joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42161d
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x5779de
call fcn.00550dd0
mov edi, ecx
mov dword [ebp - 0x30], edi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
cmp ebx, esi
jne 0x42163f
xor eax, eax
jmp 0x42179d
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x421666
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x421666
dec dword [edx]
mov ecx, dword [edi + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov byte [edx], bl
jmp 0x42179b
cmp dword [edi + 0x50], 0
jne 0x421673
mov eax, esi
jmp 0x42179d
mov ecx, edi
call fcn.0041f990
xor eax, eax
cmp dword [edi + 0x40], eax
jne 0x421693
push dword [edi + 0x50]
push ebx
call fcn.0041a403
pop ecx
test al, al
pop ecx
cmovne esi, ebx
jmp 0x42166c
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 8
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004045b9
and dword [ebp - 4], 0
lea eax, [edi + 0x48]
mov dword [ebp - 0x40], eax
mov esi, dword [ebp - 0x14]
cmp esi, 0x10
mov esi, dword [edi + 0x40]
lea eax, [ebp - 0x34]
mov edi, dword [esi]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
mov ecx, esi
call dword [edi + 0x1c]
test eax, eax
js 0x42178c
cmp eax, 1
jg 0x42176b
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
cmp esi, 0x10
lea eax, [ebp - 0x28]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x421741
push dword [edi + 0x50]
lea eax, [ebp - 0x28]
push edx
cmp esi, 0x10
cmovae eax, ecx
push 1
push eax
call fcn.00555c11
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x42178c
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [edi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x42178f
test edx, edx
jne 0x4216c1
cmp dword [ebp - 0x18], 0x20
jae 0x42178c
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.004044c4
jmp 0x4216be
cmp eax, 3
jne 0x42178c
mov eax, dword [ebp - 0x30]
push dword [eax + 0x50]
push dword [ebp - 0x2c]
call fcn.0041a403
pop ecx
pop ecx
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
mov ebx, ecx
jmp 0x42178f
or ebx, 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401d18
mov eax, ebx
call fcn.00550d7f
ret 4
Function at 0x426bb4
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xc
mov eax, 0x57ef55
call fcn.00550e06
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xac], edi
je 0x426c75
call fcn.0042711e
test eax, eax
je 0x426c05
lea eax, [ebp - 0x18]
push eax
push 4
push esi
push 0x427f46
push edi
push edi
call fcn.005562ff
add esp, 0x18
mov dword [esi + 0xc8], eax
test eax, eax
je 0x426c75
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x426c75
mov ecx, dword [esi + 0xd0]
test ecx, ecx
je 0x426c75
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push ecx
call dword [eax + 0x18]
mov eax, dword [esi + 0xd0]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x1c]
mov ecx, dword [esi + 0xd0]
mov edx, dword [ecx]
push edi
mov eax, dword [ebp - 0x14]
neg eax
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push edi
push dword [esi + 0x88]
push dword [esi + 0x84]
push edi
push edi
push dword [esi + 0xb0]
push ecx
call dword [edx + 0x20]
test eax, eax
jne 0x426c75
push edi
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
inc eax
jmp 0x426c77
xor eax, eax
call fcn.00550d6b
ret

Function at 0x42749c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x57f063
call fcn.00550e06
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
call fcn.0042e945
mov eax, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x427572
call fcn.0042e945
mov ecx, dword [eax + 0xc]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x427572
call fcn.0042e945
mov ecx, dword [eax + 0xc]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
push eax
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x427513
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x427572
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42755f
test ebx, ebx
je 0x42755f
push dword [ebp + 0xc]
push eax
push ebx
call fcn.0054f7d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0xc]
push edi
mov ecx, dword [ebp - 0x14]
call fcn.00427168
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x427574
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x42750a
xor eax, eax
call fcn.00550d6b
ret 8
Function at 0x428137
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x57f39a
call fcn.00550e06
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 2
call fcn.0042de6a
push eax
lea ecx, [ebp - 0x14]
call fcn.00401429
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call esi
test eax, eax
je 0x4281ee
lea eax, [ebp - 0x1c]
push eax
push 0x20119
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x4281ee
push 0x593270
mov ecx, dword [ebp + 8]
call fcn.004014cd
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 7
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 8
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.004032e4
mov eax, dword [ebp + 8]
jmp 0x428432
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 9
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
call fcn.00403274
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
call esi
mov esi, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 5
jmp 0x428281
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00429501
mov ecx, dword [ebp + 8]
test esi, esi
je 0x4282de
push 0x597830
call fcn.00401485
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0xf
jmp 0x4281d8
lea eax, [ebp - 0x14]
push eax
call fcn.00401452
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x12
jmp 0x4281d8
call fcn.00550d6b
ret
Function at 0x429024
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x2c0
mov eax, 0x57f882
call fcn.00550e3c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
and dword [ebp - 4], 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x429051
xor eax, eax
inc eax
jmp 0x42913d
lea eax, [ebp - 0x2a4]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42908d
cmp eax, 2
jne 0x42907d
push str.Key_not_found._n
call fcn.00556541
pop ecx
jmp 0x429049
push str.Error_opening_key._n
call fcn.00556541
pop ecx
jmp 0x42913b
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [edi + eax*2]
mov dword [ebp - 0x2bc], esi
push 0x5c
pop eax
cmp word [esi - 2], ax
je 0x4290d8
mov word [esi], ax
add esi, 2
mov dword [ebp - 0x2bc], esi
xor eax, eax
mov word [esi], ax
jmp 0x4290d8
lea eax, [ebp - 0x21c]
push eax
push 0x208
push esi
call fcn.00429c11
push edi
push ebx
call fcn.00429024
pop ecx
pop ecx
test eax, eax
je 0x42910d
lea eax, [ebp - 0x2b8]
push eax
xor ecx, ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x21c]
push eax
push ecx
mov dword [ebp - 0x2a8], 0x104
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4290b9
sub esi, 2
mov dword [ebp - 0x2bc], esi
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x429049
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00550d8e
ret
Function at 0x4295fe
Capabilities:
Set registry value

Disassembly:
push 0x2c8
mov eax, 0x57fa95
call fcn.00550e3c
mov dword [ebp - 4], 3
mov byte [ebp - 4], 4
lea ecx, [ebp + 0xc]
call fcn.004224de
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea eax, [ebp + 8]
push eax
call fcn.00401452
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.00429d9b
pop ecx
push eax
call fcn.00428c21
pop ecx
pop ecx
lea eax, [ebp - 0x2b4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea eax, [ebp + 8]
push eax
call fcn.00401452
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
call fcn.00429d9b
pop ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x429715
lea eax, [ebp - 0x2b4]
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea eax, [ebp + 8]
push eax
call fcn.00401452
mov byte [ebp - 4], 7
mov byte [ebp - 4], 4
call fcn.00429d9b
pop ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x429715
mov byte [ebp - 4], 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 9
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0xb
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004032e4
push 0xfffffffffffffff6
pop eax
jmp 0x42994b
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x21c], ebx
xor eax, eax
mov word [ebp - 0x22c], ax
mov byte [ebp - 4], 0xc
mov esi, dword [ebp + 0x14]
cmp word [esi], bx
jne 0x42974a
mov eax, ebx
jmp 0x429751
push esi
call fcn.005506a6
pop ecx
push eax
push esi
lea ecx, [ebp - 0x22c]
call fcn.00406419
lea ecx, [ebp - 0x22c]
cmp dword [ebp - 0x218], 8
cmovae ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x21c]
add eax, eax
push eax
push ecx
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.00429501
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x22c]
call fcn.004062e5
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov dword [ebp - 4], 0x10
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004032e4
mov eax, esi
jmp 0x42994b
call fcn.00550d8e
ret
Function at 0x42b03d
Capabilities:
Get geographical location

Disassembly:
push 0x2b8
mov eax, 0x580132
call fcn.00550e3c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2b4], esi
and dword [ebp - 0x2b0], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov word [ebp - 0x214], ax
push 0x1fc
push eax
lea eax, [ebp - 0x212]
push eax
call fcn.0054fea0
add esp, 0xc
push 0x1fe
lea eax, [ebp - 0x214]
push eax
push 0x59
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 0x29c]
call fcn.00401515
mov byte [ebp - 4], 2
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040332b
lea eax, [ebp - 0x29c]
push eax
mov ecx, esi
call fcn.00401452
mov dword [ebp - 0x2b0], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x29c]
add ecx, 0xfffffff0
call fcn.004032e4
mov eax, esi
jmp 0x42b208
call fcn.00550d8e
ret

Function at 0x42b4ce
Capabilities:
Reference wmi statements

Disassembly:
push 4
mov eax, 0x57f269
call fcn.00550d9d
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
push str.Caption
push 0x592ec4
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
push dword [ebp + 8]
call fcn.0042a910
add esp, 0x14
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
call fcn.00550d6b
ret
Function at 0x430597
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5fdc04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6010e0]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x4305e3
push 0x598128
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x430600
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x6010e0], eax
jmp 0x4305ec
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x430600
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x43066d
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x43061b
xor eax, eax
jmp 0x43066d
lea eax, [ebp - 0x210]
push eax
call fcn.005506a6
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x43064c
push 0x593cbc
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005568cf
add esp, 0xc
test eax, eax
jne 0x430617
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005568cf
add esp, 0xc
test eax, eax
jne 0x430617
lea eax, [ebp - 0x210]
push eax
call fcn.0043532b
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00550d01
leave
ret

Function at 0x430e21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x430e66
call fcn.0042e945
mov ebx, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x430e66
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x430e82
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00445f6d
mov ebx, eax
test edi, edi
je 0x430e80
test esi, esi
je 0x430e80
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x435d30
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58e84c
call fcn.00550d9d
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x435d56
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x435daa
call fcn.0042de6a
push eax
lea ecx, [ebp - 0x10]
call fcn.00401429
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0055672d
push eax
call fcn.0040265e
add esp, 0x14
test edi, edi
je 0x435d9d
push edi
call fcn.005506a6
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004032e4
mov eax, esi
call fcn.00550d6b
ret 8
Function at 0x4428d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x44291a
call fcn.0042e945
mov ebx, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x442917
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x442953
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test edi, edi
je 0x44293c
push dword [ebp + 0x10]
mov edx, dword [eax]
push edi
push dword [ebp + 8]
mov ecx, eax
call dword [edx + 0x20]
mov ebx, eax
test esi, esi
je 0x44293c
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x68]
test ecx, ecx
je 0x442951
mov eax, dword [ecx]
push dword [ebp + 0x10]
call dword [eax + 0xa0]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44765d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebx + 0x78], edi
test edi, 0xffff0000
jne 0x44767f
cmp dword [ebx + 0x74], 0
jne 0x44767f
movzx eax, di
mov dword [ebx + 0x74], eax
call fcn.0042e945
mov esi, dword [eax + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004478ea
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4476b9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0042e945
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4476f0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0044770f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x449fb9
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x581bec
call fcn.00550d9d
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0044a0f3
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.0042de6a
push eax
lea ecx, [ebx + 0x18]
call fcn.00401429
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.0040332b
push dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x44a02f
push eax
push dword [ebx + 8]
call fcn.0044a7f0
push dword [ebx + 0xc]
mov ecx, 0x601384
push eax
call fcn.0044b3f0
mov eax, ebx
call fcn.00550d6b
ret 0x18

Function at 0x44a273
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x44a29c
call fcn.0042e945
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x44a2c9
push esi
push eax
mov ecx, 0x601384
call fcn.0044b3f0
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.0044a7f0
int3
Function at 0x44dae8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5fdc04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x20], eax
mov eax, dword [0x60161c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x44db41
push 0x598128
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44db5e
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x60161c], eax
jmp 0x44db4a
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x44db5e
mov eax, dword [ebp - 0x20]
push ebx
push edi
push eax
push dword [ebp + 8]
call esi
jmp 0x44dc9b
mov eax, dword [ebp - 0x20]
and dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov ebx, ecx
push 7
lea eax, [ebp - 0x14]
and ecx, 0xfc00
and ebx, 0x3ff
push eax
or ecx, ebx
push ecx
call fcn.00571e20
lea eax, [ebp - 0x14]
push eax
call fcn.005506a6
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.005567eb
push 7
lea eax, [ebp - 0x14]
push eax
push ebx
lea edi, [esi + 1]
call fcn.00571e20
lea eax, [ebp - 0x14]
push eax
call fcn.005506a6
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.005567eb
add esp, 0x38
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
mov ebx, ecx
push 7
lea eax, [ebp - 0x14]
and ecx, 0xfc00
and ebx, 0x3ff
push eax
or ecx, ebx
push ecx
call fcn.00571e20
lea eax, [ebp - 0x14]
push eax
call fcn.005506a6
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.005567eb
push 7
lea eax, [ebp - 0x14]
push eax
push ebx
add edi, esi
call fcn.00571e20
lea eax, [ebp - 0x14]
push eax
call fcn.005506a6
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
mov ebx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
lea ecx, [ebx + edi*2]
push ecx
call fcn.005567eb
push 7
lea eax, [ebp - 0x14]
push eax
push 0x800
add edi, esi
call fcn.00571e20
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.005506a6
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
lea ecx, [ebx + edi*2]
push ecx
call fcn.005567eb
lea eax, [edi + esi]
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00550d01
leave
ret