joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ee0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560321
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x5c], edi
push 0x18
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x54], edi
call fcn.004b92c6
add esp, 4
cmp eax, edi
je 0x421093
mov dword [ebp - 0x58], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x58]
mov dword [eax + 4], eax
push 0x2c
xor eax, eax
mov ebx, 7
push str.SELECT_value_FROM_meta_WHERE_key__version
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
call fcn.00403510
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x4c]
lea edx, [ebp - 0x2c]
push edx
add ecx, 0xa0
mov byte [ebp - 4], 2
call fcn.00491a90
cmp dword [ebp - 0x54], edi
jne 0x420ff8
push 1
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
push 0x585f00
mov ecx, esi
mov word [esi], ax
call fcn.00403510
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x5c], 1
jb 0x420fb1
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004b8946
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.0041f500
mov eax, dword [ebp - 0x58]
push eax
call fcn.004b8946
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x58]
mov eax, dword [ecx]
push 5
add eax, 8
xor edx, edx
push 0x581ec8
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], dx
call fcn.00403510
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 4
call fcn.0041dd30
push 0xffffffffffffffff
xor ecx, ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
push edi
mov word [esi], cx
push eax
mov ecx, esi
call fcn.00403410
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x5c], 1
jb 0x42105d
mov edx, dword [ebp - 0x48]
push edx
call fcn.004b8946
add esp, 4
xor eax, eax
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], ax
jb 0x42107b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004b8946
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
mov dword [ebp - 4], 5
jmp 0x420fc4
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], edi
call fcn.004b912a
push 0x5a0f40
lea edx, [ebp - 0x70]
push edx
mov dword [ebp - 0x70], vtable.std::bad_alloc.0
call fcn.004b9346
int3
Function at 0x423b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560b68
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push 0xa
mov dword [ebp - 0x3c], ecx
xor ebx, ebx
xor eax, eax
push str.NoRecovery
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
call fcn.00403510
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push 0x2001f
push reloc.WS2_32.dll_accept
push esi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00404ef0
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], 0xffffffff
jae 0x423bde
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x50]
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
push edi
mov dword [ebp - 0x44], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x423c05
mov esi, eax
jmp 0x423c12
mov esi, dword [ebp - 0x40]
sub esi, 4
neg esi
sbb esi, esi
and esi, 0xd
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
neg esi
sbb esi, esi
not esi
and esi, dword [ebp - 0x34]
cmp edi, ebx
je 0x423c2d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], 8
mov byte [ebp - 4], bl
jb 0x423c42
mov edx, dword [ebp - 0x30]
push edx
call fcn.004b8946
add esp, 4
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
cmp esi, ebx
jne 0x423c6c
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
push edi
mov ecx, esi
call fcn.0041c290
push edi
mov ecx, esi
call fcn.00421b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret 4

Function at 0x4249d0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.00404eb0
cmp dword [eax + 0x14], 8
jb 0x4249f4
mov eax, dword [eax]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0xc], 8
jb 0x424a11
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004b8946
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret
Function at 0x42b600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push 2
push 0
push ebx
mov dword [ebp - 4], ecx
call fcn.004bb7bb
add esp, 0xc
test eax, eax
je 0x42b628
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push ebx
call fcn.004bb6cc
mov esi, eax
add esp, 4
test esi, esi
jns 0x42b645
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
jne 0x42b651
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push esi
call fcn.0046a4eb
mov edi, eax
add esp, 4
test edi, edi
jne 0x42b66d
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push ebx
call fcn.004bb7bb
push ebx
push esi
push 1
push edi
call fcn.004bb51b
add esp, 0x1c
cmp eax, esi
je 0x42b69f
push edi
call fcn.004b9392
add esp, 4
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.0042b450
push edi
mov esi, eax
call fcn.004b9392
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4321e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, edx
je 0x432210
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x4321f1
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
pop ebp
ret
Function at 0x43b070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5632a3
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x114]
call fcn.00405080
xor ebx, ebx
push str.Temp
mov dword [ebp - 4], ebx
call fcn.004bbd4e
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], cx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00404090
push str.ie.reg
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00404090
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebp - 0x48]
call fcn.00404eb0
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x43b101
mov eax, dword [eax]
push 0x588aa0
push eax
call fcn.004bb273
add esp, 8
mov esi, eax
cmp dword [ebp - 0x50], edi
jb 0x43b122
mov eax, dword [ebp - 0x64]
push eax
call fcn.004b8946
add esp, 4
xor ecx, ecx
push esi
push str.REGEDIT4_n_n
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], cx
call fcn.004bbc0f
push esi
push str.__HKEY_USERS_
call fcn.004bbc0f
add esp, 0x10
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0x114]
call fcn.00413070
cmp dword [eax + 0x14], edi
jb 0x43b161
mov eax, dword [eax]
push esi
push eax
call fcn.004bbc0f
add esp, 8
cmp dword [ebp - 0x6c], edi
jb 0x43b17c
mov eax, dword [ebp - 0x80]
push eax
call fcn.004b8946
add esp, 4
push esi
push str.SoftwareMicrosoftInternet_ExplorerUser_Preferences__n
call fcn.004bbc0f
push esi
call fcn.004baa9e
add esp, 0xc
mov esi, 7
xor ecx, ecx
push esi
mov word [ebp - 0x2c], cx
push str.import
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
call fcn.00403510
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040f430
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x43b1cd
lea eax, [ebp - 0x2c]
push ebx
push ebx
push eax
push str.reg.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x18], edi
jb 0x43b1f2
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004b8946
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], edi
jb 0x43b20f
mov edx, dword [ebp - 0x48]
push edx
call fcn.004b8946
add esp, 4
xor eax, eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0xffffffff
call fcn.00403350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret
Function at 0x4446b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push 2
push 0
push ebx
mov dword [ebp - 4], ecx
call fcn.004bb7bb
add esp, 0xc
test eax, eax
je 0x4446d8
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push ebx
call fcn.004bb6cc
mov esi, eax
add esp, 4
test esi, esi
jns 0x4446f5
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
jne 0x444701
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push esi
call fcn.0046a4eb
mov edi, eax
add esp, 4
test edi, edi
jne 0x44471d
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push ebx
call fcn.004bb7bb
push ebx
push esi
push 1
push edi
call fcn.004bb51b
add esp, 0x1c
cmp eax, esi
je 0x44474f
push edi
call fcn.004b9392
add esp, 4
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00444560
push edi
mov esi, eax
call fcn.004b9392
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x448840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564d68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
push eax
call fcn.004486a0
push 6
lea esi, [edi + 0x20]
push 0x589520
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [edi], vtable.mailru::delay_patching.0
call fcn.0040f540
cmp dword [esi + 0x14], 8
mov dword [ebp + 8], 0xffffffff
jb 0x4488a2
mov esi, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [edi + 0x3c]
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push ecx
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4488ca
mov esi, eax
jmp 0x4488d7
mov esi, dword [ebp - 0x14]
sub esi, 4
neg esi
sbb esi, esi
and esi, 0xd
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
neg esi
sbb esi, esi
not esi
and esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push esi
call fcn.00405770
mov edx, dword [ebp - 0x18]
mov dword [edi + 0x48], edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x448910
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564da8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x18], 8
lea esi, [ecx + 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [esi + 0x10]
jb 0x44894e
mov eax, dword [esi]
jmp 0x448950
mov eax, esi
push ecx
push eax
mov eax, dword [0x5bb6e4]
push eax
xor ebx, ebx
push ebx
mov ecx, 0x5bb6d4
call fcn.00407840
test eax, eax
je 0x448a35
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00419130
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
lea edx, [ebp - 0x11]
push edx
push ecx
mov dword [ebp - 4], 2
call fcn.00414040
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
add esp, 0xc
push edi
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0041dea0
add esp, 0x2c
cmp edi, dword [eax]
mov eax, dword [ebp - 0x2c]
setne byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x4489dc
push eax
call fcn.004b8946
add esp, 4
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x4489ec
push eax
call fcn.004b8946
add esp, 4
cmp byte [ebp - 0x11], bl
je 0x448a35
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x48]
xor edx, edx
cmp eax, eax
jne 0x448a01
cmp ebx, edx
je 0x448a0b
push str.bitset_N__overflow
call fcn.00469bb1
cmp dword [esi + 0x14], 8
jb 0x448a13
mov esi, dword [esi]
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 0x3c]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
jmp 0x448a37
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret
Function at 0x448a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564de8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00419130
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [esi + 4]
push eax
lea edx, [ebp - 0x11]
push edx
push ecx
mov dword [ebp - 4], 2
call fcn.00414040
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
add esp, 0xc
push edi
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041dea0
add esp, 0x2c
cmp edi, dword [eax]
mov eax, dword [ebp - 0x28]
setne byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x448b01
push eax
call fcn.004b8946
add esp, 4
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x448b11
push eax
call fcn.004b8946
add esp, 4
cmp byte [ebp - 0x11], bl
je 0x448b83
mov ecx, dword [ebp + 8]
cmp ecx, 3
jb 0x448b28
push str.invalid_bitset_N__position
call fcn.00469b64
mov edx, ecx
shr edx, 5
lea eax, [esi + edx*4 + 0x48]
and ecx, 0x1f
mov edx, 1
shl edx, cl
xor ecx, ecx
or dword [eax], edx
mov eax, dword [esi + 0x48]
xor edx, edx
cmp eax, eax
jne 0x448b4c
cmp edx, ecx
je 0x448b56
push str.bitset_N__overflow
call fcn.00469bb1
cmp dword [esi + 0x34], 8
lea ecx, [esi + 0x20]
jb 0x448b61
mov ecx, dword [ecx]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push ecx
mov ecx, dword [esi + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
jmp 0x448b85
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret 4

Function at 0x448bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x448beb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x448c22
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x448c1e
jmp 0x448c10
cmp esi, eax
jae 0x448c22
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x448c10
cmp esi, eax
jb 0x448c29
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x449430
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x5c1a54], esi
jne 0x44946f
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x449465
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x5c1a50], eax
mov dword [0x5c1a54], 1
mov eax, dword [0x5c1a50]
mov edi, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44948b
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4494c5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x4494ba
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov eax, dword [ebp + 8]
jns 0x4494a9
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
jmp 0x4494ae
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
call edx
test eax, eax
je 0x4494c5
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push edi
push eax
call ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x44a0d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564e40
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi + 4]
jne 0x44a13a
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
push ecx
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x44a13a
mov ecx, dword [esi + 0x28]
push 9
push 0x581cac
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x44a150
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564e60
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xd
je 0x44a17f
cmp eax, 0x20
jne 0x44a199
mov eax, dword [ecx + 0x28]
push 9
push 0x581cac
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44f990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565336
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x418], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x44fa0d
call fcn.0044caf0
mov edi, eax
jmp 0x44faf2
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x44fa26
call fcn.0044caf0
jmp 0x44fae9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x44fa44
call fcn.0044caf0
jmp 0x44fae9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x41c], edi
cmp eax, edi
jae 0x44fa65
mov edi, 0x8007000e
jmp 0x44faeb
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0044d930
mov dword [ebp - 4], 1
jmp 0x44fa9d
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x44faae
mov edi, 0x8007000e
jmp 0x44faeb
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x44fac7
call fcn.0044caf0
jmp 0x44fae9
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x418]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.0044ef50
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x44fb10
lea ecx, [ebp - 0x418]
call fcn.00449580
jmp 0x44fb10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret 0x10