joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b710
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xbc]
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
xor eax, eax
push fcn.0043b6c0
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0xa8], pe_nt_image_headers32
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0xb0]
call fcn.00403d10
push 0
push 1
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x80]
xor cx, cx
mov edx, 0x7f
call fcn.004095c0
mov esi, dword [ebp - 0xb4]
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x5685c0]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x5685c0]
mov eax, 0x58ed90
call fcn.004237d0
mov edx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb0]
mov ecx, esi
call fcn.00408cd0
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xa4]
mov eax, 0x5978a8
call fcn.00427bf0
lea ecx, [ebp - 0x84]
lea edx, [ebp - 0xa4]
mov eax, 0x5978a8
call fcn.00427b70
mov dword [ebp - 0xbc], 5
lea eax, [ebp - 0xbc]
push eax
mov edx, 0x599058
lea eax, [ebp - 0xac]
mov ecx, 1
call fcn.0040ce50
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x568c20]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568c20]
mov eax, 0x58ed90
call fcn.004237d0
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
call fcn.00408bd0
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x568c30]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568c30]
mov eax, 0x58ed90
call fcn.004237d0
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
add eax, 4
call fcn.00408bd0
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x568c40]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568c40]
mov eax, 0x58ed90
call fcn.004237d0
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
add eax, 8
call fcn.00408bd0
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x568c50]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568c50]
mov eax, 0x58ed90
call fcn.004237d0
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
add eax, 0xc
call fcn.00408bd0
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x568c60]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568c60]
mov eax, 0x58ed90
call fcn.004237d0
mov edx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xac]
add eax, 0x10
call fcn.00408bd0
lea eax, [ebp - 0x88]
xor edx, edx
call fcn.00408bd0
mov eax, dword [ebp - 0xac]
call fcn.0040cd20
mov esi, eax
mov edi, 0xffffffff
lea esi, [esi]
nop
add edi, 1
mov eax, dword [ebp - 0xac]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x84]
call fcn.00409790
test eax, eax
jne 0x43b998
mov eax, dword [0x56c0f0]
or eax, ebx
mov ebx, eax
jmp 0x43b99c
cmp esi, edi
ja 0x43b970
test ebx, ebx
sete bl
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043b6c0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c150
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x234]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
xor eax, eax
push fcn.0043c0f0
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ebx, eax
test ebx, ebx
jbe 0x43c3d8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x208]
mov cl, 1
mov edx, 0x103
call fcn.0040b720
mov eax, dword [ebp - 0x220]
mov ecx, ebx
xor edx, edx
call fcn.0040bb60
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x210]
call fcn.0040b160
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
call fcn.0040a6a0
mov ecx, dword [ebp - 0x214]
mov eax, esi
mov edx, 0x598f7c
call fcn.0043c040
mov esi, eax
test esi, esi
jbe 0x43c32c
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x224], eax
lea edx, [esi + 2]
cmp word [eax + edx*2 - 2], 0x78
jne 0x43c283
mov eax, dword [ebp - 0x224]
lea edx, [esi + 3]
cmp word [eax + edx*2 - 2], 0x65
je 0x43c32c
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x568870]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568870]
mov eax, 0x58ed90
call fcn.004237d0
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0040a5d0
mov ebx, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 0x214]
xor edx, edx
call fcn.0040aa80
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x214]
mov ecx, ebx
call fcn.0040a720
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x220]
call fcn.0040b190
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
call fcn.0040b190
mov eax, dword [ebp - 0x21c]
mov edx, ebx
call fcn.00463ea0
mov eax, dword [edi]
add eax, 0x24
mov edx, dword [ebp - 0x214]
call fcn.0040a6a0
lea eax, [ebp - 0x20c]
push eax
push 0
mov eax, edi
push eax
mov eax, 0x4352d0
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, 1
mov eax, 0x597dc8
call fcn.0042bff0
mov ebx, eax
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x568bf0]
call fcn.0040cd20
mov ecx, eax
mov edx, dword [0x568bf0]
mov eax, 0x58ed90
call fcn.004237d0
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x218]
call fcn.0040a5d0
push 1
push 0
mov edx, dword [edi]
mov eax, ebx
call fcn.0042c0f0
push eax
mov eax, dword [ebp - 0x214]
test eax, eax
jne 0x43c3a9
mov eax, 0x5e92f0
push eax
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x43c3b9
mov eax, 0x5e92f0
push eax
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jbe 0x43c3d8
mov byte [ebp - 0x234], 1
mov eax, dword [edi]
push dword [eax + 0x34]
call sub.kernel32.dll_CloseHandle
nop
mov bl, byte [ebp - 0x234]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043c0f0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c7b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x218]
push ebx
push esi
push edi
mov dword [ebp - 0x20c], 0
xor eax, eax
push fcn.0043c7a0
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x5ea720], 0
push 0x208
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov dword [ebp - 0x210], eax
mov word [ebp + eax*2 - 0x208], 0
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov eax, ebp
call fcn.0043ca70
mov ecx, dword [ebp - 0x210]
shl ecx, 1
mov eax, dword [0x5ea710]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
call fcn.004037c0
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
call fcn.004049b0
mov dword [ebp - 0x214], eax
mov edx, eax
lea eax, [ebp - 0x20c]
call fcn.0040a9a0
mov ecx, dword [ebp - 0x214]
shl ecx, 1
mov eax, ebx
mov edx, dword [ebp - 0x20c]
call fcn.004037c0
mov ebx, 1
jmp 0x43ca2f
add ebx, 1
cmp dword [ebp - 0x214], ebx
jl 0x43c892
mov eax, dword [ebp - 0x20c]
cmp word [eax + ebx*2 - 2], 0x20
jbe 0x43c878
cmp dword [ebp - 0x214], ebx
jl 0x43ca3b
mov esi, esi
mov byte [ebp - 0x218], 0
mov edi, ebx
mov dword [ebp - 0x210], 0
jmp 0x43c92b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x43c920
sub ax, 0x20
jbe 0x43c8dc
sub ax, 2
je 0x43c8f0
jmp 0x43c920
mov al, byte [ebp - 0x218]
test al, al
je 0x43c933
add dword [ebp - 0x210], 1
jmp 0x43c928
cmp dword [ebp - 0x214], ebx
jle 0x43c91b
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 1]
cmp word [edx + eax*2 - 2], 0x22
je 0x43c91b
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x43c928
add ebx, 1
jmp 0x43c928
add dword [ebp - 0x210], 1
nop
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x43c8b8
cmp dword [0x5ea720], 0
jle 0x43ca28
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x5ea720]
mov eax, ebp
call fcn.0043ca70
mov byte [ebp - 0x218], 0
mov ebx, edi
mov esi, 1
jmp 0x43ca1b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x43c9f4
sub ax, 0x20
jbe 0x43c990
sub ax, 2
je 0x43c9c4
jmp 0x43c9f4
mov al, byte [ebp - 0x218]
test al, al
je 0x43ca27
mov edx, dword [0x5ea710]
mov eax, dword [0x5ea720]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
jmp 0x43ca18
cmp dword [ebp - 0x214], ebx
jle 0x43c9ef
mov eax, dword [ebp - 0x20c]
lea edx, [ebx + 1]
cmp word [eax + edx*2 - 2], 0x22
je 0x43c9ef
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x43ca18
add ebx, 1
jmp 0x43ca18
mov eax, dword [0x5ea710]
mov edx, dword [0x5ea720]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
lea esi, [esi]
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x43c968
nop
add dword [0x5ea720], 1
cmp dword [ebp - 0x214], ebx
jge 0x43c87b
sub dword [0x5ea720], 1
cmp word [0x5e8030], 0xfde9
jne 0x43ca54
call fcn.0043c6b0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043c7a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ce70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov bl, cl
push 4
lea ecx, [ebp - 8]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 2
jle 0x43cefa
lea edx, [eax - 2]
test edx, edx
jl 0x43cf0f
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov si, word [ebp + ecx*2 - 8]
mov di, word [ebp + ecx*2 - 8]
cmp di, 0x20
jb 0x43cf0f
sub di, 0x20
je 0x43cef4
sub di, 0x80
je 0x43cef4
sub di, 0x1f62
jb 0x43cf0f
sub di, 1
jbe 0x43cef4
sub di, 6
je 0x43cef4
sub di, 0x26
jne 0x43cf0f
mov esi, esi
jmp 0x43cef4
cmp edx, ecx
jg 0x43cea8
jmp 0x43cf0f
cmp eax, 2
jne 0x43cf05
mov si, word [ebp - 8]
jmp 0x43cf0f
mov al, bl
call fcn.0040b5a0
mov si, ax
mov ax, si
sub ax, 0x7f
jbe 0x43cf88
sub ax, 0x21
je 0x43cf98
sub ax, 0x17
je 0x43cf9c
sub ax, 0x222
je 0x43cfa0
sub ax, 0x392
je 0x43cfa4
sub ax, 1
je 0x43cfa8
sub ax, 0x1996
je 0x43cfac
sub ax, 1
je 0x43cfb0
sub ax, 6
je 0x43cfb4
sub ax, 0xb
je 0x43cfbc
sub ax, 0x1b
je 0x43cfb8
sub ax, 0x367
je 0x43cfc0
jmp 0x43cfc4
mov ax, si
call fcn.0040b640
jmp 0x43cfc8
mov al, 0x20
jmp 0x43cfc8
mov al, 0x2e
jmp 0x43cfc8
mov al, 0x27
jmp 0x43cfc8
mov al, 0x2c
jmp 0x43cfc8
mov al, 0x27
jmp 0x43cfc8
mov al, 0x20
jmp 0x43cfc8
mov al, 0x20
jmp 0x43cfc8
mov al, 0x20
jmp 0x43cfc8
mov al, 0x20
jmp 0x43cfc8
mov al, 0x2d
jmp 0x43cfc8
mov al, 0x27
jmp 0x43cfc8
mov al, bl
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448670
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448790
mov al, byte [ebp - 0x110]
test al, al
je 0x448759
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fe0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409450
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x4486ea
mov ecx, ebp
call fcn.004146d0
jmp 0x448790
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x448759
mov ecx, ebp
call fcn.004146d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448854
mov al, byte [ebp - 0x110]
test al, al
je 0x44881d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fe0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409450
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x4487ae
mov ecx, ebp
call fcn.004146d0
jmp 0x448854
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x44881d
mov ecx, ebp
call fcn.004146d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00448010
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4486ea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448670
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448790
mov al, byte [ebp - 0x110]
test al, al
je 0x448759
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fe0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409450
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x4486ea
mov ecx, ebp
call fcn.004146d0
jmp 0x448790
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x448759
mov ecx, ebp
call fcn.004146d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448854
mov al, byte [ebp - 0x110]
test al, al
je 0x44881d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fe0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409450
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x4487ae
mov ecx, ebp
call fcn.004146d0
jmp 0x448854
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x44881d
mov ecx, ebp
call fcn.004146d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00448010
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448759
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448670
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448790
mov al, byte [ebp - 0x110]
test al, al
je 0x448759
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fe0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409450
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x4486ea
mov ecx, ebp
call fcn.004146d0
jmp 0x448790
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x448759
mov ecx, ebp
call fcn.004146d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448854
mov al, byte [ebp - 0x110]
test al, al
je 0x44881d
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fe0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409450
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x4487ae
mov ecx, ebp
call fcn.004146d0
jmp 0x448854
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x59af40
call fcn.00462630
mov edx, 0x44881d
mov ecx, ebp
call fcn.004146d0
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00448010
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44ba00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, 0x59bc48
call fcn.0040d4d0
test al, al
je 0x44bae6
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.0044bb00
xor eax, eax
push fcn.0044b9f0
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0xc4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x18]
mov byte [edx + 0x18], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1a]
mov byte [edx + 0x1a], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1b]
mov byte [edx + 0x1b], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x1c]
mov byte [edx + 0x1c], al
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 8]
add eax, 0x30
call fcn.00408bd0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
call fcn.0044ac30
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0044a780
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0xb0]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0044b9f0
jmp 0x44baf1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0044e650
mov esp, ebp
pop ebp
ret

Function at 0x44d980
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x44d99c
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4585c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc20]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc10], 0
xor eax, eax
push fcn.004585b0
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc10]
call fcn.00408bd0
lea eax, [ebp - 0xc10]
call fcn.00403d50
lea eax, [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x458620
mov eax, 0x5e92f0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc18], eax
cmp eax, 0xc00
jbe 0x4586ca
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc0c]
call fcn.0040ff60
xor eax, eax
push fcn.004585a0
push ebp
push 0x414810
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0xc0c]
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x45867c
mov eax, 0x5e92f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4586b8
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x5a093c
push eax
push dword [ebp - 0xc0c]
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4586b8
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004585a0
jmp 0x458728
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xc18]
push dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc10]
test eax, eax
jne 0x4586ec
mov eax, 0x5e92f0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x458728
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
mov eax, 0x5a093c
push eax
lea eax, [ebp - 0xc08]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x458728
mov eax, dword [ebp - 0xc20]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004585b0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret