joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4100d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x84]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
add esi, 4
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xa
push 4
push dword [ebp + 0xc]
push dword [esi]
call fcn.00456aaf
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4101a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftSpeech_OneCoreSettingsOnlineSpeechPrivacy
push SysReAllocStringLen
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [esi + 8]
push eax
push 4
push 0
push str.HasAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4101f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push 0x4702f0
push SysReAllocStringLen
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
push esi
push 4
push 0
push str.SecureProtocols
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410240
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocStringLen
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [esi + 8]
push eax
push 4
push 0
push str.EnableTextPrediction
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410290
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager
push SysReAllocStringLen
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [esi + 0x18]
push eax
push 4
push 0
push str.RotatingLockScreenEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4102e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager
push SysReAllocStringLen
mov esi, ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.RotatingLockScreenEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.RotatingLockScreenEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x410362
mov dword [esi + 0x1e8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocStringLen
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.EnableDesktopModeAutoInvoke
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4103f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.CANDIDATE
push 0xae
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x4104ce
test esi, esi
je 0x4104ba
test edi, edi
je 0x410475
cmp esi, 0x800
ja 0x410475
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x4104ba
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x41049c
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x4104af
cmp esi, 0x800
jbe 0x4104c0
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410588
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x410572
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41056b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x410564
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444943
jne 0x410564
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46e7c4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3
Function at 0x410590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.ECMINVERSION
push 0xa5
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x410672
test esi, esi
je 0x41065e
test ebx, ebx
je 0x410619
cmp esi, 0x800
ja 0x410619
push esi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x41065e
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test ebx, ebx
jne 0x410640
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x410653
cmp esi, 0x800
jbe 0x410664
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410764
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x410751
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x410748
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x41073d
push ebx
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea ecx, [ebp - 0x804]
mov eax, 0x494d4345
cmp eax, dword [ecx]
jne 0x41073d
mov eax, 0x5245564e
cmp eax, dword [ecx + 4]
jne 0x41073d
mov eax, 0x3a
cmp al, byte [ecx + 8]
jne 0x41073d
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x7fb]
push 0x46e7c4
push eax
call fcn.00403220
lea ecx, [ebp - 0x7fb]
add esp, 0xc
mov eax, ecx
sub edi, eax
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x410730
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebx
jmp 0x41074e
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004465ed
mov esp, ebp
pop ebp
ret 4
call fcn.00446a02
int3
Function at 0x410770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.ENVIRONMENT
push 0xaa
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41084e
test esi, esi
je 0x41083a
test edi, edi
je 0x4107f5
cmp esi, 0x800
ja 0x4107f5
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x41083a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x41081c
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x41082f
cmp esi, 0x800
jbe 0x410840
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410908
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4108f2
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4108eb
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x4108e4
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444945
jne 0x4108e4
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46e7c4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3
Function at 0x410910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.INSTITUTION
push 0xad
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x4109ee
test esi, esi
je 0x4109da
test edi, edi
je 0x410995
cmp esi, 0x800
ja 0x410995
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x4109da
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x4109bc
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x4109cf
cmp esi, 0x800
jbe 0x4109e0
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410aa8
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x410a92
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x410a8b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x410a84
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444949
jne 0x410a84
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46e7c4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3
Function at 0x410ab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.INTERVAL
push 0x85
push 0
mov dword [ebp - 0x1854], 0x1d4c0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x410b8e
test esi, esi
je 0x410b7a
test edi, edi
je 0x410b35
cmp esi, 0x800
ja 0x410b35
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x410b7a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x410b5c
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x410b6f
cmp esi, 0x800
jbe 0x410b80
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410c48
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x410c32
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x410c2b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x410c24
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a544e49
jne 0x410c24
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46e7c4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3
Function at 0x410cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x410e0f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1050], eax
inc eax
push eax
push 0x2040
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x410d75
lea ecx, [eax + 1]
test edi, edi
jne 0x410d42
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x410d6a
cmp ecx, eax
jb 0x410d53
push eax
push ebx
push edi
call fcn.00448cc0
add esp, 0xc
jmp 0x410d6f
push ecx
push 0
push edi
call fcn.00449240
add esp, 0xc
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov eax, dword [ebp - 0x1050]
mov byte [edi + eax], 0
lea eax, [ebp - 0x104c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1050]
push eax
push edi
call fcn.00404370
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x14
mov dword [ebp - 0x1054], eax
push edi
call ebx
mov eax, dword [ebp - 0x1054]
test eax, eax
je 0x410e0f
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1050]
push ecx
push eax
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x410e06
mov eax, dword [ebp - 0x1050]
test eax, eax
je 0x410e03
shr eax, 1
inc eax
push eax
push 0x2040
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push dword [ebp - 0x1050]
mov esi, eax
mov ecx, 0x553538
push esi
call fcn.00443300
push edi
call ebx
mov eax, dword [ebp - 0x1054]
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004465ed
mov esp, ebp
pop ebp
ret 8
Function at 0x410e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1858
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.OPTIONS
push 0x88
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x1858], xmm0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x410f0f
test esi, esi
je 0x410efb
test edi, edi
je 0x410eb6
cmp esi, 0x800
ja 0x410eb6
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x410efb
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x410edd
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x410ef0
cmp esi, 0x800
jbe 0x410f01
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x410fda
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x410fbe
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x410fb7
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x410fb0
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea ecx, [ebp - 0x804]
mov eax, 0x5354504f
cmp eax, dword [ecx]
jne 0x410fb0
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x410fb0
lea eax, [ebp - 0x1858]
push eax
lea eax, [ebp - 0x7ff]
push str._lld
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1858]
xor ecx, ebp
mov edx, dword [ebp - 0x1854]
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3
Function at 0x410fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.PROGRAM
push 0xab
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x4110be
test esi, esi
je 0x4110aa
test edi, edi
je 0x411065
cmp esi, 0x800
ja 0x411065
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x4110aa
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x41108c
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x41109f
cmp esi, 0x800
jbe 0x4110b0
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x411178
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x411162
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41115b
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x411154
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea eax, [ebp - 0x804]
cmp dword [eax], 0x3a444950
jne 0x411154
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x800]
push 0x46e7c4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3
Function at 0x411180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.00446880
mov eax, dword [0x4cc5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x470a10
push 0xa2
push 0
mov dword [ebp - 0x1854], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41125e
test esi, esi
je 0x41124a
test edi, edi
je 0x411205
cmp esi, 0x800
ja 0x411205
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.00448cc0
add esp, 0xc
jmp 0x41124a
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00449240
add esp, 0xc
test edi, edi
jne 0x41122c
call fcn.0045131a
mov dword [eax], 0x16
jmp 0x41123f
cmp esi, 0x800
jbe 0x411250
call fcn.0045131a
mov dword [eax], 0x22
call fcn.00451240
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x411323
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x49a460]
push 0x49a464
call fcn.00404720
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404370
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41130d
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x411306
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x4112ff
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x553538
push eax
call fcn.00443300
lea ecx, [ebp - 0x804]
mov eax, 0x44494552
cmp eax, dword [ecx]
jne 0x4112ff
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x4112ff
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x7ff]
push 0x46e7c4
push eax
call fcn.00403220
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1854]
xor ecx, ebp
pop edi
pop esi
call fcn.004465ed
mov esp, ebp
pop ebp
ret
call fcn.00446a02
int3