joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440300
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450e63
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x464080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xae4], 0
je 0x4403a1
lea ecx, [ebp - 0x10]
call fcn.004062e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x4fc
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xb64]
push eax
push 0x457330
lea ecx, [ebp - 0x10]
push ecx
call fcn.00407120
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00414010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x440392
push 5
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00414010
push eax
call sym.Install_style.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004063a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4403b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450e8e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x464080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
add eax, 0xa10
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4403f0
jmp 0x44048d
lea ecx, [ebp - 0x10]
call fcn.004062e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0xa10
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xb64]
push eax
push 0x4572fc
lea ecx, [ebp - 0x10]
push ecx
call fcn.00407120
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.00414010
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44047e
lea ecx, [ebp - 0x14]
call fcn.004062e0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
push edx
push 0x457308
lea eax, [ebp - 0x14]
push eax
call fcn.00407120
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00414010
push eax
push str.regedit.exe
call sym.Install_style.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004063a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004063a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4404a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x464080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0xb64
call fcn.00419570
test eax, eax
jle 0x4404d3
jmp 0x4405bc
mov eax, dword [ebp + 8]
add eax, 0x85c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x440565
mov ecx, dword [ebp + 8]
add ecx, 0x85c
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0xb64
call fcn.004063e0
mov ecx, dword [ebp - 0x214]
add ecx, 0xb64
call fcn.00419570
sub eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x214]
add ecx, 0xb64
call fcn.0041bf00
movzx eax, ax
cmp eax, 0x5c
jne 0x44054b
movzx ecx, word [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0xb64
call fcn.0041bd50
mov edx, dword [ebp - 0x214]
add edx, 0xb64
push edx
mov ecx, dword [ebp - 0x214]
call sym.Install_style.exe_private:_void___thiscall_CNsInstaller::ReplaceSysPath_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
jmp 0x4405bc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00421340
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0x456c8c
mov edx, dword [ebp - 0x214]
add edx, 0xb64
push edx
call fcn.00407120
add esp, 0x10
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042047a
mov esp, ebp
pop ebp
ret 4
Function at 0x4405d0
Capabilities:
Get common file path
Get program files directory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x464080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x42c]
call sym.Install_style.exe_public:_bool___thiscall_CNsInstaller::GetSetupInfoEx_struct_tagSetupInfo__
movzx ecx, al
test ecx, ecx
je 0x440615
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x42c]
call sym.Install_style.exe_private:_void___thiscall_CNsInstaller::InitPath_struct_tagSetupInfo__
mov al, 1
jmp 0x440760
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00421340
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x456c7c
lea eax, [ebp - 0x210]
push eax
call fcn.0042cede
add esp, 8
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x440672
xor al, al
jmp 0x440760
lea ecx, [ebp - 0x218]
push ecx
push 0x456c84
push 0x1f41
call sym.Install_style.exe_int___cdecl_NsResGetBuff_int__wchar_t_const___void__
add esp, 0xc
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4406fb
push 0xb00
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00421340
add esp, 0xc
xor eax, eax
mov word [ebp - 0x428], ax
push 0x206
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.00421340
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x428]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0x42c]
add ecx, 0xb64
call fcn.004063e0
xor al, al
jmp 0x440760
push 0
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call fcn.0042e4f4
add esp, 0xc
push 0xb00
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00421340
add esp, 0xc
mov ecx, dword [ebp - 0x214]
push ecx
push 1
push 0xb00
mov edx, dword [ebp + 8]
push edx
call fcn.0042def2
add esp, 0x10
mov eax, dword [ebp - 0x214]
push eax
call fcn.0042ab2a
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x42c]
call sym.Install_style.exe_private:_void___thiscall_CNsInstaller::InitPath_struct_tagSetupInfo__
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042047a
mov esp, ebp
pop ebp
ret 4
Function at 0x441bd0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1584
call fcn.00429800
mov eax, dword [0x464080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1584], ecx
lea eax, [ebp - 0x1580]
push eax
mov ecx, dword [ebp - 0x1584]
call sym.Install_style.exe_public:_bool___thiscall_CNsInstaller::GetCloudInfo_struct_tagCloudInfo__
movzx ecx, al
test ecx, ecx
jne 0x441c26
push 0
push 0xffffffffffffffff
push 0x7e9
mov edx, dword [ebp - 0x1584]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor al, al
jmp 0x441d6a
lea ecx, [ebp - 0x1580]
push ecx
push str.install_cloud
push 0x457360
call sym.Install_style.exe_void___cdecl_DoReport_wchar_t_const___wchar_t_const___wchar_t_const__
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00421340
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx eax, word [ebp + eax*2 - 0x21a]
cmp eax, 0x5c
jne 0x441c9e
push 0x4573a8
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x441cb0
push str.hf_cloud_setup.exe
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0x1584]
mov byte [eax + 0xb58], 0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push sym.Install_style.exe_private:_static_void___stdcall_CNsInstaller::DownNotify_int__wchar_t_const___long_long___int64___long_long___int64___double_
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x14b8]
push eax
call sym.Install_style.exe_public:_static_class_CNsDownload____cdecl_CNsDownload::Instance_void_
mov ecx, eax
call sym.Install_style.exe_public:_int___thiscall_CNsDownload::GetHttpFile_wchar_t_const___wchar_t_const___int__void____stdcall___int__wchar_t_const___long_long___int64___long_long___int64___double__
mov ecx, dword [ebp - 0x1584]
movzx edx, byte [ecx + 0xb58]
test edx, edx
je 0x441d19
push 0
push 0xffffffffffffffff
push 0x7e9
mov eax, dword [ebp - 0x1584]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor al, al
jmp 0x441d6a
push 0
push 0xfffffffffffffffe
push 0x7e9
mov edx, dword [ebp - 0x1584]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 5
push 1
lea ecx, [ebp - 0x12b0]
push ecx
lea edx, [ebp - 0x218]
push edx
call sym.Install_style.exe_int___cdecl_DoRun_wchar_t_const___wchar_t_const___int__int_
add esp, 0x10
push 0
push 0x2710
push 0x7e9
mov eax, dword [ebp - 0x1584]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042047a
mov esp, ebp
pop ebp
ret
Function at 0x443cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x464080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00421340
add esp, 0xc
mov dword [ebp - 0x214], 0x208
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp + 8]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x443d75
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x443d60
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
jmp 0x443d7b
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042047a
mov esp, ebp
pop ebp
ret

Function at 0x443d90
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x464080]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x443dbc
xor eax, eax
jmp 0x443e19
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x443de6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x443e19
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042047a
mov esp, ebp
pop ebp
ret
Function at 0x443e30
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x443e55
xor eax, eax
jmp 0x443f20
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 1
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x443ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x443ec2
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x443ec0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x443f20
jmp 0x443ed0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x443f20
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x443f07
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x443f07
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x443f20
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x444710
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x457ec8
mov eax, dword [ebp + 8]
push eax
call fcn.0042cede
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444732
xor eax, eax
jmp 0x444759
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042cd9b
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042ab2a
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x444760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x457ec0
mov eax, dword [ebp + 8]
push eax
call fcn.0042cede
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444782
xor eax, eax
jmp 0x4447b0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042def2
add esp, 0x10
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call fcn.0042ab2a
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x444820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x44485b
xor eax, eax
jmp 0x444916
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x444879
xor eax, eax
jmp 0x444916
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4448ab
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x444916
mov eax, dword [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4448c4
jmp 0x444909
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00421d50
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x444920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x444953
xor eax, eax
jmp 0x4449c3
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44496e
xor eax, eax
jmp 0x4449c3
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4449a0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x4449c3
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00421d50
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4449d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x444a01
xor eax, eax
jmp 0x444a71
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x444a1c
xor eax, eax
jmp 0x444a71
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x444a4e
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x444a71
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00421d50
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x444a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x444ab3
xor eax, eax
jmp 0x444b23
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x444ace
xor eax, eax
jmp 0x444b23
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x444b00
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x444b23
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
call sym.Install_style.exe_int___cdecl_NsWriteFile_wchar_t_const___void___unsigned_long_int_
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x444b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x444b61
xor eax, eax
jmp 0x444bd1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x444b7c
xor eax, eax
jmp 0x444bd1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x444bae
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x444bd1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call sym.Install_style.exe_int___cdecl_NsWriteFile_wchar_t_const___void___unsigned_long_int_
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
mov esp, ebp
pop ebp
ret