joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00439b80
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov edx, dword [eax + 0x3c]
mov ecx, dword [0x5f1c30]
mov eax, esi
call fcn.00438790
test al, al
jne 0x439c0c
mov byte [ebp - 0x20], 0
jmp 0x439d33
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x10], 0
jne 0x439d04
lea eax, [ebp - 8]
push eax
mov eax, dword [0x5f1900]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1900]
mov eax, 0x617d90
call fcn.00423b60
call sub.kernel32.dll_GetCommandLineW
lea ecx, [ebp - 4]
xor dx, dx
call fcn.0040b430
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.00409a90
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5f1c20]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1c20]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 1
call fcn.00409a90
add ebx, eax
test ebx, ebx
jbe 0x439c9d
mov eax, dword [esi + 0xc]
mov byte [eax + 5], 1
jmp 0x439d04
xor bl, bl
mov byte [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
or eax, eax
je 0x439cf4
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x14
push dword [ebp - 0xc]
call sub.advapi32.dll_GetTokenInformation
or eax, eax
setne al
mov byte [ebp - 0x24], al
test al, al
je 0x439cf4
mov eax, dword [esi + 0xc]
cmp dword [ebp - 0x10], 0
seta byte [eax + 5]
lea esi, [esi]
cmp dword [ebp - 0xc], 0
jbe 0x439d04
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov esi, esi
mov ebx, 0x620960
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [0x5f1c40]
mov edx, dword [0x5f1c30]
mov eax, esi
call fcn.004388c0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi]
add eax, 0x3c
mov ecx, ebx
call fcn.0040d040
mov byte [ebp - 0x20], 1
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00439b80
mov al, byte [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a600
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xb0]
push ebx
push esi
push edi
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
xor eax, eax
push fcn.0043a5b0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0x9c], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0xa4]
call fcn.00403d00
push 0
push 1
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x80]
xor cx, cx
mov edx, 0x7f
call fcn.004095b0
mov esi, dword [ebp - 0xa8]
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1690]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1690]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xa4]
mov ecx, esi
call fcn.00408cc0
mov edx, dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
mov eax, 0x620a30
call fcn.004282c0
lea ecx, [ebp - 0x84]
lea edx, [ebp - 0x98]
mov eax, 0x620a30
call fcn.00428240
mov dword [ebp - 0xb0], 5
lea eax, [ebp - 0xb0]
push eax
mov edx, 0x622318
lea eax, [ebp - 0xa0]
mov ecx, 1
call fcn.0040d060
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1cf0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cf0]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d00]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d00]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 4
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d10]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d10]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 8
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d20]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d20]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0xc
call fcn.00408bc0
lea eax, [ebp - 0xac]
push eax
mov eax, dword [0x5f1d30]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1d30]
mov eax, 0x617d90
call fcn.00423b60
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa0]
add eax, 0x10
call fcn.00408bc0
lea eax, [ebp - 0x88]
xor edx, edx
call fcn.00408bc0
mov eax, dword [ebp - 0xa0]
call fcn.0040cf30
mov esi, eax
mov edi, 0xffffffff
lea esi, [esi]
nop
add edi, 1
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 0x84]
call fcn.00409780
test eax, eax
jne 0x43a888
mov eax, dword [0x5f5150]
or eax, ebx
mov ebx, eax
jmp 0x43a88c
cmp esi, edi
ja 0x43a860
test ebx, ebx
sete bl
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043a5b0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b030
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x234]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
xor eax, eax
push fcn.0043afd0
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x234], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ebx, eax
test ebx, ebx
jbe 0x43b2b8
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x208]
mov cl, 1
mov edx, 0x103
call fcn.0040b930
mov eax, dword [ebp - 0x220]
mov ecx, ebx
xor edx, edx
call fcn.0040bd70
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x210]
call fcn.0040b370
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x214]
call fcn.0040a690
mov ecx, dword [ebp - 0x214]
mov eax, esi
mov edx, 0x622130
call fcn.0043af20
mov esi, eax
test esi, esi
jbe 0x43b20c
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x224], eax
lea edx, [esi + 2]
cmp word [eax + edx*2 - 2], 0x78
jne 0x43b163
mov eax, dword [ebp - 0x224]
lea edx, [esi + 3]
cmp word [eax + edx*2 - 2], 0x65
je 0x43b20c
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1940]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1940]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0040a5c0
mov ebx, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 0x214]
xor edx, edx
call fcn.0040ab80
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x214]
mov ecx, ebx
call fcn.0040a710
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x220]
call fcn.0040b3a0
mov ebx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
call fcn.0040b3a0
mov eax, dword [ebp - 0x21c]
mov edx, ebx
call fcn.004638d0
mov eax, dword [edi]
add eax, 0x24
mov edx, dword [ebp - 0x214]
call fcn.0040a690
lea eax, [ebp - 0x20c]
push eax
push 0
mov eax, edi
push eax
mov eax, 0x433280
push eax
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, 1
mov eax, 0x620f70
call fcn.0042a7e0
mov ebx, eax
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x5f1cc0]
call fcn.0040cf30
mov ecx, eax
mov edx, dword [0x5f1cc0]
mov eax, 0x617d90
call fcn.00423b60
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x218]
call fcn.0040a5c0
push 1
push 0
mov edx, dword [edi]
mov eax, ebx
call fcn.0042a8e0
push eax
mov eax, dword [ebp - 0x214]
test eax, eax
jne 0x43b289
mov eax, 0x6722f0
push eax
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x43b299
mov eax, 0x6722f0
push eax
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jbe 0x43b2b8
mov byte [ebp - 0x234], 1
mov eax, dword [edi]
push dword [eax + 0x34]
call sub.kernel32.dll_CloseHandle
nop
mov bl, byte [ebp - 0x234]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043afd0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b6f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
mov dword [ebp - 0x104], eax
mov esi, edx
mov eax, ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
push dword [ebx]
call fcn.0043b680
mov dword [ebp - 4], eax
mov eax, dword [ebx]
movzx eax, word [eax + 6]
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x100]
push eax
mov edx, 0x6226b8
mov eax, 0x673610
mov ecx, 1
call fcn.0040d060
mov dword [ebp - 0x108], ebx
mov eax, ebx
mov edx, dword [eax]
movzx eax, word [edx + 6]
sub eax, 1
mov dword [ebp - 0x10c], eax
test eax, eax
jl 0x43b868
mov ebx, 0xffffffff
lea esi, [esi]
nop
add ebx, 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x43b7de
mov edi, dword [ebp - 0xc4]
test edi, edi
jle 0x43b7d0
push 0x40
push 0x1000
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 4]
call fcn.0043b550
push eax
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x673610]
mov dword [eax + ebx*8], esi
mov eax, dword [0x673610]
mov dword [eax + ebx*8 + 4], edi
mov edx, dword [ebp - 4]
mov eax, esi
xor ecx, ecx
mov dword [edx + 8], eax
push edi
push esi
call fcn.00446a00
push 0
push 0x28
lea eax, [ebp - 4]
call fcn.0043b510
jmp 0x43b85b
push 0x40
push 0x1000
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
xor eax, eax
push eax
push edx
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 4]
call fcn.0043b550
push eax
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x673610]
mov dword [eax + ebx*8], esi
mov edx, dword [0x673610]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x14]
xor eax, eax
push eax
push edx
mov eax, dword [ebp - 0x104]
call fcn.0043b550
push eax
push esi
call fcn.004469e0
mov edx, dword [ebp - 4]
mov eax, esi
xor ecx, ecx
mov dword [edx + 8], eax
push 0
push 0x28
lea eax, [ebp - 4]
call fcn.0043b510
cmp dword [ebp - 0x10c], ebx
jg 0x43b770
nop
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bcd0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ecx
and edx, 0x4000000
je 0x43bce8
or eax, 0x200
nop
mov edx, ecx
and edx, 0x20000000
je 0x43bd26
mov edx, ecx
and edx, 0x40000000
je 0x43bd10
mov edx, ecx
and edx, 0x80000000
je 0x43bd0b
or eax, 0x40
jmp 0x43bd54
or eax, 0x20
jmp 0x43bd54
mov edx, ecx
and edx, 0x80000000
je 0x43bd21
or eax, 0x80
jmp 0x43bd54
or eax, 0x10
jmp 0x43bd54
mov edx, ecx
and edx, 0x40000000
je 0x43bd44
mov edx, ecx
and edx, 0x80000000
je 0x43bd3f
or eax, 4
jmp 0x43bd54
or eax, 2
jmp 0x43bd54
and ecx, 0x80000000
je 0x43bd51
or eax, 8
jmp 0x43bd54
or eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x43c690
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x218]
push ebx
push esi
push edi
mov dword [ebp - 0x20c], 0
xor eax, eax
push fcn.0043c680
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x673740], 0
push 0x208
lea eax, [ebp - 0x208]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov dword [ebp - 0x210], eax
mov word [ebp + eax*2 - 0x208], 0
mov ecx, dword [ebp - 0x210]
xor edx, edx
mov eax, ebp
call fcn.0043c950
mov ecx, dword [ebp - 0x210]
shl ecx, 1
mov eax, dword [0x673730]
mov edx, dword [eax]
lea eax, [ebp - 0x208]
call fcn.004037b0
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
call fcn.004049a0
mov dword [ebp - 0x214], eax
mov edx, eax
lea eax, [ebp - 0x20c]
call fcn.0040aaa0
mov ecx, dword [ebp - 0x214]
shl ecx, 1
mov eax, ebx
mov edx, dword [ebp - 0x20c]
call fcn.004037b0
mov ebx, 1
jmp 0x43c90f
add ebx, 1
cmp dword [ebp - 0x214], ebx
jl 0x43c772
mov eax, dword [ebp - 0x20c]
cmp word [eax + ebx*2 - 2], 0x20
jbe 0x43c758
cmp dword [ebp - 0x214], ebx
jl 0x43c91b
mov esi, esi
mov byte [ebp - 0x218], 0
mov edi, ebx
mov dword [ebp - 0x210], 0
jmp 0x43c80b
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x43c800
sub ax, 0x20
jbe 0x43c7bc
sub ax, 2
je 0x43c7d0
jmp 0x43c800
mov al, byte [ebp - 0x218]
test al, al
je 0x43c813
add dword [ebp - 0x210], 1
jmp 0x43c808
cmp dword [ebp - 0x214], ebx
jle 0x43c7fb
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 1]
cmp word [edx + eax*2 - 2], 0x22
je 0x43c7fb
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x43c808
add ebx, 1
jmp 0x43c808
add dword [ebp - 0x210], 1
nop
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x43c798
cmp dword [0x673740], 0
jle 0x43c908
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x673740]
mov eax, ebp
call fcn.0043c950
mov byte [ebp - 0x218], 0
mov ebx, edi
mov esi, 1
jmp 0x43c8fb
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
cmp ax, 1
jb 0x43c8d4
sub ax, 0x20
jbe 0x43c870
sub ax, 2
je 0x43c8a4
jmp 0x43c8d4
mov al, byte [ebp - 0x218]
test al, al
je 0x43c907
mov edx, dword [0x673730]
mov eax, dword [0x673740]
mov edx, dword [edx + eax*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
jmp 0x43c8f8
cmp dword [ebp - 0x214], ebx
jle 0x43c8cf
mov eax, dword [ebp - 0x20c]
lea edx, [ebx + 1]
cmp word [eax + edx*2 - 2], 0x22
je 0x43c8cf
mov al, byte [ebp - 0x218]
test al, al
sete byte [ebp - 0x218]
jmp 0x43c8f8
add ebx, 1
jmp 0x43c8f8
mov eax, dword [0x673730]
mov edx, dword [0x673740]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp - 0x20c]
mov ax, word [eax + ebx*2 - 2]
mov word [edx + esi*2 - 2], ax
add esi, 1
lea esi, [esi]
add ebx, 1
cmp dword [ebp - 0x214], ebx
jge 0x43c848
nop
add dword [0x673740], 1
cmp dword [ebp - 0x214], ebx
jge 0x43c75b
sub dword [0x673740], 1
cmp word [0x671030], 0xfde9
jne 0x43c934
call fcn.0043c590
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0043c680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cd50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov bl, cl
push 4
lea ecx, [ebp - 8]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
cmp eax, 2
jle 0x43cdda
lea edx, [eax - 2]
test edx, edx
jl 0x43cdef
mov ecx, 0xffffffff
lea esi, [esi]
add ecx, 1
mov si, word [ebp + ecx*2 - 8]
mov di, word [ebp + ecx*2 - 8]
cmp di, 0x20
jb 0x43cdef
sub di, 0x20
je 0x43cdd4
sub di, 0x80
je 0x43cdd4
sub di, 0x1f62
jb 0x43cdef
sub di, 1
jbe 0x43cdd4
sub di, 6
je 0x43cdd4
sub di, 0x26
jne 0x43cdef
mov esi, esi
jmp 0x43cdd4
cmp edx, ecx
jg 0x43cd88
jmp 0x43cdef
cmp eax, 2
jne 0x43cde5
mov si, word [ebp - 8]
jmp 0x43cdef
mov al, bl
call fcn.0040b7b0
mov si, ax
mov ax, si
sub ax, 0x7f
jbe 0x43ce68
sub ax, 0x21
je 0x43ce78
sub ax, 0x17
je 0x43ce7c
sub ax, 0x222
je 0x43ce80
sub ax, 0x392
je 0x43ce84
sub ax, 1
je 0x43ce88
sub ax, 0x1996
je 0x43ce8c
sub ax, 1
je 0x43ce90
sub ax, 6
je 0x43ce94
sub ax, 0xb
je 0x43ce9c
sub ax, 0x1b
je 0x43ce98
sub ax, 0x367
je 0x43cea0
jmp 0x43cea4
mov ax, si
call fcn.0040b850
jmp 0x43cea8
mov al, 0x20
jmp 0x43cea8
mov al, 0x2e
jmp 0x43cea8
mov al, 0x27
jmp 0x43cea8
mov al, 0x2c
jmp 0x43cea8
mov al, 0x27
jmp 0x43cea8
mov al, 0x20
jmp 0x43cea8
mov al, 0x20
jmp 0x43cea8
mov al, 0x20
jmp 0x43cea8
mov al, 0x20
jmp 0x43cea8
mov al, 0x2d
jmp 0x43cea8
mov al, 0x27
jmp 0x43cea8
mov al, bl
mov esi, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448550
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448670
mov al, byte [ebp - 0x110]
test al, al
je 0x448639
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x4485ca
mov ecx, ebp
call fcn.00414920
jmp 0x448670
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x448639
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448734
mov al, byte [ebp - 0x110]
test al, al
je 0x4486fd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x44868e
mov ecx, ebp
call fcn.00414920
jmp 0x448734
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x4486fd
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00447ef0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4485ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448550
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448670
mov al, byte [ebp - 0x110]
test al, al
je 0x448639
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x4485ca
mov ecx, ebp
call fcn.00414920
jmp 0x448670
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x448639
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448734
mov al, byte [ebp - 0x110]
test al, al
je 0x4486fd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x44868e
mov ecx, ebp
call fcn.00414920
jmp 0x448734
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x4486fd
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00447ef0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448639
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00448550
push ebp
push 0x414a60
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x448670
mov al, byte [ebp - 0x110]
test al, al
je 0x448639
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x4485ca
mov ecx, ebp
call fcn.00414920
jmp 0x448670
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x448639
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x448734
mov al, byte [ebp - 0x110]
test al, al
je 0x4486fd
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.00404fd0
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.00409440
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.0040a260
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x44868e
mov ecx, ebp
call fcn.00414920
jmp 0x448734
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x6244b0
call fcn.00462020
mov edx, 0x4486fd
mov ecx, ebp
call fcn.00414920
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.00447ef0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00448550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8