx
push 0x101
xor eax, eax
push eax
push str.Local_SettingsSoftwareMicrosoftWindowsShellMuiCache
push SysReAllocString
mov word [ebp - 0x1014], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x407de7
lea edx, [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push edi
push edx
mov dword [ebp + 8], 0x800
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x407e28
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push str.No_MUI_cache_entry_for__s
call fcn.004261a0
add esp, 8
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407e14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x1014]
push edx
push str.Success__Result_is__s
call fcn.004261a0
mov eax, dword [ebx]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x407df5
lea eax, [ebp - 0x1014]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407e57
lea ecx, [ebp - 0x1014]
sub eax, edx
push ecx
sar eax, 1
push ebx
mov ebx, eax
call fcn.00402e20
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407e98
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8