joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
lea edi, [ecx + 0x200]
lea eax, [ecx + 0x1ff]
mov byte [edi], 1
mov word [ecx + 0x300], 0
mov byte [ecx + 0x201], 3
mov byte [ecx + 0x303], 1
mov dword [esp + 0x18], 2
lea esi, [eax + 2]
sub edi, eax
lea esp, [esp]
mov dl, byte [esi]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
xor al, dl
mov byte [edi + esi], al
movzx edx, al
mov eax, dword [esp + 0x18]
mov byte [edx + ecx + 0x300], al
inc eax
inc esi
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x4010e0
mov byte [ecx], 0x63
mov byte [ecx + 0x163], 0
mov edx, 1
movzx eax, dl
movzx eax, byte [eax + ecx + 0x300]
mov esi, ecx
sub esi, eax
mov bl, byte [esi + 0x2ff]
mov al, bl
rol al, 1
xor bl, al
rol al, 1
mov byte [esp + 0x18], al
xor bl, al
rol al, 1
mov byte [esp + 0x18], al
rol al, 1
xor al, bl
xor al, byte [esp + 0x18]
xor al, 0x63
mov byte [edx + ecx], al
movzx eax, al
mov byte [eax + ecx + 0x100], dl
inc edx
cmp edx, 0x100
jl 0x401121
mov al, 1
lea esi, [ecx + 0xc00]
mov edi, 0x1e
movzx edx, al
mov dword [esi], edx
mov dl, al
and dl, 0x80
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
add esi, 4
dec edi
jne 0x401177
lea edi, [ecx + 0x100]
lea ebp, [ecx + 0x800]
mov dword [esp + 0x10], pe_nt_image_headers32
mov dl, byte [edi - 0x100]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
mov bl, al
xor bl, dl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x19], dl
mov byte [esp + 0x18], al
mov byte [esp + 0x1b], bl
mov eax, dword [esp + 0x18]
mov dword [ebp - 0x400], eax
mov al, byte [edi]
xor dl, dl
cmp al, dl
je 0x40126f
movzx edx, al
movzx esi, byte [edx + ecx + 0x300]
movzx eax, byte [ecx + 0x30b]
add eax, esi
cdq
mov ebx, 0xff
idiv ebx
mov al, byte [edx + ecx + 0x200]
mov byte [esp + 0x1b], al
movzx eax, byte [ecx + 0x30d]
add eax, esi
cdq
idiv ebx
movzx eax, byte [ecx + 0x309]
add eax, esi
mov dl, byte [edx + ecx + 0x200]
mov byte [esp + 0x1a], dl
cdq
idiv ebx
mov al, byte [edx + ecx + 0x200]
mov byte [esp + 0x19], al
movzx eax, byte [ecx + 0x30e]
add eax, esi
cdq
mov esi, ebx
idiv esi
mov dl, byte [edx + ecx + 0x200]
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
add ebp, 4
inc edi
dec dword [esp + 0x10]
jne 0x4011a6
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x19], dl
jmp 0x401250
Function at 0x402300
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x402389
push ebp
dec ebx
push esi
mov esi, dword [esp + 0x14]
shr ebx, 4
push edi
mov edi, dword [esp + 0x14]
inc ebx
lea ecx, [ecx]
lea eax, [esi + 1]
lea ecx, [edi + 0x1075]
mov ebp, 4
mov edi, edi
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
dec ebp
jne 0x402330
push esi
push edi
call fcn.00401a20
mov eax, dword [esi]
mov dword [edi + 0x1074], eax
mov ecx, dword [esi + 4]
mov dword [edi + 0x1078], ecx
mov edx, dword [esi + 8]
mov dword [edi + 0x107c], edx
mov eax, dword [esi + 0xc]
add esp, 8
add esi, 0x10
dec ebx
mov dword [edi + 0x1080], eax
jne 0x402320
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4023e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x4024a0
push ebp
dec ebx
push esi
mov esi, dword [esp + 0x10]
shr ebx, 4
push edi
mov edi, dword [esp + 0x18]
inc ebx
lea ecx, [ecx]
mov eax, dword [edi]
mov dword [esi + 0x1074], eax
mov ecx, dword [edi + 4]
mov dword [esi + 0x1078], ecx
mov edx, dword [edi + 8]
mov dword [esi + 0x107c], edx
mov eax, dword [edi + 0xc]
push edi
push esi
mov dword [esi + 0x1080], eax
call fcn.00401e70
add esp, 8
lea eax, [edi + 1]
lea ecx, [esi + 0x1085]
mov ebp, 4
jmp 0x402440
movzx edx, byte [ecx - 1]
xor byte [eax - 1], dl
movzx edx, byte [ecx]
xor byte [eax], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx + 2]
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
dec ebp
jne 0x402440
mov eax, dword [esi + 0x1074]
mov ecx, dword [esi + 0x1078]
mov edx, dword [esi + 0x107c]
mov dword [esi + 0x1084], eax
mov eax, dword [esi + 0x1080]
mov dword [esi + 0x1088], ecx
add edi, 0x10
dec ebx
mov dword [esi + 0x108c], edx
mov dword [esi + 0x1090], eax
jne 0x402400
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402c60
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x104], ecx
mov dword [eax + 0x100], ecx
mov dword [eax + 0x108], 0x6a09e667
mov dword [eax + 0x10c], 0xbb67ae85
mov dword [eax + 0x110], 0x3c6ef372
mov dword [eax + 0x114], 0xa54ff53a
mov dword [eax + 0x118], 0x510e527f
mov dword [eax + 0x11c], 0x9b05688c
mov dword [eax + 0x120], 0x1f83d9ab
mov dword [eax + 0x124], 0x5be0cd19
mov dword [eax], 0x428a2f98
mov dword [eax + 4], 0x71374491
mov dword [eax + 8], 0xb5c0fbcf
mov dword [eax + 0xc], 0xe9b5dba5
mov dword [eax + 0x10], 0x3956c25b
mov dword [eax + 0x14], 0x59f111f1
mov dword [eax + 0x18], 0x923f82a4
mov dword [eax + 0x1c], 0xab1c5ed5
mov dword [eax + 0x20], 0xd807aa98
mov dword [eax + 0x24], 0x12835b01
mov dword [eax + 0x28], 0x243185be
mov dword [eax + 0x2c], 0x550c7dc3
mov dword [eax + 0x30], 0x72be5d74
mov dword [eax + 0x34], 0x80deb1fe
mov dword [eax + 0x38], 0x9bdc06a7
mov dword [eax + 0x3c], 0xc19bf174
mov dword [eax + 0x40], 0xe49b69c1
mov dword [eax + 0x44], 0xefbe4786
mov dword [eax + 0x48], 0xfc19dc6
mov dword [eax + 0x4c], 0x240ca1cc
mov dword [eax + 0x50], 0x2de92c6f
mov dword [eax + 0x54], 0x4a7484aa
mov dword [eax + 0x58], 0x5cb0a9dc
mov dword [eax + 0x5c], 0x76f988da
mov dword [eax + 0x60], 0x983e5152
mov dword [eax + 0x64], 0xa831c66d
mov dword [eax + 0x68], 0xb00327c8
mov dword [eax + 0x6c], 0xbf597fc7
mov dword [eax + 0x70], 0xc6e00bf3
mov dword [eax + 0x74], 0xd5a79147
mov dword [eax + 0x78], 0x6ca6351
mov dword [eax + 0x7c], 0x14292967
mov dword [eax + 0x80], 0x27b70a85
mov dword [eax + 0x84], 0x2e1b2138
mov dword [eax + 0x88], 0x4d2c6dfc
mov dword [eax + 0x8c], 0x53380d13
mov dword [eax + 0x90], 0x650a7354
mov dword [eax + 0x94], 0x766a0abb
mov dword [eax + 0x98], 0x81c2c92e
mov dword [eax + 0x9c], 0x92722c85
mov dword [eax + 0xa0], 0xa2bfe8a1
mov dword [eax + 0xa4], 0xa81a664b
mov dword [eax + 0xa8], 0xc24b8b70
mov dword [eax + 0xac], 0xc76c51a3
mov dword [eax + 0xb0], 0xd192e819
mov dword [eax + 0xb4], 0xd6990624
mov dword [eax + 0xb8], 0xf40e3585
mov dword [eax + 0xbc], 0x106aa070
mov dword [eax + 0xc0], 0x19a4c116
mov dword [eax + 0xc4], 0x1e376c08
mov dword [eax + 0xc8], 0x2748774c
mov dword [eax + 0xcc], 0x34b0bcb5
mov dword [eax + 0xd0], 0x391c0cb3
mov dword [eax + 0xd4], 0x4ed8aa4a
mov dword [eax + 0xd8], 0x5b9cca4f
mov dword [eax + 0xdc], 0x682e6ff3
mov dword [eax + 0xe0], 0x748f82ee
mov dword [eax + 0xe4], 0x78a5636f
mov dword [eax + 0xe8], 0x84c87814
mov dword [eax + 0xec], 0x8cc70208
mov dword [eax + 0xf0], 0x90befffa
mov dword [eax + 0xf4], 0xa4506ceb
mov dword [eax + 0xf8], 0xbef9a3f7
mov dword [eax + 0xfc], 0xc67178f2
ret
Function at 0x444b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x444b79
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x444bb2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x444bae
lea ebx, [ebx]
cmp esi, eax
jae 0x444bb2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x444ba0
cmp esi, eax
jb 0x444bb8
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x445d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x744768
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x756a90]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
push 0x58
push eax
lea ebx, [esi + 0x20]
push ebx
mov dword [esp + 0x2c], eax
call fcn.00737190
mov edx, dword [esp + 0x34]
xor eax, eax
xor ecx, ecx
lea edi, [esi + 0x27c]
lea ebp, [esi + 0x7c]
add esp, 0xc
mov word [edi], ax
mov word [ebp], cx
mov dword [esi + 0x78], edx
mov dword [ebx], 0x58
call fcn.00444c50
test al, al
je 0x445ddc
mov dword [ebx], 0x4c
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
or ecx, 0x880020
mov dword [esi + 0x5c], eax
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x44], ebp
mov dword [esi + 0x48], pe_nt_image_headers32
mov dword [esi + 0x2c], edx
mov eax, dword [0x758a98]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x64], 0x445a60
mov dword [esi + 0x24], ecx
test eax, eax
je case.0x445e46.0
push 0xffffffffffffffff
push eax
push 0x104
push edi
call fcn.0073776c
add esp, 0x10
cmp eax, 0x50
ja case.0x445e46.1
movzx edx, byte [eax + 0x445e94]
jmp dword [edx*4 + 0x445e84]
push 0x8007000e
call fcn.004445d0
push 0x80070057
call fcn.004445d0
push 0x80004005
call fcn.004445d0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18
Function at 0x4460b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7447d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x756a90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [0x7579a0]
mov edx, dword [eax + 0xc]
xor esi, esi
mov ecx, 0x7579a0
mov dword [esp + 0x24], esi
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov ecx, ebp
mov byte [esp + 0x24], 1
call fcn.00444fa0
mov ebx, dword [esp + 0x30]
test ebx, ebx
jle 0x4461a8
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4461fd
lea ecx, [esp + 0x30]
push ecx
push 1
push eax
mov dword [esp + 0x3c], 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
test eax, eax
js 0x446207
mov edi, dword [esp + 0x30]
cmp esi, edi
jl 0x44620d
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
test eax, eax
js 0x446207
cmp esi, dword [esp + 0x14]
jg 0x44620d
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx + 0xc]
sub eax, edi
movzx edx, byte [eax + esi]
push edx
lea eax, [esp + 0x1c]
push 0x7479d8
push eax
call fcn.00445af0
mov edi, dword [esp + 0x24]
mov eax, dword [edi - 0xc]
add esp, 0xc
push eax
push edi
mov ecx, ebp
call fcn.00445850
inc esi
cmp esi, ebx
jl 0x44610d
lea eax, [edi - 0x10]
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4461c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4461e7
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
test eax, eax
js 0x4461e7
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
push 0x80004005
call fcn.004445d0
push eax
call fcn.004445d0
push 0x80070057
call fcn.004445d0
int3

Function at 0x446420
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x58]
call fcn.00445f60
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 4
push 0
push 0x470
push eax
call dword [0x757af0]
mov ecx, dword [esi + 0xad]
mov edx, dword [esi + 0x8d]
mov edi, dword [0x757b08]
push ecx
push edx
call edi
mov eax, dword [esi + 0x5d]
mov ecx, dword [esi + 0x65]
push eax
push ecx
call edi
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f6
push edx
call edi
mov ecx, dword [esi + 0xb1]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push eax
call ebx
mov edx, dword [esi + 4]
push 0x3f7
push edx
call edi
mov ecx, dword [esi + 0xb1]
push ecx
push eax
call ebx
mov edx, dword [esi + 4]
push 0x3fb
push edx
call edi
mov ecx, dword [esi + 0xb1]
push ecx
push eax
call ebx
mov edx, dword [esi + 4]
push 0x3fc
push edx
call edi
mov ecx, dword [esi + 0xb1]
push ecx
push eax
call ebx
mov edx, dword [esi + 4]
push 0x3ff
push edx
call edi
mov ecx, dword [esi + 0xb1]
push ecx
push eax
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4476b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x744a18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x756a90]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], vtable.CEndUserUpdateController.0
call fcn.0044a080
mov dword [esp + 0x10], vtable.CUpdateManager.0
mov eax, dword [0x7579a0]
mov edx, dword [eax + 0xc]
mov ecx, 0x7579a0
mov dword [esp + 0x2c], 0
call edx
add eax, 0x10
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.0045fdb0
mov edx, dword [0x7579a0]
mov eax, dword [edx + 0xc]
mov ecx, 0x7579a0
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 8]
push ecx
lea edx, [esp + 0x10]
push 0x3ea
push edx
mov byte [esp + 0x38], 2
call fcn.004475d0
mov eax, dword [esi + 4]
add esp, 0xc
push 0x3ea
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [esp + 0xc]
push esi
push eax
call dword [0x757b08]
lea eax, [esi - 0x10]
mov byte [esp + 0x2c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44778f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4477b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], vtable.CEndUserUpdateController.0
call fcn.0044a0b0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret
Function at 0x44aae0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x744f19
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x756a90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x18], edi
mov eax, dword [0x7579a0]
mov edx, dword [eax + 0xc]
mov ecx, 0x7579a0
mov dword [esp + 0x28], edi
call edx
mov ebx, dword [esp + 0x30]
add eax, 0x10
mov dword [ebx], eax
push 0x747d24
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], 1
call fcn.004466c0
mov esi, dword [esp + 0x34]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], 1
cmp ecx, edi
jle 0x44ac4f
test edi, edi
js 0x44ac88
cmp edi, ecx
jg 0x44ac88
cmp dword [edx - 0xc], 0
movzx eax, word [eax + edi*2]
jle 0x44ab99
push eax
push edx
call fcn.00737ee6
add esp, 8
test eax, eax
je 0x44ab99
mov edx, dword [esp + 0x14]
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
jg 0x44ac41
mov eax, dword [esi]
cmp edi, dword [eax - 0xc]
jg 0x44ac88
movzx eax, word [eax + edi*2]
push eax
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0044aa10
add esp, 0xc
mov ecx, dword [eax]
mov esi, dword [ebx]
lea eax, [ecx - 0x10]
sub esi, 0x10
mov byte [esp + 0x28], 2
cmp eax, esi
je 0x44ac14
cmp dword [esi + 0xc], 0
lea ebp, [esi + 0xc]
jl 0x44ac08
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x44ac08
push eax
call fcn.00444e00
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebp], eax
dec eax
test eax, eax
jg 0x44abfb
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x30]
add ebx, 0x10
mov dword [ecx], ebx
mov ebx, ecx
jmp 0x44ac14
mov eax, dword [ecx - 0xc]
push eax
push ecx
mov ecx, ebx
call fcn.00445910
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x28], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44ac39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x34]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
inc edi
cmp edi, ecx
jl 0x44ab60
lea eax, [edx - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44ac70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
push 0x80070057
call fcn.004445d0
int3
Function at 0x44ccf0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x7453c0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x756a90]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x54]
mov ecx, dword [ebp]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jne 0x44cd44
call fcn.0044b320
test eax, eax
js 0x44cd4e
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, esi
or edx, eax
jne 0x44cd98
lea ecx, [esp + 0x1c]
call fcn.004447b0
push 0x74779c
mov dword [esp + 0x50], 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
test eax, eax
jne 0x44cd7c
push 0x8007000e
call fcn.004445d0
push 0
lea eax, [esp + 0x58]
push eax
push 0
push 0x1000018e
lea ecx, [esp + 0x2c]
mov byte [esp + 0x5c], 1
call fcn.00444870
test eax, eax
jne 0x44cda1
cmp esi, 0xffffffff
jbe 0x44cdeb
lea ecx, [esp + 0x1c]
call fcn.004447b0
push 0x74779c
mov dword [esp + 0x50], 2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
test eax, eax
jne 0x44cdcf
push 0x8007000e
call fcn.004445d0
push 0
lea ecx, [esp + 0x58]
push ecx
push 0
push 0x1000018e
lea ecx, [esp + 0x2c]
mov byte [esp + 0x5c], 3
call fcn.00444870
lea edi, [esi + 1]
push edi
call fcn.0073815e
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x44ce53
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x44ce0b
call esi
lea ecx, [esp + 0x1c]
call fcn.004447b0
push 0x74779c
mov dword [esp + 0x50], 4
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
test eax, eax
jne 0x44ce39
push 0x8007000e
call fcn.004445d0
push 0
lea edx, [esp + 0x58]
push edx
push 0
mov byte [esp + 0x58], 5
call esi
push eax
lea ecx, [esp + 0x2c]
call fcn.00444870
push edi
push 0
push eax
call fcn.00737190
mov eax, dword [ebx]
add esp, 0xc
push esi
push eax
mov ecx, ebp
call fcn.0044cc70
mov edi, eax
test edi, edi
je 0x44cebb
jns 0x44cebb
lea ecx, [esp + 0x30]
call fcn.004447b0
push 0x74779c
mov dword [esp + 0x50], 6
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x54], eax
test eax, eax
jne 0x44cea0
push 0x8007000e
call fcn.004445d0
push 0
lea ecx, [esp + 0x58]
push ecx
movzx edx, di
push 0
push edx
lea ecx, [esp + 0x40]
mov byte [esp + 0x5c], 7
call fcn.00444870
mov dword [ebx + 4], esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4
Function at 0x454a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x7458d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x756a90]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x418]
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [0x757a80]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x454b02
call fcn.0044b320
mov edi, eax
jmp 0x454bc9
push ebx
push edi
push esi
call dword [0x757a64]
mov edi, eax
test edi, edi
jne 0x454b1b
call fcn.0044b320
jmp 0x454bc0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x454b36
call fcn.0044b320
jmp 0x454bc0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
cmp eax, edi
jae 0x454b51
mov edi, 0x8007000e
jmp 0x454bc2
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.0044e930
mov dword [ebp - 4], 1
jmp 0x454b7d
mov eax, dword [ebp]
test eax, eax
jne 0x454b8b
mov edi, 0x8007000e
jmp 0x454bc2
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [0x757a84]
test eax, eax
jne 0x454ba4
call fcn.0044b320
jmp 0x454bc0
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.0044f790
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x454be0
lea ecx, [ebp]
call fcn.0044dfd0
lea esp, [esp]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00737092
lea esp, [ebp + 0x408]
pop ebp
ret 0x10