joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42db00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
push edi
push 0x104
push 0
push eax
mov edi, edx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x124], ebx
call fcn.004ab0f0
mov eax, dword [ebp + 0x10]
push eax
push 0
push ebx
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x11c], eax
call fcn.004ab0f0
add esp, 0x18
test edi, edi
je 0x42dd4d
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x42db84
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esi, ecx
je 0x42dba0
cmp byte [edi + esi], 0x5c
je 0x42dbd6
sub esi, 1
jne 0x42db95
lea eax, [ebp - 0x110]
push eax
push 0x2001d
push 0
push str.SOFTWARE
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42dc96
mov dword [ebp - 0x110], 0
jmp 0x42dd29
cmp esi, 0x104
jae 0x42dd4d
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42dbe7
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x42dc0c
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42dc00
sub ecx, edx
inc ecx
jmp 0x42dc11
mov ecx, 0x104
push ecx
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004aab70
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42dc27
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x42dc4c
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42dc40
sub ecx, edx
inc ecx
jmp 0x42dc51
mov ecx, 0x104
lea eax, [ebp - 0x10c]
mov byte [ebp + ecx - 0x109], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], 0
push eax
push dword [ebp - 0x114]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42dccf
mov dword [ebp - 0x10c], 0
jmp 0x42dd1c
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 7
push 0
push 0
push 0
push str.Akeo_ConsultingRufus
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x42dccf
mov dword [ebp - 0x10c], 0
jmp 0x42dd1c
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x124]
lea eax, [ebp - 0x118]
push eax
push 0
lea eax, [edi + esi]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x42dd12
test eax, eax
jne 0x42dd1c
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp + 8]
jne 0x42dd1c
cmp dword [ebp - 0x11c], 0
jbe 0x42dd1c
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x42dd29
push eax
call ebx
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x42dd36
push ecx
call ebx
mov eax, dword [ebp - 0x120]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
Function at 0x42dd60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
mov edi, edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
test edi, edi
jne 0x42dd95
push 0x8a
push str.D:_a_rufus_rufus_src_registry.h
push str.key_name___NULL
call fcn.004dfbbc
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x5c
push edi
call fcn.004aa320
add esp, 8
test eax, eax
je 0x42ddbb
push 0x91
push str.D:_a_rufus_rufus_src_registry.h
push str.strchr_key_name_____NULL
call fcn.004dfbbc
add esp, 0xc
push 0x5c
push edi
call fcn.004aa320
add esp, 8
test eax, eax
jne 0x42dd8d
lea eax, [ebp - 4]
push eax
push 0x2001d
push 0
push 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42ddeb
mov dword [ebp - 4], esi
jmp 0x42de3c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 7
push 0
push 0
push 0
push str.SOFTWAREAkeo_ConsultingRufus
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x42de14
mov dword [ebp - 8], esi
jmp 0x42de2e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb esi, esi
inc esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x42de3c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x42de4a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432110
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ecx
push 0x80
push 3
sub esp, 8
mov edx, 0x80000000
mov esi, ecx
xor bl, bl
call fcn.0042cc40
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
jne 0x432157
call fcn.0044b6b0
push eax
push esi
push str.FindArch:_Could_not_open_file__s:__s
call fcn.0044b0b0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
jne 0x43218c
call fcn.0044b6b0
push eax
push str.FindArch:_Could_not_create_file_mapping:__s
call fcn.0044b0b0
add esp, 8
jmp 0x432276
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x4321b9
call fcn.0044b6b0
push eax
push str.FindArch:_Could_not_get_mapped_view_address:__s
call fcn.0044b0b0
add esp, 8
jmp 0x432268
mov eax, 0x5a4d
cmp word [esi], ax
je 0x4321d5
push str.FindArch:_DOS_header_not_found
call fcn.0044b0b0
add esp, 4
jmp 0x432261
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
je 0x4321f0
push str.FindArch:_NT_header_not_found
call fcn.0044b0b0
add esp, 4
jmp 0x432261
movzx eax, word [eax + esi + 4]
cmp eax, 0x5032
ja 0x43222e
je 0x43222a
cmp eax, 0x200
ja 0x43221f
je 0x43221b
sub eax, 0x14c
je 0x432217
sub eax, 0x74
jne 0x432261
mov bl, 3
jmp 0x432261
mov bl, 1
jmp 0x432261
mov bl, 5
jmp 0x432261
cmp eax, 0xebc
jne 0x432261
mov bl, 9
jmp 0x432261
mov bl, 6
jmp 0x432261
cmp eax, 0x8664
ja 0x432251
je 0x43224d
cmp eax, 0x5064
je 0x432249
cmp eax, 0x5128
jne 0x432261
mov bl, 8
jmp 0x432261
mov bl, 7
jmp 0x432261
mov bl, 2
jmp 0x432261
cmp eax, 0xaa64
movzx ebx, bl
mov ecx, 4
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x432276
push edi
call esi
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x432281
push eax
call esi
cmp bl, 0xa
jb 0x43229d
push 0x4e3
push str.D:_a_rufus_rufus_src_rufus.c
push str.ret___ARCH_MAX
call fcn.004dfbbc
add esp, 0xc
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ac40
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x5a29d0]
push edi
push 0xa
push 0x1f5
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x43ac84
call fcn.0044b6b0
push eax
push str.rufus.com
push str.Could_not_locate_resource__s:__s
call fcn.0044b0b0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x43acb3
call fcn.0044b6b0
push eax
push str.rufus.com
push str.Could_not_load_resource__s:__s
call fcn.0044b0b0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x43ac7b
push 0x536cc0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push str.rufus.com
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ad1c
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x43ad1c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1c
push 0xa
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x43ae61
mov dword [esi], 1
mov dword [esi + 8], 4
movsx cx, byte [str.rufus.com]
mov dword [esi + 0x1c], 1
mov dword [esi + 0x24], 4
push 0x1c
mov word [esi + 6], cx
movsx eax, byte [0x53526d]
mov word [esi + 0x22], ax
mov dword [esi + 0x38], 1
mov dword [esi + 0x40], 4
movsx eax, byte [0x53526e]
mov word [esi + 0x3e], ax
mov dword [esi + 0x54], 1
mov dword [esi + 0x5c], 4
movsx eax, byte [0x53526f]
mov word [esi + 0x5a], ax
mov dword [esi + 0x70], 1
mov dword [esi + 0x78], 4
movsx eax, byte [0x535270]
mov word [esi + 0x76], ax
mov dword [esi + 0x8c], 1
mov dword [esi + 0x94], 4
movsx eax, byte [0x535271]
mov word [esi + 0x92], ax
mov dword [esi + 0xa8], 1
mov dword [esi + 0xb0], 4
movsx eax, byte [0x535272]
mov word [esi + 0xae], ax
mov dword [esi + 0xc4], 1
mov dword [esi + 0xcc], 4
movsx eax, byte [0x535273]
mov word [esi + 0xca], ax
mov dword [esi + 0xe0], 1
mov dword [esi + 0xe8], 4
movsx eax, byte [0x535274]
mov word [esi + 0xe6], ax
mov eax, 0xd
push esi
push 0xa
mov dword [esi + 0xfc], 1
mov word [esi + 0x100], ax
call dword [sym.imp.USER32.dll_SendInput]
push esi
call fcn.004d1211
add esp, 4
test edi, edi
je 0x43ae70
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f6a0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x100
push 0
push esi
call fcn.004ab0f0
add esp, 0xc
mov dword [esi + 0x80], 0x6a09e667
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xbb67ae85
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0x3c6ef372
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0xa54ff53a
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0x510e527f
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0x9b05688c
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0x1f83d9ab
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0x5be0cd19
mov dword [esi + 0xbc], 0
pop esi
pop ebp
ret
Function at 0x444f20
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xffffffc0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1178
call fcn.004a99b0
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
push 0x7f
mov dword [ebp - 0x114c], eax
xor esi, esi
lea eax, [ebp - 0x113f]
mov byte [ebp - 0x1140], 0
mov edi, edx
push esi
push eax
mov dword [ebp - 0x1144], edi
call fcn.004ab0f0
add esp, 0xc
lea eax, [ebp - 0x10c0]
push 0x80
push esi
push eax
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0x1148], esi
test edi, edi
je 0x44514d
cmp dword [ebp - 0x114c], esi
je 0x44514d
cmp byte [edi], 0
jne 0x444fbc
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
jmp 0x44500e
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp edi, 1
jle 0x44500c
push 2
push edi
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x44500c
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 0x1144]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x44500e
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1144], eax
test esi, esi
je 0x445048
push esi
call fcn.004d1211
mov eax, dword [ebp - 0x1144]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0xffffffff
jne 0x445086
call fcn.0044b6b0
push eax
push str.Could_not_open_file:__s
call fcn.0044b0b0
add esp, 8
mov dword [0x55a318], 0xc003006e
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x1140]
push eax
call fcn.0043f6a0
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
nop dword [eax + eax]
mov eax, dword [0x55a318]
test eax, eax
jns 0x4450b3
cmp ax, 0x4c7
je 0x445140
push 0
lea eax, [ebp - 0x1148]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push edi
call esi
test eax, eax
je 0x445123
mov eax, dword [ebp - 0x1148]
test eax, eax
je 0x4450f2
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1140]
push eax
call fcn.00444760
add esp, 0xc
jmp 0x4450a0
lea eax, [ebp - 0x1140]
push eax
call fcn.00444b20
mov eax, dword [ebp - 0x114c]
add esp, 4
movups xmm0, xmmword [ebp - 0x1140]
mov esi, 1
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x1130]
movups xmmword [eax + 0x10], xmm0
jmp 0x445142
mov dword [0x55a318], 0xc003001e
call fcn.0044b6b0
push eax
push str.__Read_error:__s
call fcn.0044b0b0
add esp, 8
xor esi, esi
test edi, edi
je 0x44514d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004a8b60
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4474e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
push edi
push 0x104
push 0
push eax
mov edi, edx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x124], ebx
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x11c], 4
mov dword [ebx], 0
test edi, edi
je 0x44772a
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x447562
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esi, ecx
je 0x44757e
cmp byte [edi + esi], 0x5c
je 0x4475b4
sub esi, 1
jne 0x447573
lea eax, [ebp - 0x110]
push eax
push 0x2001d
push 0
push str.SOFTWARE
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x447676
mov dword [ebp - 0x110], 0
jmp 0x447706
cmp esi, 0x104
jae 0x44772a
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4475c5
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x4475ec
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4475e0
sub ecx, edx
inc ecx
jmp 0x4475f1
mov ecx, 0x104
push ecx
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004aab70
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447607
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x44762c
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447620
sub ecx, edx
inc ecx
jmp 0x447631
mov ecx, 0x104
lea eax, [ebp - 0x10c]
mov byte [ebp + ecx - 0x109], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], 0
push eax
push dword [ebp - 0x114]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4476af
mov dword [ebp - 0x10c], 0
jmp 0x4476f9
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 7
push 0
push 0
push 0
push str.Akeo_ConsultingRufus
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4476af
mov dword [ebp - 0x10c], 0
jmp 0x4476f9
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x124]
lea eax, [ebp - 0x118]
push eax
push 0
lea eax, [edi + esi]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x4476ef
test eax, eax
jne 0x4476f9
cmp dword [ebp - 0x118], 4
jne 0x4476f9
cmp dword [ebp - 0x11c], eax
jbe 0x4476f9
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x447706
push eax
call ebx
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x447713
push ecx
call ebx
mov eax, dword [ebp - 0x120]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
Function at 0x449730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x449769
call fcn.0044b6b0
push eax
push dword [ebp + 0xc]
push str.Could_not_locate_resource__s:__s
call fcn.0044b0b0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x449799
call fcn.0044b6b0
push eax
push dword [ebp + 0xc]
push str.Could_not_load_resource__s:__s
call fcn.0044b0b0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp + 0x14], 0
mov esi, eax
mov ebx, dword [ebp + 0x10]
je 0x449821
mov eax, dword [ebx]
test eax, eax
jne 0x4497b6
mov dword [ebx], esi
mov eax, esi
push 1
push eax
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
jne 0x4497e0
push dword [ebp + 0xc]
push str.Could_not_allocate_resource__s
call fcn.0044b0b0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
cmp esi, eax
cmovb eax, esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call fcn.004aab70
mov ecx, dword [ebx]
add esp, 0xc
cmp esi, ecx
jbe 0x44982a
mov eax, esi
sub eax, ecx
push eax
push dword [ebp + 0xc]
push str.WARNING:_Resource__s_was_truncated_by__d_bytes_
call fcn.0044b0b0
add esp, 0xc
mov dword [ebx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [ebx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a440
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov edx, dword [0x55a750]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x59d304
mov dword [ebp - 0x10], str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [ebp - 0xc], str.NoDriveTypeAutorun
mov dword [ebp - 8], eax
mov dword [ebp + 0x10], 0
push esi
push edi
test edx, edx
je 0x44a4aa
push 1
mov ecx, str.DisableLGP
xor edi, edi
call fcn.004249f0
mov esi, eax
add esp, 4
test esi, esi
je 0x44a4a4
push edi
push edi
push esi
call fcn.004e439f
add esp, 0xc
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
xor ecx, ecx
test edi, edi
jmp 0x44a4c7
push ecx
lea eax, [ebp - 4]
mov edx, str.DisableLGP
push eax
push ecx
mov ecx, 0x80000001
call fcn.004474e0
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 4], ecx
setne cl
test ecx, ecx
je 0x44a535
mov ecx, dword [0x55b210]
mov eax, 0xffc
sub eax, ecx
push str.LPG_handling_disabled__per_settings
push eax
lea eax, [ecx + 0x5a0980]
push eax
call fcn.004050d0
mov ecx, 0x5a0980
mov byte [0x5a197b], 0
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44a500
sub ecx, edx
mov word [ecx + 0x5a0980], 0xa0d
add ecx, 2
mov dword [0x55b210], ecx
cmp ecx, 0x1000
jae 0x44a659
mov byte [ecx + 0x5a0980], al
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0x449eb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x44a5b8
mov ecx, dword [0x55b210]
mov eax, 0xffc
sub eax, ecx
push str.SetLGP:_Unable_to_start_thread
push eax
lea eax, [ecx + 0x5a0980]
push eax
call fcn.004050d0
mov ecx, 0x5a0980
mov byte [0x5a197b], 0
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44a583
sub ecx, edx
mov word [ecx + 0x5a0980], 0xa0d
add ecx, 2
mov dword [0x55b210], ecx
cmp ecx, 0x1000
jae 0x44a659
mov byte [ecx + 0x5a0980], al
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x44a641
mov ecx, dword [0x55b210]
mov eax, 0xffc
sub eax, ecx
push str.SetLGP:_Killing_stuck_thread_
push eax
lea eax, [ecx + 0x5a0980]
push eax
call fcn.004050d0
mov ecx, 0x5a0980
mov byte [0x5a197b], 0
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44a600
sub ecx, edx
mov word [ecx + 0x5a0980], 0xa0d
add ecx, 2
mov dword [0x55b210], ecx
cmp ecx, 0x1000
jae 0x44a659
push 0
push esi
mov byte [ecx + 0x5a0980], al
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
neg eax
pop edi
sbb eax, eax
and eax, dword [ebp + 0x10]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004a8c90
int3
Function at 0x44b0b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp + 0xc]
mov edi, 0xffd
push eax
push ecx
push dword [ebp + 8]
mov edx, edi
push ecx
mov ecx, 0x59d9f8
call fcn.0041da10
mov esi, eax
add esp, 0x10
test esi, esi
cmovs esi, edi
add esi, 0x59d9f8
cmp esi, 0x59d9f8
jbe 0x44b10d
nop dword [eax + eax]
movzx eax, byte [esi - 1]
push eax
call fcn.004e16f0
add esp, 4
test eax, eax
je 0x44b10d
dec esi
mov byte [esi], 0
cmp esi, 0x59d9f8
ja 0x44b0f0
mov word [esi], 0xa0d
mov byte [esi + 2], 0
cmp byte [0x59d9f8], 0
jne 0x44b12f
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x44b184
push 0
push 0
push 0xffffffffffffffff
push 0x59d9f8
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, 1
jle 0x44b182
push 2
push esi
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x44b182
push esi
push edi
push 0xffffffffffffffff
push 0x59d9f8
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x44b184
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x55a7ec]
test eax, eax
je 0x44b1e2
cmp eax, 0xffffffff
je 0x44b1e2
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x7ffffffe
push 0x7ffffffe
push 0xb1
push eax
call esi
push edi
push 0
push 0xc2
push dword [0x55a7ec]
call esi
push 0
push 0
push 0xba
push dword [0x55a7ec]
call esi
push eax
push 0
push 0xb6
push dword [0x55a7ec]
call esi
push edi
call fcn.004d1211
add esp, 4
pop edi
pop esi
pop ecx
pop ebp
ret

Function at 0x44b1f0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x44b1fc
xor edi, edi
jmp 0x44b260
cmp byte [esi], 0
jne 0x44b211
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x44b260
push ebx
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x44b25d
push 2
push ebx
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x44b25d
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x44b25f
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x55a7ec]
test eax, eax
je 0x44b2be
cmp eax, 0xffffffff
je 0x44b2be
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x7ffffffe
push 0x7ffffffe
push 0xb1
push eax
call esi
push edi
push 0
push 0xc2
push dword [0x55a7ec]
call esi
push 0
push 0
push 0xba
push dword [0x55a7ec]
call esi
push eax
push 0
push 0xb6
push dword [0x55a7ec]
call esi
push edi
call fcn.004d1211
add esp, 4
pop edi
pop esi
ret