joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405770
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x405791
push 0x57c308
mov ecx, dword [ebp - 0x14]
call fcn.00405590
mov dword [ebp - 4], eax
jmp 0x4057a1
push 0x57c3a8
mov ecx, dword [ebp - 0x14]
call fcn.00405590
mov dword [ebp - 4], eax
cmp dword [0x57c264], 0
je 0x405877
cmp dword [ebp - 4], 0
je 0x405877
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x405837
mov ecx, dword [ebp + 8]
push ecx
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call sub.IMM32.dll_ImmGetOpenStatus
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4057f4
push 0
mov eax, dword [ebp - 8]
push eax
call sub.IMM32.dll_ImmSetOpenStatus
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.IMM32.dll_ImmReleaseContext
push 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov ecx, dword [ebp + 8]
push ecx
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
je 0x40582a
push 1
mov edx, dword [ebp - 8]
push edx
call sub.IMM32.dll_ImmSetOpenStatus
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.IMM32.dll_ImmReleaseContext
cmp dword [0x57ad5c], 0
je 0x405877
mov edx, dword [ebp + 8]
push edx
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40586a
mov eax, dword [ebp - 8]
push eax
call sub.IMM32.dll_ImmGetOpenStatus
test eax, eax
jne 0x40586a
push 1
mov ecx, dword [ebp - 8]
push ecx
call sub.IMM32.dll_ImmSetOpenStatus
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.IMM32.dll_ImmReleaseContext
mov esp, ebp
pop ebp
ret 8
Function at 0x445860
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x584fc0]
call fcn.004e2d7f
mov dword [ebp - 8], eax
cmp dword [0x57c264], 0
je 0x44598d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + eax*4 + 0xcc], 0
je 0x44598d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + edx*4 + 0xcc]
je 0x445943
mov ecx, dword [ebp - 0x14]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call sub.IMM32.dll_ImmGetOpenStatus
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4458e7
push 0
mov eax, dword [ebp - 4]
push eax
call sub.IMM32.dll_ImmSetOpenStatus
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmReleaseContext
push 8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx*4 + 0xcc]
push ecx
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov ecx, dword [ebp - 0x14]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x445931
push 1
mov edx, dword [ebp - 4]
push edx
call sub.IMM32.dll_ImmSetOpenStatus
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmReleaseContext
cmp dword [0x57ad5c], 0
je 0x44598d
mov ecx, dword [ebp - 0x14]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44598d
mov ecx, dword [ebp - 4]
push ecx
call sub.IMM32.dll_ImmGetOpenStatus
test eax, eax
jne 0x44597b
push 1
mov edx, dword [ebp - 4]
push edx
call sub.IMM32.dll_ImmSetOpenStatus
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004137d0
push eax
call sub.IMM32.dll_ImmReleaseContext
mov esp, ebp
pop ebp
ret 4
Function at 0x4460d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528fec
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
lea ecx, [ebp - 0x10]
call fcn.00401b80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401b80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.0041def0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.004dcb08
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004e82b0
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x446279
mov eax, dword [ebp + 8]
push eax
push 0xefb3
lea ecx, [ebp - 0x10]
push ecx
call fcn.0042e2e0
add esp, 0xc
push 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x24
lea ecx, [ebp - 0x14]
call fcn.004d6200
push eax
lea ecx, [ebp - 0x10]
call fcn.004d6200
push eax
mov ecx, dword [ebp - 0x268]
call fcn.004da052
cmp eax, 7
jne 0x4461ca
mov dword [ebp - 0x254], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d61e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d61e0
mov eax, dword [ebp - 0x254]
jmp 0x446311
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x446249
push 0xefb4
lea ecx, [ebp - 0x10]
call fcn.00401d90
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x30
lea ecx, [ebp - 0x14]
call fcn.004d6200
push eax
lea ecx, [ebp - 0x10]
call fcn.004d6200
push eax
mov ecx, dword [ebp - 0x268]
call fcn.004da052
mov dword [ebp - 0x258], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d61e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d61e0
mov eax, dword [ebp - 0x258]
jmp 0x446311
mov dword [ebp - 0x25c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d61e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d61e0
mov eax, dword [ebp - 0x25c]
jmp 0x446311
movzx eax, byte [ebp - 0x22c]
and eax, 0x10
jne 0x4462e6
push 0xefb5
lea ecx, [ebp - 0x10]
call fcn.00401d90
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x30
lea ecx, [ebp - 0x14]
call fcn.004d6200
push eax
lea ecx, [ebp - 0x10]
call fcn.004d6200
push eax
mov ecx, dword [ebp - 0x268]
call fcn.004da052
mov dword [ebp - 0x260], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d61e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d61e0
mov eax, dword [ebp - 0x260]
jmp 0x446311
mov dword [ebp - 0x264], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004d61e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d61e0
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret 4
Function at 0x449fa0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529684
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x578750]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x30], 0xf3f3f3
lea ecx, [ebp - 0x2c]
call fcn.0044a890
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push eax
push 1
push 0
lea ecx, [ebp - 0x2c]
call fcn.0044a900
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004e081e
push 5
push 5
lea ecx, [ebp - 0xa4]
call fcn.0041cd80
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0xac]
add eax, 0x58
push eax
mov ecx, dword [ebp + 8]
call fcn.0044aa00
lea ecx, [ebp - 0x24]
call fcn.00401840
mov byte [ebp - 4], 1
push 0x5c
push 0
lea ecx, [ebp - 0x94]
push ecx
call fcn.00504b10
add esp, 0xc
push 0x53db48
lea edx, [ebp - 0x78]
push edx
call fcn.00504ae3
add esp, 8
mov byte [ebp - 0x7d], 0x80
mov dword [ebp - 0x94], 0x16
mov dword [ebp - 0x84], 0x2bc
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x24]
call fcn.004228b0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x28]
call edx
lea ecx, [ebp - 0x1c]
call fcn.00407ab0
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 0xac]
mov eax, dword [edx + 0x60]
push eax
mov ecx, dword [ebp - 0xac]
mov edx, dword [ecx + 0x5c]
add edx, 1
push edx
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax + 0x58]
add ecx, 2
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0044a860
push 0xf
push 4
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0044a970
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x30]
call edx
push 1
mov ecx, dword [ebp + 8]
call fcn.004dfbc3
push 0x53db54
lea ecx, [ebp - 0xa8]
call fcn.0042abf0
mov byte [ebp - 4], 2
push 0x8025
mov eax, dword [ebp - 0xac]
add eax, 0x58
push eax
lea ecx, [ebp - 0xa8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0044aa70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.004d61e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00401aa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0044a8e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.00504a55
mov esp, ebp
pop ebp
ret 4
Function at 0x44ac50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x44ac6d
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
cmp edx, dword [ebp + 8]
je 0x44ade2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0x53e0a8
push str.BIG5_GB
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push 0x53e0c8
push str.GB_BIG5
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push 0x53e0e8
push str.CWH_CWK
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
push 0x53e108
push str.BIG5_CWH
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push 0x53e12c
push str.CWH_BIG5
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push 0x53e150
push str.UNI_CWH
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [0x57a1c0], eax
push 0x53e170
push str.CWH_UNI
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [0x57a1bc], eax
push 0x53e190
push str.UNI_CWK
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [0x57a1b8], eax
push 0x53e1b0
push str.CWK_UNI
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [0x57a1b4], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x44b760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
cmp ecx, 0xa1
jl 0x44b784
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
cmp eax, 0xf9
jle 0x44b796
mov ecx, dword [ebp + 8]
mov byte [ecx], 0x81
mov edx, dword [ebp + 8]
mov byte [edx + 1], 0x40
jmp 0x44b899
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
cmp ecx, 0x40
jl 0x44b7bd
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 1]
cmp eax, 0x7f
jle 0x44b7cf
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 1]
cmp edx, 0xa0
jge 0x44b7cf
mov eax, dword [ebp + 8]
mov byte [eax], 0x81
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], 0x40
jmp 0x44b899
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
sub edx, 0xa1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
sub ecx, 0x40
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 1]
cmp eax, 0xa0
jl 0x44b812
mov ecx, dword [ebp - 0x18]
sub ecx, 0x20
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shr edx, 4
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
shl eax, 4
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x15a
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x22
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 6]
mov eax, dword [ebp - 4]
mov cl, byte [edx + eax*2]
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x22
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 6]
mov edx, dword [ebp - 4]
mov al, byte [ecx + edx*2 + 1]
mov byte [ebp - 0xb], al
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
call fcn.0044ce60
movzx eax, byte [ebp - 0xc]
cmp eax, 0x3f
jne 0x44b889
mov ecx, dword [ebp + 8]
mov byte [ecx], 0x81
mov edx, dword [ebp + 8]
mov byte [edx + 1], 0xac
jmp 0x44b899
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0044aea0
mov esp, ebp
pop ebp
ret 8
Function at 0x44b910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x44ba52
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
cmp eax, 0xa1
jl 0x44ba39
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
cmp edx, 0xf9
jg 0x44ba39
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
cmp ecx, 0x40
jl 0x44b97f
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 1]
cmp eax, 0x80
jl 0x44b991
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 1]
cmp edx, 0x9f
jg 0x44b991
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x81
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 1], 0x40
jmp 0x44ba37
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
sub eax, 0xa1
mov word [ebp - 8], ax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 1]
sub edx, 0x40
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov word [ebp - 4], ax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
cmp ecx, 0xa0
jl 0x44b9d9
movzx edx, word [ebp - 4]
sub edx, 2
mov word [ebp - 4], dx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
and ecx, 0xf
mov word [ebp - 0xc], cx
movzx edx, word [ebp - 0xc]
shl edx, 1
mov word [ebp - 0xc], dx
movzx eax, word [ebp - 8]
imul eax, eax, 0x15a
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
movzx ecx, word [ebp - 4]
imul ecx, ecx, 0x22
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 6]
movzx ecx, word [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov al, byte [eax + ecx]
mov byte [edx], al
movzx ecx, word [ebp - 4]
imul ecx, ecx, 0x22
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 6]
movzx ecx, word [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov al, byte [eax + ecx + 1]
mov byte [edx + 1], al
jmp 0x44ba46
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0x81
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0x40
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0044ce60
mov esp, ebp
pop ebp
ret 8
Function at 0x44ba60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
cmp ecx, 0x81
jl 0x44baa0
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
cmp eax, 0x9f
jle 0x44ba92
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
cmp edx, 0xe0
jl 0x44baa0
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
cmp ecx, 0xfc
jle 0x44bab2
mov edx, dword [ebp + 8]
mov byte [edx], 0xa1
mov eax, dword [ebp + 8]
mov byte [eax + 1], 0x40
jmp 0x44bb77
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 1]
cmp edx, 0x40
jge 0x44bad0
mov eax, dword [ebp + 8]
mov byte [eax], 0xa1
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], 0x40
jmp 0x44bb77
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
sub edx, 0x81
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
cmp ecx, 0xe0
jl 0x44bb06
mov edx, dword [ebp - 0xc]
sub edx, 0x40
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
sub ecx, 0x40
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
shr edx, 4
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 4
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x19e
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x22
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 6]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dl, byte [edx + ecx*2]
mov byte [eax], dl
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x22
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 6]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dl, byte [edx + ecx*2 + 1]
mov byte [eax + 1], dl
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.0044ce60
mov esp, ebp
pop ebp
ret 8
Function at 0x44bb80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0044b200
movzx edx, byte [ebp - 8]
cmp edx, 0xa1
jl 0x44bbb0
movzx eax, byte [ebp - 8]
cmp eax, 0xff
jne 0x44bbc2
mov ecx, dword [ebp + 8]
mov byte [ecx], 0xa1
mov edx, dword [ebp + 8]
mov byte [edx + 1], 0x40
jmp 0x44bc84
movzx eax, byte [ebp - 7]
cmp eax, 0xa0
jge 0x44bbdf
mov ecx, dword [ebp + 8]
mov byte [ecx], 0xa1
mov edx, dword [ebp + 8]
mov byte [edx + 1], 0x40
jmp 0x44bc84
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
movzx edx, byte [ebp - 8]
sub edx, 0xa1
mov dword [ebp - 0xc], edx
movzx eax, byte [ebp - 7]
sub eax, 0xa0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
shr ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shl edx, 4
mov eax, dword [ebp - 0x18]
sub eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xd2
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x22
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 6]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + eax*2]
mov byte [edx], cl
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x22
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 6]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + eax*2 + 1]
mov byte [edx + 1], cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
call fcn.0044ce60
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0x3f
jne 0x44bc84
mov eax, dword [ebp + 8]
mov byte [eax], 0xa2
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], 0xa4
mov esp, ebp
pop ebp
ret 8
Function at 0x44bef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0xc]
movzx cx, byte [eax + 1]
mov word [ebp - 8], cx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
shl eax, 8
movzx ecx, word [ebp - 8]
add ecx, eax
mov word [ebp - 8], cx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
cmp eax, 0xf0
jl 0x44bfeb
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
cmp edx, 0xf4
jg 0x44bfeb
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
cmp ecx, 0x40
jge 0x44bf59
mov edx, dword [ebp + 8]
mov byte [edx], 0x81
mov eax, dword [ebp + 8]
mov byte [eax + 1], 0x40
jmp 0x44bfe9
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
sub ecx, 0xf0
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 1]
sub eax, 0x40
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
shr ecx, 4
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
shl edx, 4
mov eax, dword [ebp - 0x18]
sub eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x19e
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x22
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx + 6]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + eax*2]
mov byte [edx], cl
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x22
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx + 6]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov cl, byte [ecx + eax*2 + 1]
mov byte [edx + 1], cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xc]
push eax
call fcn.0044ce60
jmp 0x44c057
movzx ecx, word [ebp - 8]
cmp ecx, 0xf9d0
jl 0x44c041
movzx edx, word [ebp - 8]
cmp edx, 0xf9fc
jg 0x44c041
movzx eax, word [ebp - 8]
sub eax, 0xf9d0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dx, word [ecx*2 + 0x5761d0]
mov word [ebp - 8], dx
movzx eax, word [ebp - 8]
and eax, 0xff00
sar eax, 8
mov ecx, dword [ebp + 8]
mov byte [ecx], al
movzx edx, word [ebp - 8]
and edx, 0xff
mov eax, dword [ebp + 8]
mov byte [eax + 1], dl
jmp 0x44c057
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 1]
mov byte [ecx + 1], al
mov esp, ebp
pop ebp
ret 8